BlueBorne Linux Kernel BlueZ L2CAP Configuration Response Stack Overflow RCE

This repository provides operational proof-of-concept exploits for the BlueBorne Bluetooth vulnerabilities, specifically targeting Android devices (CVE-2017-0781 for RCE and CVE-2017-0785 for information leak/ASLR bypass). The main exploit is implemented in 'android/doit.py', which orchestrates the attack by first leaking memory addresses via SDP (Service Discovery Protocol) to bypass ASLR, then exploiting a heap overflow in the Bluetooth stack to achieve remote code execution. The payload is a reverse shell, implemented as a shell command using toybox nc, which connects back to the attacker's machine. The exploit requires a compatible Bluetooth adapter (CSR), specific vulnerable Android versions, and network accessibility for the reverse shell. The repository also includes a general L2CAP testing framework under 'l2cap_infra', which is used for low-level Bluetooth protocol manipulation and testing. No hardcoded IP addresses or domains are present, but the exploit targets specific system libraries for version-dependent offsets. The code is mature and functional, but not weaponized for mass exploitation.

This repository provides a proof-of-concept (PoC) exploit for the BlueBorne vulnerability (CVE-2017-1000251), which affects the Linux BlueZ Bluetooth stack. The main exploit file, 'bluebornexploit.py', uses the Scapy library to craft and send malformed L2CAP configuration packets to a target Bluetooth device, specified by its MAC address. The exploit aims to trigger a Denial of Service (DoS) by exploiting improper handling of L2CAP configuration requests and responses. The 'bluetoothsrv.py' file appears to be a simple Bluetooth L2CAP server for testing purposes. The repository is structured with a README describing its purpose, the main exploit script, and a test server script. No network endpoints such as URLs or IPs are present; instead, Bluetooth MAC addresses are used as targets. The exploit requires proximity to the target and a Bluetooth adapter capable of raw packet injection.

This repository contains a proof-of-concept (PoC) exploit for the BlueBorne Bluetooth vulnerability (CVE-2017-1000251) affecting Linux kernels prior to 4.13.1. The main exploit code is in 'blueborne.c', which crafts and sends a series of malicious L2CAP packets over a raw Bluetooth socket to a specified target Bluetooth MAC address. The exploit is designed to trigger a buffer overflow in the kernel's Bluetooth stack, resulting in a denial of service (kernel panic/crash) on the target system. The exploit does not provide remote code execution or a shell; it is strictly a DoS PoC. The repository also includes a README describing the exploit, a text file ('blueborne.txt') with additional protocol details and usage notes, and a kernel call trace log ('dmesg_call-trace.txt') showing the crash. The exploit requires the attacker to know the target's Bluetooth MAC address and to be within Bluetooth range. No network, HTTP, or file-based endpoints are present; the only fingerprintable endpoint is the target's Bluetooth MAC address.