BlueBorne Android Bluetooth Information Disclosure

This eight-file Python repository implements a nearby, unauthenticated Bluetooth exploit chain for Android BlueBorne vulnerabilities. `exp4.py` is the primary entry point: it randomizes the attacker's Bluetooth address, invokes the SDP information leak implemented by `bluedroid.py` to derive libc and BlueDroid BSS bases, stores a ROP-like command payload in the attacker Bluetooth name, then uses BNEP heap grooming and repeated malformed packets to exploit an 8-byte heap overflow and redirect execution to libc `system()`. Its offsets are hard-coded and therefore target-specific; comments identify a Nexus 5 Android 6.0.1 profile, while the README describes testing an intentionally unpatched Android 7.1.2/LineageOS build. `leak.py` is a separate Pwntools-based CVE-2017-0785 SDP stack-leak PoC. `btsock.py`, `sdp.py`, and `utils.py` provide L2CAP and SDP packet/structure helpers. `connectback.py` is auxiliary code for three TCP listeners and an interactive toybox-netcat shell channel, but is not enabled by the default exploit path. The README documents BlueBorne context, debugger output, and the default proof-file payload rather than supplying additional executable logic.

This repository contains a Python proof-of-concept exploit for CVE-2017-0785, a Bluetooth SDP information leak vulnerability affecting Android devices. The main file, cve20170785.py, uses the 'pwn' and 'bluetooth' Python libraries to craft and send malicious SDP packets over a Bluetooth L2CAP connection to a specified target device (identified by its Bluetooth MAC address). The exploit attempts to leak memory from the target's Bluetooth stack by abusing the SDP protocol, saving the leaked data to 'leak.bin' and displaying a hexdump of the most interesting memory segment. The repository is structured simply, with a README and the exploit script. No hardcoded endpoints are present; the attacker must supply the target's Bluetooth address. The exploit is a POC and does not provide post-exploitation capabilities beyond memory disclosure.

This repository provides operational proof-of-concept exploits for the BlueBorne Bluetooth vulnerabilities, specifically targeting Android devices (CVE-2017-0781 for RCE and CVE-2017-0785 for information leak/ASLR bypass). The main exploit is implemented in 'android/doit.py', which orchestrates the attack by first leaking memory addresses via SDP (Service Discovery Protocol) to bypass ASLR, then exploiting a heap overflow in the Bluetooth stack to achieve remote code execution. The payload is a reverse shell, implemented as a shell command using toybox nc, which connects back to the attacker's machine. The exploit requires a compatible Bluetooth adapter (CSR), specific vulnerable Android versions, and network accessibility for the reverse shell. The repository also includes a general L2CAP testing framework under 'l2cap_infra', which is used for low-level Bluetooth protocol manipulation and testing. No hardcoded IP addresses or domains are present, but the exploit targets specific system libraries for version-dependent offsets. The code is mature and functional, but not weaponized for mass exploitation.

This repository contains a proof-of-concept (PoC) exploit for CVE-2017-0785, a vulnerability in the Bluetooth SDP (Service Discovery Protocol) implementation on Android devices (part of the BlueBorne family of vulnerabilities). The main exploit file, 'CVE-2017-0785.py', is a Python script that uses the pybluez and pwntools libraries to craft and send a series of malicious L2CAP packets to a target device's Bluetooth MAC address. The exploit does not require pairing or discoverable mode on the target. Upon successful exploitation, the script extracts and prints a memory dump (stack data) from the target device's Bluetooth process, demonstrating the information leak. The repository also includes a detailed README.md explaining the BlueBorne attack vector, its risks, and affected platforms. No hardcoded IPs, URLs, or domains are present; the only fingerprintable endpoint is the Bluetooth MAC address of the target. The exploit is a PoC and does not provide remote code execution, but it demonstrates the vulnerability and can be used as a basis for further research or exploitation.

This repository provides a proof-of-concept exploit and scanner for the BlueBorne vulnerability (CVE-2017-0785), which affects the Bluetooth SDP (Service Discovery Protocol) implementation in various platforms (notably Android, Linux, and iOS). The main files are: - bluebornescan.py: The entry point script. It scans for nearby Bluetooth devices, checks their MAC address prefixes against a large list of known vulnerable device manufacturers (from vulndevices.py), and allows the user to select a target for exploitation. - cve20170785.py: Contains the exploit logic. It establishes a Bluetooth L2CAP connection to the selected target and sends specially crafted SDP requests to trigger an out-of-bounds read, leaking memory from the target device. The leaked data is printed in hex format. - vulndevices.py: Contains a large dictionary mapping manufacturers to MAC address prefixes, used to identify potentially vulnerable devices during scanning. - notes.txt: Provides detailed technical background on Bluetooth protocols, the BlueBorne vulnerabilities, and affected platforms. The exploit requires the attacker to be within Bluetooth range of the target. It does not provide remote code execution, but leaks memory from the target device, which may include sensitive information. The code is a proof-of-concept and is intended for research and demonstration purposes.

This repository contains a proof-of-concept exploit for CVE-2017-0785, an information leak vulnerability in the Bluetooth SDP implementation on Android devices (as described by Armis in the BlueBorne disclosure). The main file, 'CVE-2017-0785.py', is a Python script that uses the 'pybluez' and 'pwntools' libraries to interact with a target device over Bluetooth L2CAP. The script requires the attacker to specify the target's Bluetooth MAC address. It crafts and sends a series of malformed SDP packets to the target, exploiting the vulnerability to leak stack memory from the device. The leaked data is then displayed as a hexdump. The repository also includes a README with setup instructions and background information. No hardcoded network endpoints are present; the only fingerprintable endpoint is the Bluetooth MAC address of the target device. The exploit is a standalone proof-of-concept and does not include weaponized or automated payload delivery.