Exploiting the USB Ninja BLE Connection - Revision history

Cskallak at 13:49, 28 May 2021

2021-05-28T13:49:47Z

← Older revision		Revision as of 13:49, 28 May 2021
Line 260:		Line 260:
	[E1:F1:22:F6:28:B5][LE]>Button B		[E1:F1:22:F6:28:B5][LE]>Button B
	Pressed Button B [E1:F1:22:F6:28:B5][LE]>Quit		Pressed Button B [E1:F1:22:F6:28:B5][LE]>Quit

	~~== Part 2 is following soon ==~~
	~~== Conclusio is following soon ==~~

	== References ==		== References ==

Cskallak: /* References */

2020-11-12T17:39:34Z

References

← Older revision		Revision as of 17:39, 12 November 2020
Line 266:		Line 266:
	== References ==		== References ==

	* https://~~wikipedia~~.~~org~~		* https://www.greatscottgadgets.com/ubertoothone/
	* https://~~google~~.com		* https://usbninja.com/
			* https://www.bluetooth.com/specifications/assigned-numbers/

	Category:Documentation[[]]		[[Category:Documentation]]

Cskallak: /* Step Two: Ubertooth BLE Connection Sniffing */

2020-11-12T17:35:12Z

Step Two: Ubertooth BLE Connection Sniffing

← Older revision		Revision as of 17:35, 12 November 2020
Line 207:		Line 207:
	ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe		ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe

	[[File:USBNINJAWIRESHARK.png\|~~400px~~]]		[[File:USBNINJAWIRESHARK.png\|600px]]

	The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.		The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.

	[[File:USBNINJACON.png\|~~400px~~]]		[[File:USBNINJACON.png\|600px]]

	During the Connection establishment the exchange MTX gets discussed followed by a write request to the handle 0x22 with the value 0x0100. Then the USB Cable responds with an acknowledgement. I think that this operation causes the Error in interactive mode of the gatttool but I did use it in script of Step Three.		During the Connection establishment the exchange MTX gets discussed followed by a write request to the handle 0x22 with the value 0x0100. Then the USB Cable responds with an acknowledgement. I think that this operation causes the Error in interactive mode of the gatttool but I did use it in script of Step Three.

Cskallak: /* Part 2 is following soon */

2020-11-12T17:34:54Z

Part 2 is following soon

← Older revision		Revision as of 17:34, 12 November 2020
Line 262:		Line 262:

	== Part 2 is following soon ==		== Part 2 is following soon ==
			== Conclusio is following soon ==

	== References ==		== References ==

Cskallak: /* Step Two: Ubertooth BLE Connection Sniffing */

2020-11-12T17:34:35Z

Step Two: Ubertooth BLE Connection Sniffing

← Older revision		Revision as of 17:34, 12 November 2020
Line 203:		Line 203:
	mkfifo /tmp/pipe		mkfifo /tmp/pipe
	sudo wireshark -i /tmp/pipe		sudo wireshark -i /tmp/pipe


	Terminal B:		Terminal B:
	ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe		ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe

	[[File:USBNINJAWIRESHARK.png\|400px]		[[File:USBNINJAWIRESHARK.png\|400px]]

	The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.		The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.

Cskallak: /* Step Two: Ubertooth BLE Connection Sniffing */

2020-11-12T17:34:14Z

Step Two: Ubertooth BLE Connection Sniffing

← Older revision		Revision as of 17:34, 12 November 2020
Line 208:		Line 208:
	ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe		ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe

	~~ Wiresahrk image~~		[[File:USBNINJAWIRESHARK.png\|400px]

	The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.		The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.

	~~ Connection image~~		[[File:USBNINJACON.png\|400px]]

	During the Connection establishment the exchange MTX gets discussed followed by a write request to the handle 0x22 with the value 0x0100. Then the USB Cable responds with an acknowledgement. I think that this operation causes the Error in interactive mode of the gatttool but I did use it in script of Step Three.		During the Connection establishment the exchange MTX gets discussed followed by a write request to the handle 0x22 with the value 0x0100. Then the USB Cable responds with an acknowledgement. I think that this operation causes the Error in interactive mode of the gatttool but I did use it in script of Step Three.

