bugtraq - hack.lu Bluetooth demo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <453CF22B.9000103@digitalmunition.com>
Date: Mon, 23 Oct 2006 12:47:39 -0400
From: "K F (lists)" <kf_lists@...italmunition.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: hack.lu Bluetooth demo 

As requested by several of the folks that went to hack.lu - 2006 I have 
posted the code for the 'GenerationTwo' InqTana variant at
http://www.digitalmunition.com/hacklu.html

For those that missed it Thierry Zoller of nruns demonstrated a remote 
exploitation of CVE-2005-1333 as a means to compromise both a Bluetooth 
enabled 10.3.9 Macintosh (that has not been patched to 
APPLE-SA-2005-03-21 and APPLE-SA-2005-05-03) and anything that it was 
paired with. The variant also works on 10.4 machines that have not been 
patched with the Mac OS X 10.4.1 and Mac OS X 10.4.7 Updates.

Post-compromise the 'GenerationTwo' variant installs a malicious 
/etc/ttys file with a login getty listening on a Bluetooth rfcomm 
channel. A user is added and a setuid backdoor is left behind for easy 
root access over a Bluetooth rfcomm connection. The final steps of 
exploitation invole the harvesting of any available link keys (via 
KeyHarvest.pl) from blued.plist so that other devices may also be 
exploited.

Much thanks to both Thierry Zoller and the organizers of Hack.lu.

If you have any questions about GenerationTwo feel free to ask. Please 
keep in mind that CVE-2005-1333 was patched almost one and a half years 
ago at this point so I would say that you SHOULD be patched to this by 
now. If you are pen-testing older Macs make sure you check for Bluetooth!
-KF