BlueBorne Android Bluetooth Remote Code Execution

This eight-file Python repository implements a nearby, unauthenticated Bluetooth exploit chain for Android BlueBorne vulnerabilities. `exp4.py` is the primary entry point: it randomizes the attacker's Bluetooth address, invokes the SDP information leak implemented by `bluedroid.py` to derive libc and BlueDroid BSS bases, stores a ROP-like command payload in the attacker Bluetooth name, then uses BNEP heap grooming and repeated malformed packets to exploit an 8-byte heap overflow and redirect execution to libc `system()`. Its offsets are hard-coded and therefore target-specific; comments identify a Nexus 5 Android 6.0.1 profile, while the README describes testing an intentionally unpatched Android 7.1.2/LineageOS build. `leak.py` is a separate Pwntools-based CVE-2017-0785 SDP stack-leak PoC. `btsock.py`, `sdp.py`, and `utils.py` provide L2CAP and SDP packet/structure helpers. `connectback.py` is auxiliary code for three TCP listeners and an interactive toybox-netcat shell channel, but is not enabled by the default exploit path. The README documents BlueBorne context, debugger output, and the default proof-file payload rather than supplying additional executable logic.

This repository is a functional proof-of-concept exploit for the BlueBorne Bluetooth vulnerabilities affecting Android devices, specifically targeting CVE-2017-0781 (RCE) and CVE-2017-0785 (information leak). The exploit is implemented in Python and is structured into several modules: - `exp4.py` is the main exploit script, orchestrating the attack. It first uses a memory leak (via SDP protocol) to bypass ASLR, then crafts a payload to achieve remote code execution by exploiting heap overflows in the Bluetooth stack. The default payload creates a file on the target device, but it can be modified for other actions (e.g., reverse shell). - `bluedroid.py`, `btsock.py`, and `sdp.py` provide lower-level Bluetooth protocol manipulation, including L2CAP and SDP packet crafting and parsing. - `connectback.py` contains code for establishing a reverse shell connection, which can be used as a payload for more interactive access. - `leak.py` is a standalone script for exploiting the information leak (CVE-2017-0785) to obtain memory addresses from the target device. - `utils.py` provides utility functions for struct packing/unpacking. The exploit requires the attacker to be within Bluetooth range of the target device, which must have Bluetooth enabled and be unpatched for the BlueBorne vulnerabilities. No user interaction is required on the target. The exploit demonstrates a full attack chain: information leak to bypass ASLR, followed by heap overflow to achieve code execution. The repository is operational and can be adapted for more advanced payloads. The only fingerprintable endpoint is the file `/data/local/tmp/test` created on the target as proof of exploitation.

This repository provides operational proof-of-concept exploits for the BlueBorne Bluetooth vulnerabilities, specifically targeting Android devices (CVE-2017-0781 for RCE and CVE-2017-0785 for information leak/ASLR bypass). The main exploit is implemented in 'android/doit.py', which orchestrates the attack by first leaking memory addresses via SDP (Service Discovery Protocol) to bypass ASLR, then exploiting a heap overflow in the Bluetooth stack to achieve remote code execution. The payload is a reverse shell, implemented as a shell command using toybox nc, which connects back to the attacker's machine. The exploit requires a compatible Bluetooth adapter (CSR), specific vulnerable Android versions, and network accessibility for the reverse shell. The repository also includes a general L2CAP testing framework under 'l2cap_infra', which is used for low-level Bluetooth protocol manipulation and testing. No hardcoded IP addresses or domains are present, but the exploit targets specific system libraries for version-dependent offsets. The code is mature and functional, but not weaponized for mass exploitation.

This repository contains a proof-of-concept exploit for CVE-2017-0781, a heap overflow vulnerability in the Android Bluetooth stack (Blueborne). The main file, CVE-2017-0781.py, is a Python script that uses pwntools and pybluez to send malformed BNEP packets over a Bluetooth L2CAP connection to a specified target device (identified by its Bluetooth MAC address). The exploit repeatedly sends crafted packets to the target, causing a heap overflow and crashing the Bluetooth service, resulting in a denial of service. The README provides detailed setup and usage instructions, including required dependencies and troubleshooting steps. The exploit does not achieve code execution but demonstrates the ability to crash the service, serving as a proof-of-concept for the underlying vulnerability.