Cskallak: /* Step Two: Ubertooth BLE Connection Sniffing */

2020-11-12T17:30:59Z

Step Two: Ubertooth BLE Connection Sniffing

← Older revision		Revision as of 17:30, 12 November 2020
Line 198:		Line 198:
	=== Step Two: Ubertooth BLE Connection Sniffing ===		=== Step Two: Ubertooth BLE Connection Sniffing ===

			After installing the Ubertooth functions and get the device running, I started to sniff the transferred data and piped it directly into wireshark

			Terminal A:
			mkfifo /tmp/pipe
			sudo wireshark -i /tmp/pipe


			Terminal B:
			ubertooth-btle -f E1:F1:22:F6:28:B5 -c /tmp/pipe

			Wiresahrk image

			The Wireshark output shows that the transmitter only interacts with the handle 0x22 and 0x25. I the following figure shows the connection in a simplified way.

			Connection image

			During the Connection establishment the exchange MTX gets discussed followed by a write request to the handle 0x22 with the value 0x0100. Then the USB Cable responds with an acknowledgement. I think that this operation causes the Error in interactive mode of the gatttool but I did use it in script of Step Three.

			When a button is Pressed it first send a write request to the handle 0x25 with the value 0x38383838. This value is the Password in plaintext but coded as hex (0x38383838 = 8888). Because of that it is possible to overtake the connection if the password got sniffed. After the acknowldgment its send either the value 0x413d4c0d0a (Button A) or 0x423d4c0d0a (Button A) to tirgger the corresponding Payload. Attentive observer will instandly recognize that the first hexpair 0x41 and 0x42 of the sent values are A and B in ASCII and indicate the used buttons.

	=== Step Three: Writing a Contolling Python Script ===		=== Step Three: Writing a Contolling Python Script ===

Cskallak: /* Step Three: Writing a Contolling Python Script */

2020-11-12T16:03:42Z

Step Three: Writing a Contolling Python Script

← Older revision		Revision as of 16:03, 12 November 2020
Line 229:		Line 229:

	./USBNinja.py -m r -d E1:F1:22:F6:28:B5		./USBNinja.py -m r -d E1:F1:22:F6:28:B5

	[E1:F1:22:F6:28:B5][LE]>info		[E1:F1:22:F6:28:B5][LE]>info
	Device name: Ninja		Device name: Ninja

Cskallak: /* Step Three: Writing a Contolling Python Script */

2020-11-12T16:03:07Z

Step Three: Writing a Contolling Python Script

← Older revision		Revision as of 16:03, 12 November 2020
Line 228:		Line 228:
	'''Example usage of the Remote mode:'''		'''Example usage of the Remote mode:'''

	./USBNinja.py -m r -d E1:F1:22:F6:28:B5		./USBNinja.py -m r -d E1:F1:22:F6:28:B5

	[E1:F1:22:F6:28:B5][LE]>info		[E1:F1:22:F6:28:B5][LE]>info

Cskallak: /* Reverse Engeneering The Remote */

2020-11-12T16:01:06Z

Reverse Engeneering The Remote

← Older revision		Revision as of 16:01, 12 November 2020
Line 109:		Line 109:
	\|}		\|}

	The wellknown Services were easy to read and to decipher but the four custom services couldn't be reverse engineered by using only the gatttool. The rest of this paragraph is a listing of the commands used to create the table above and how to decode the values. So feel free to jump to the Ubertooth BLE connection sniffing part by klicking this link: [[Exploiting_the_USB_Ninja_BLE_Connection#Step_Two:_Ubertooth_BLE_Connection_Sniffing]].		The wellknown Services were easy to read and to decipher but the four custom services couldn't be reverse engineered by using only the gatttool. The rest of this paragraph is a listing of the commands used to create the table above and how to decode the values. So feel free to jump to the Ubertooth BLE connection sniffing part by klicking this link: [[Exploiting_the_USB_Ninja_BLE_Connection#Step_Two:_Ubertooth_BLE_Connection_Sniffing \| Step Two: Ubertooth BLE Connection Sniffing]].

	''' [1] [Device Name] [RW] handle: 0x0002, char properties: 0x0a, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb '''		''' [1] [Device Name] [RW] handle: 0x0002, char properties: 0x0a, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb '''