BLE CTF - Revision history

NKirnbauer: -r hat gefehlt

2025-03-21T14:44:30Z

-r hat gefehlt

← Older revision		Revision as of 14:44, 21 March 2025
Line 189:		Line 189:
	$ cat <<EOF > score.sh		$ cat <<EOF > score.sh
	#!/bin/bash		#!/bin/bash
	gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a \| awk -F':' '{print \$2}' \| tr -d ' ' \| xxd -p; printf '\n'		gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a \| awk -F':' '{print \$2}' \| tr -d ' ' \| xxd -r -p; printf '\n'
	EOF		EOF
	$ chmod u+x score.sh		$ chmod u+x score.sh

NKirnbauer: expired link changed with link from wayback machine

2024-09-03T08:21:22Z

expired link changed with link from wayback machine

← Older revision		Revision as of 08:21, 3 September 2024
Line 204:		Line 204:
	* http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1		* http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1
	* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain		* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain
	* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html		* http://web.archive.org/web/20181214013848/https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html
	* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html		* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html
	* https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md		* https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md

	[[Category:Documentation]]		[[Category:Documentation]]

Ikramer at 13:57, 30 May 2022

2022-05-30T13:57:52Z

← Older revision		Revision as of 13:57, 30 May 2022
Line 66:		Line 66:
	=== Step 3 - Install Python packages ===		=== Step 3 - Install Python packages ===

	Run:		Run installation script:

			cd ~/esp-idf
			./install.sh esp32


	~~python3 -m pip install -r $IDF_PATH/requirements.txt~~


	~~KALI --> if you get an error on Kali you have to configure the Makefile by adding:~~

	~~ESP_IDF = ~/esp/esp-idf~~

	=== Step 4 - Connect the device ===		=== Step 4 - Connect the device ===

Bnagl: Updated the documentation

2021-07-18T13:51:48Z

Updated the documentation

← Older revision		Revision as of 13:51, 18 July 2021
Line 19:		Line 19:
	Install prerequisites:		Install prerequisites:

	sudo apt-get install ~~gcc~~ git wget ~~make libncurses-dev~~ flex bison gperf ~~python python~~-pip ~~python~~-setuptools ~~python~~-~~serial python~~-~~cryptography python~~-~~future python~~-~~pyparsing~~		sudo apt-get install git wget flex bison gperf python3 python3-pip python3-setuptools cmake ninja-build ccache libffi-dev libssl-dev dfu-util libusb-1.0-0

	Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:		Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:
Line 68:		Line 68:
	Run:		Run:

	~~python~~ -m pip install ~~--user~~ -r $IDF_PATH/requirements.txt		python3 -m pip install -r $IDF_PATH/requirements.txt


Line 97:		Line 97:
	cd ble_ctf		cd ble_ctf
	make menuconfig		make menuconfig

			Make sure to turn Bluetooth in the "Component config" on.

			If you receive a error while the make command, please rerun make menuconfig. Go to Compiler options ---> Turn on the "Disable new warnings introduced in GCC 6 - 8" option.

	KALI --> if you get an error on Kali you have to configure the Makefile by adding:		KALI --> if you get an error on Kali you have to configure the Makefile by adding:

Silvie: /* Step 1 - Standard Setup of Toolchain for Linux */

2019-07-03T13:14:21Z

Step 1 - Standard Setup of Toolchain for Linux

← Older revision		Revision as of 13:14, 3 July 2019
Line 30:		Line 30:

	export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"		export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"
	~~KALI:~~
	~~export IDF_PATH=~/esp/esp-idf~~

	On UBUNTU: log off and log back in to make the changes effective.		On UBUNTU: log off and log back in to make the changes effective.

Silvie: /* Step 5 - CTF Setup */

2019-07-03T13:13:22Z

Step 5 - CTF Setup

← Older revision		Revision as of 13:13, 3 July 2019
Line 98:		Line 98:
	cd ble_ctf		cd ble_ctf
	make menuconfig		make menuconfig

			KALI --> if you get an error on Kali you have to configure the Makefile by adding:

			ESP_IDF = ~/esp/esp-idf

	A window appears. Navigate to "Serial flasher config" > "Default Serial port" and enter the port you found out in step 4. Confirm, save and exit.		A window appears. Navigate to "Serial flasher config" > "Default Serial port" and enter the port you found out in step 4. Confirm, save and exit.

Silvie: /* Step 1 - Standard Setup of Toolchain for Linux */

2019-07-03T13:12:28Z

Step 1 - Standard Setup of Toolchain for Linux

← Older revision		Revision as of 13:12, 3 July 2019
Line 30:		Line 30:

	export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"		export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"
			KALI:
			export IDF_PATH=~/esp/esp-idf

	On UBUNTU: log off and log back in to make the changes effective.		On UBUNTU: log off and log back in to make the changes effective.

