Bluetooth Low Energy
In order to interact with bluetooth low energy ensure you configure your dongle to be in low energy mode
# verify dongle is detected and in up state
hciconfig
# set to low energy mode
sudo btmgmt le on
hci0 Set Low Energy complete, settings: powered ssp br/edr le secure-conn if you have to unplug the adapter for any reason you will need to set le mode again and ensure device is in an up state
sudo hciconfig hci0 up
sudo btmgmt le onScanning for BLE devices
when the scan occurs we will be flooded with information as it will scan on all three channels and advertisements happen frequently.
Look for unique addresses, easy to bash script
sudo hcitool -i hci0 lescan
4C:CE:83:6B:73:1D (unknown)
D8:3A:DD:95:26:78 (unknown)
D8:3A:DD:95:26:78 tens
30:C6:F7:9D:09:BA 51c7928byou can also capture to a file and then
uniq -c
sudo hcitool -i hci0 lescan > lescan.txt
cat lescan.txt | sort | uniq -cGATT Tool to Connect to Devices
lecc
Perform a BLE, instead of Classic, connection.
-t
public
Use the BLE adapter's publicly assigned manufacturer assigned BLE address.
-i
hci0
The BLE adapter device descriptor.
-b
*BDADDR*
The BDADDR of the victim BLE device, D8:3A:DD:95:26:78 for the purposes of this demonstration.
-I
Enter gatttool in interactive mode.
connect
Connect to the specified device from the interactive session.
primary
Get the primary UUID's ("services") on the device.
you can see
0x0001for the first attr handle and the individual values for the service end at address0x0005meaning there are 5 values for that servicefor the second attr handle:
0x06through0x09represents 4 service values.
Documentation for GATT Services
Good reference page
Interacting with Services
convert the response from hex to ascii
Enumerate Range of Service handles
we can iterate through this enumeration command from
0x000a to 0x001a
Writing to a Device
after enumerating the handles and getting the values with
char-read-hndwe can write values altering the settings of the device
BLE Fuzzing
we can use
blefuzzto fuzz blescript does not accept cmdline args, all manual data input
modify this script to perform write operations
at the bottom you will see a large amount of read commands, you can modify to
--char-writeand--char-write-requsing-ato specify the handle and-nto specify the value to write.you can now automate any testing you want to perform.
Reverse Engineering BLE
many bluetooth le devices have an android and ios application which is utilized to control the device.
we should use the target application (android apps are better as they can be downloaded from APK Monk)
we can use JadX to reconstruct the Java source code.
with the source code up search for strings
BluetoothGattCallbackBluetoothGattDescriptorBluetooth
Reverse Engineering BLE with PCAP
Android devices can dump all hci commands to a log file and the traffic can be captured in Wireshark
Turn on the
HCI capture feature in AndroidIt is under the developer options, can exfil the file with ADB or just email it to yourself.
after opening pcap, filter on
btattthis will show us the bluetooth attribute protocol
it is all the data send and recieved between the ble device and the app
filter on the read request opcode
btatt.opcode == 0x0afilter on the write request opcode
btatt.opcode == 0x12it is simple to derive the valid handles this way
can also use tshark
in the last above command we can see the value
btatt.valuealways is 06. so we can rule that out as a handle that controls a device setting. find the values that are different as those are likely the setting changesto find these values see which wireshark
btatt.valuechanges per packetif handle
0x0031has the samebtatt.valueeach time, rule it out. look for ones where the data value inbtatt.valuechanges each time or frequently
awk for your handles and then iterate through the last tshark command seeing the values and if they seem to be different alot
Reverse Engineering TSHARK HCI Summary
awk for the handles, iterate through them see the changing values
headwas used to save space, dont do this in real life, you might miss stuff...
0x0034is the handle we want!
Last updated