top of page
Search
  • Writer's pictureotw

Bluetooth Hacking: Injecting Commands into a Bluetooth Device with BlueDucky

Updated: Apr 29

Welcome back, my aspiring cyberwarriors!


Bluetooth is a nearly ubiquitous protocol used to communicate between devices in close proximity or a piconet, such as speakers, headphones, and cellphones. If an attacker can exploit Bluetooth, it may be able to take control of or eavesdrop on any of these devices.




There are numerous classes of Bluetooth devices. These different classes are announced to the connecting device in the banner. In previous Bluetooth tutorials here, we have discussed probably the most important class for exploiting Bluetooth devices, the HID class. This class of devices is known as Human Interface Devices and includes such things as Bluetooth mice and keyboards. These are the devices that are allowed to send inputs to the Bluetooth-enabled device necessary for keyboards and mice to function properly.


In 2023, a new vulnerability was discovered in Bluetooth that may allow an unauthenticated HID Device to initiate and establish an encrypted connection. If this happens, the HID device may be able to inject commands into the device. This exploit works against unpatched Android 11 and later devices and any Android 10 and earlier device, as there is no patch presently available for these devices. A Proof Of Concept or POC was released in January 2024 and was recently integrated into a new tool known as BlueDucky.


Let's take a look at this tool and see what it can do.



Step # 1 Download and Install BlueDucky


To install BlueDucky, we need to do a few things to get our system ready.


First, update your apt cache.


kali > sudo apt update


Next, install the necessary dependencies from the Kali repository.


kali > sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev git gcc python3-pip python3-setuptools python3-pydbus


We n0w need to get bluez from github.com. If you have done my previous tutorials on bluetooth, you likely already have this.



Now, move into the new directory, pybluez.


kali > cd pybluez


We now need to run the setup script for bluez


kali > python3 setup.py install


Next, we need to build bdaddr from source. bdaddr enables us to query or set the local Bluetooth device address.


kali > cd ~


kali > git clone --depth=1 https://github.com/bluez/bluez.git


kali > gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth


Now, let copy bdaddr to our local binary directory (/usr/local/bin) so that we can use it in our script from anywhere (/usr/local/bin is in the Linux $PATH variable).


kali > sudo cp bdaddr /usr/local/bin


Finally, we should download BlueDucky from github.



kali > cd BlueDucky


kali > sudo hciconfig hci0 up


Step # 2 Run BlueDucky


Now that we have all of the elements necessary to run BlueDucky installed, let's try running it. If you are running it from a system with an external plug-in bluetooth adapter, as I am, you will likely need to make a small change to the python script. BlueDucky, by default, uses hci0 to scan for Bluetooth devices. If you added an external bluetooth device, it will likely be recognized as hci1. We can remedy this by simply opening the script in your favorite text editor and changing the default value to hci1. Here I have used the default GUI text editor in Kali, mousepad.


kali > sudo mousepad BlueDucky.py




Now, go ahead and save this file. Make certain to give yourself execute permissions.


kali > sudo chmod 755 BlueDucky.py


It's a good idea now to check to make certain your bluetooth adapter is up and activated.


kali > hciconfig hci1 up


If your adapter is up and running, it's time to start BlueDucky!


kali > sudo python3 BlueDucky.py




If you know the MAC address of the device, you can enter it here. If not, simply hit ENTER and BlueDucky will scan for available MAC addresses.





At this point, you can enter "yes"and then the number of the device. I selected "4", the Samsung Galaxy Note10+.


You will then be asked which payload you would like to use. There are two payloads available by default (you can build you own and place it in the payloads directory).


I've opened payload_example_1.txt in my text editor and edited line 13 to open the hackers-arise.com website on the target phone.

When I hit ENTER, BlueDucky connects to the target Android phone and opens the website as seen below!



Of course, you can send ANY arbitrary commands or website by simply editing the payloads files.


Summary


Bluetooth enabled devices are all around us in our everyday life. These includes phones, tablets, speakers, headsets, keyboards and many other devices. Bluetooth devices declare the type of the device they are before pairing with another device. This is the class of the device. This class declaration can be manipulated by an attacker to inject commands into the device.


BlueDucky is an automated tool for exploiting this vulnerability and although the tool only sends an innocuous message to the target, it can easily be altered to send malicious commands into the target device such as "shutdown" or "rm -rf".



5,874 views2 comments

Recent Posts

See All

2 則留言


lucyj7537
lucyj7537
6 days ago

I’m excited to write about Henry Hacker, he is a great and brilliant hacker who penetrated my spouse’s phone without a physical installation app. And I was able to access my spouse’s phone, SMS, Whatsapp, Instagram, Facebook, Wechat, Snapchat, Call Logs, Kik, Twitter and all social media. The most amazing thing there is that he restores all phone deleted text messages. And I also have access to everything including the phone gallery without touching the phone.I can see the whole secret of my spouse. Contact him for any hacking service. He is also a genius in repairing Credit Score, increasing school grade, Clear Criminal Record etc. His service is fast. Contact:, Henryclarkethicalhacker@gmail.com and you can text, call him on whatsapp him on…

按讚

Hello Everyone, we sell loaded and programmed ATM cards that can be used in withdrawing cash at any ATM stand. We sell this cards to interested buyers worldwide. you can contact us with this address for further information....Email: garryfrank226 @ gmail . com.....whatsapp number..+1(332) 242 - 5663.

按讚
bottom of page