Silvie: /* Important Commands for the BLE CTF */

2019-07-02T14:30:14Z

Important Commands for the BLE CTF

← Older revision		Revision as of 14:30, 2 July 2019
Line 143:		Line 143:
	Start the BLE CTF: https://github.com/hackgnar/ble_ctf		Start the BLE CTF: https://github.com/hackgnar/ble_ctf

	~~###~~ hciconfig		'''hciconfig'''

	~~```~~sudo hciconfig -a~~```~~ lists all hci interfaces		sudo hciconfig -a
			...lists all hci interfaces

	sudo hciconfig hciX down		sudo hciconfig hciX down
Line 151:		Line 152:
	You might need this on receiving I/O errors.		You might need this on receiving I/O errors.

	~~###~~ hcitool		'''hcitool'''

	~~```~~sudo hcitool lescan~~```~~ lists all availble BLE devices.		sudo hcitool lescan
			...lists all availble BLE devices.

	~~###~~ gatttool		'''gatttool'''

	~~```~~sudo gatttool -i hci0 -b XX:XX:XX:XX:XX:XX --characteristics~~```~~		sudo gatttool -i hci0 -b XX:XX:XX:XX:XX:XX --characteristics
	...lists all characteristics/handles of the GATT server		...lists all characteristics/handles of the GATT server

	~~```~~sudo gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011~~```~~		sudo gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011
	...reading the characteristic/handle value from handle 0x0011		...reading the characteristic/handle value from handle 0x0011

	~~```~~sudo gatttool -b XX:XX:XX:XX:XX:XX --char-write -a 0x0011 -n 0x1122~~```~~		sudo gatttool -b XX:XX:XX:XX:XX:XX --char-write -a 0x0011 -n 0x1122
	...writes the value 0x1122 to characteristic/handle 0x0011		...writes the value 0x1122 to characteristic/handle 0x0011

	~~```~~gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011 --listen~~```~~		gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011 --listen
	...streams data while subscription / listening		...streams data while subscription / listening

	~~```~~gatttool -b XX:XX:XX:XX:XX:XX -I~~```~~		gatttool -b XX:XX:XX:XX:XX:XX -I
	...for persistent connections to a GATT server		...for persistent connections to a GATT server

	~~###~~ Speed-up		'''Speed-up'''

	Shell script for retrieving the current score:		Shell script for retrieving the current score:

	~~```~~$ cat <<EOF > score.sh~~```~~		$ cat <<EOF > score.sh
	~~```~~#!/bin/bash~~```~~		#!/bin/bash
	~~```~~gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a \| awk -F':' '{print \$2}' \| tr -d ' ' \| xxd -p; printf '\n'~~```~~		gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a \| awk -F':' '{print \$2}' \| tr -d ' ' \| xxd -p; printf '\n'
	~~```~~EOF~~```~~		EOF
	~~```~~$ chmod u+x score.sh~~```~~		$ chmod u+x score.sh
	~~```~~$ ./score.sh~~```~~		$ ./score.sh

	== Used Hardware ==		== Used Hardware ==

Silvie at 14:26, 2 July 2019

2019-07-02T14:26:38Z

← Older revision		Revision as of 14:26, 2 July 2019
Line 138:		Line 138:

	Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)		Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)

			=== Important Commands for the BLE CTF ===

			Start the BLE CTF: https://github.com/hackgnar/ble_ctf

			### hciconfig

			```sudo hciconfig -a``` lists all hci interfaces

			sudo hciconfig hciX down
			sudo hciconfig hciX up
			You might need this on receiving I/O errors.

			### hcitool

			```sudo hcitool lescan``` lists all availble BLE devices.

			### gatttool

			```sudo gatttool -i hci0 -b XX:XX:XX:XX:XX:XX --characteristics```
			...lists all characteristics/handles of the GATT server

			```sudo gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011```
			...reading the characteristic/handle value from handle 0x0011

			```sudo gatttool -b XX:XX:XX:XX:XX:XX --char-write -a 0x0011 -n 0x1122```
			...writes the value 0x1122 to characteristic/handle 0x0011

			```gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011 --listen```
			...streams data while subscription / listening

			```gatttool -b XX:XX:XX:XX:XX:XX -I```
			...for persistent connections to a GATT server

			### Speed-up

			Shell script for retrieving the current score:

			```$ cat <<EOF > score.sh```
			```#!/bin/bash```
			```gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a \| awk -F':' '{print \$2}' \| tr -d ' ' \| xxd -p; printf '\n'```
			```EOF```
			```$ chmod u+x score.sh```
			```$ ./score.sh```

	== Used Hardware ==		== Used Hardware ==

Silvie: /* Step 1 - Standard Setup of Toolchain for Linux */

2019-07-02T09:29:00Z

Step 1 - Standard Setup of Toolchain for Linux

← Older revision		Revision as of 09:29, 2 July 2019
Line 31:		Line 31:
	export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"		export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"

	~~Log~~ off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:		On UBUNTU: log off and log back in to make the changes effective.
			On KALI do not log off.

			Run the following command to verify if PATH is correctly set:

	printenv PATH		printenv PATH

	The output should contain (userName gets replaced by your user name):		The output in Ubuntu should contain (userName gets replaced by your user name):

	/home/userName/esp/xtensa-esp32-elf/bin		/home/userName/esp/xtensa-esp32-elf/bin