<<< Date Index >>>     <<< Thread Index >>>

hack.lu Bluetooth demo



As requested by several of the folks that went to hack.lu - 2006 I have posted the code for the 'GenerationTwo' InqTana variant at
http://www.digitalmunition.com/hacklu.html

For those that missed it Thierry Zoller of nruns demonstrated a remote exploitation of CVE-2005-1333 as a means to compromise both a Bluetooth enabled 10.3.9 Macintosh (that has not been patched to APPLE-SA-2005-03-21 and APPLE-SA-2005-05-03) and anything that it was paired with. The variant also works on 10.4 machines that have not been patched with the Mac OS X 10.4.1 and Mac OS X 10.4.7 Updates.

Post-compromise the 'GenerationTwo' variant installs a malicious /etc/ttys file with a login getty listening on a Bluetooth rfcomm channel. A user is added and a setuid backdoor is left behind for easy root access over a Bluetooth rfcomm connection. The final steps of exploitation invole the harvesting of any available link keys (via KeyHarvest.pl) from blued.plist so that other devices may also be exploited.

Much thanks to both Thierry Zoller and the organizers of Hack.lu.

If you have any questions about GenerationTwo feel free to ask. Please keep in mind that CVE-2005-1333 was patched almost one and a half years ago at this point so I would say that you SHOULD be patched to this by now. If you are pen-testing older Macs make sure you check for Bluetooth!
-KF