blexploit/main.py at main · schoi1337/blexploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Path: main.py

import argparse
import asyncio

from core.ble_write import write_to_characteristic
from core.uuid_scanner import scan_gatt_services
from core.read_gatt import run_read_gatt
from core.passive_scanner import scan_passive_devices
from core.fingerprint_store import collect_device_fingerprints
from attacks import dispatch_attack
from utils.mac_tracker import detect_rotating_macs
from utils.unknown_tracker import detect_unknown_repeaters
from utils.fingerprint_db_builder import build_fingerprint_db

def main():
    parser = argparse.ArgumentParser(description="🔓 Blexploit - Offensive BLE Exploitation Framework")
    subparsers = parser.add_subparsers(dest="command", required=True)

    # --- Simulations ---
    subparsers.add_parser("simulate-replay", help="Simulate BLE replay attack (not yet implemented)")
    subparsers.add_parser("simulate-fakekey", help="Simulate fake BLE key injection (not yet implemented)")

    # --- Passive Scanner ---
    parser_passive = subparsers.add_parser("passive-scan", help="Scan for nearby BLE devices")
    parser_passive.add_argument("--timeout", type=int, default=10)
    parser_passive.add_argument("--min-rssi", type=int, default=-100)
    parser_passive.add_argument("--json-only", action="store_true")
    parser_passive.add_argument("--unsafe", action="store_true")

    # --- Fingerprint Collection ---
    parser_fp = subparsers.add_parser("fingerprint", help="Collect and store BLE device fingerprints")
    parser_fp.add_argument("--timeout", type=int, default=10)

    # --- Rotating MAC Detection ---
    subparsers.add_parser("track-macs", help="Detect rotating MAC addresses from fingerprints and reports")

    # --- Unknown Device Detection ---
    subparsers.add_parser("track-unknowns", help="Detect suspicious unknown BLE devices")

    # --- GATT Fingerprint DB Builder ---
    subparsers.add_parser("build-fingerprint-db", help="Generate GATT-based BLE fingerprint database")

    # --- write-test ---
    parser_write = subparsers.add_parser("write-test", help="Test writing to a BLE characteristic")
    parser_write.add_argument("--address", required=True)
    parser_write.add_argument("--uuid", required=True)
    parser_write.add_argument("--payload", required=True)
    parser_write.add_argument("--unsafe", action="store_true")

    # --- read-gatt ---
    parser_read = subparsers.add_parser("read-gatt", help="Read a BLE characteristic value")
    parser_read.add_argument("--address", required=True)
    parser_read.add_argument("--uuid", required=True)

    # --- scan-uuid ---
    parser_scan = subparsers.add_parser("scan-uuid", help="Scan and list GATT services of a device")
    parser_scan.add_argument("--address", required=True)

    # --- Modular Attack System ---
    parser_attack = subparsers.add_parser("attack", help="Launch an active BLE attack module")
    parser_attack.add_argument("--type", required=True, help="Attack module name (e.g. brute-pin, replay)")
    parser_attack.add_argument("--address")
    parser_attack.add_argument("--wordlist", default="data/top100_ble_pins.txt")
    parser_attack.add_argument("--delay", type=float, default=1.0)
    parser_attack.add_argument("--payload")
    parser_attack.add_argument("--input-file")
    parser_attack.add_argument("--uuid", default="0000ffd6-0000-1000-8000-00805f9b34fb")
    parser_attack.add_argument("--unsafe", action="store_true")
    parser_attack.add_argument("--json-only", action="store_true", help="Only output JSON report (no HTML)")

    args = parser.parse_args()

    if args.command == "write-test":
        if not args.unsafe:
            print("[!] This command performs a real BLE write operation.")
            print("    Use the --unsafe flag to acknowledge and proceed.")
            return
        else:
            confirm = input("This will write to a BLE device. Proceed? (yes/no): ")
            if confirm.lower() != "yes":
                print("[!] Aborting write.")
                return
        write_to_characteristic(args)

    elif args.command == "read-gatt":
        run_read_gatt(args)

    elif args.command == "scan-uuid":
        from logic.attack_suggester import suggest_attacks
        uuids = asyncio.run(scan_gatt_services(args.address))
        if uuids:
            suggestions = suggest_attacks(uuids)
            if suggestions:
                print("\n[💡] Suggested attack modules based on UUID structure:")
                for s in suggestions:
                    print(f"    → {s}")
            else:
                print("\n[!] No attack modules suggested for this device.")

    elif args.command == "passive-scan":
        asyncio.run(scan_passive_devices(args.timeout, args.min_rssi, args.json_only, args.unsafe))

    elif args.command == "fingerprint":
        asyncio.run(collect_device_fingerprints(args.timeout))

    elif args.command == "track-macs":
        detect_rotating_macs()

    elif args.command == "track-unknowns":
        detect_unknown_repeaters()

    elif args.command == "build-fingerprint-db":
        build_fingerprint_db()

    elif args.command == "attack":
        if not args.unsafe:
            print("[!] This command performs a real BLE attack.")
            print("    Use the --unsafe flag to acknowledge and proceed.")
            return
        else:
            confirm = input("This will send real BLE packets. Proceed? (yes/no): ")
            if confirm.lower() != "yes":
                print("[!] Aborting attack.")
                return
        dispatch_attack(args.type.replace("-", "_"), args)

    else:
        parser.print_help()


if __name__ == "__main__":
    main()