hack.lu Bluetooth demo
As requested by several of the folks that went to hack.lu - 2006 I have
posted the code for the 'GenerationTwo' InqTana variant at
http://www.digitalmunition.com/hacklu.html
For those that missed it Thierry Zoller of nruns demonstrated a remote
exploitation of CVE-2005-1333 as a means to compromise both a Bluetooth
enabled 10.3.9 Macintosh (that has not been patched to
APPLE-SA-2005-03-21 and APPLE-SA-2005-05-03) and anything that it was
paired with. The variant also works on 10.4 machines that have not been
patched with the Mac OS X 10.4.1 and Mac OS X 10.4.7 Updates.
Post-compromise the 'GenerationTwo' variant installs a malicious
/etc/ttys file with a login getty listening on a Bluetooth rfcomm
channel. A user is added and a setuid backdoor is left behind for easy
root access over a Bluetooth rfcomm connection. The final steps of
exploitation invole the harvesting of any available link keys (via
KeyHarvest.pl) from blued.plist so that other devices may also be
exploited.
Much thanks to both Thierry Zoller and the organizers of Hack.lu.
If you have any questions about GenerationTwo feel free to ask. Please
keep in mind that CVE-2005-1333 was patched almost one and a half years
ago at this point so I would say that you SHOULD be patched to this by
now. If you are pen-testing older Macs make sure you check for Bluetooth!
-KF