[New Tutorial For BT3 ONLY]One bluetooth post to rule them all!

**drgr33n** · 04-08-2008, 06:19 PM

Hey hongman

You have to start your bluetooth services.

Code:

bash /etc/rc.d/rc.bluetooth start

**hongman** · 04-08-2008, 06:28 PM

Hi Dr

It is started, for that I am sure becuase I can use sdptool browse Victim_MAC and return results.

My problem is:

When I use bluebugger or bluesnarfer it still prompts for a passkey. Entering 0000 or 1234 doesnt work and I get connection refused message, or it just hangs until I hit ctrl C.

I have yet to pull any phonebooks or messages or anything

I am testing on my Nokia E61, Blackberry Curve and Nokia N91.

Thanks in advance

**drgr33n** · 04-09-2008, 01:19 AM

You can still use sdptool without your bluetooth services running. You will have to pair your PC to your phone to snarf a phonebook.

Can your phone see your PC ?

**hongman** · 04-09-2008, 10:19 AM

You can still use sdptool without your bluetooth services running.

OH.

My phone cannot see my laptop. I tried using:

hcitool cc MAC
hcitool auth MAC

But on Auth I get an error. Let me boot my laptop up and I'll tell you what Im doing/not doing!

Thank you.

**hongman** · 04-09-2008, 11:01 AM

OK.

Booted up BT3b.

Code:

hciconfig hci0 up
hciconfig -a
hci0:   Type: USB
        BD Address: 08:00:46:CC:9C:A1 ACL MTU: 192:8 SCO MTU: 64:8
        UP RUNNING
        RX bytes:79 acl:0 sco:0 events:8 errors:0
        TX bytes:30 acl:0 sco:0 commands:8 errors:0
        Features: 0xff 0xff 0x0f 0x00 0x00 0x00 0x00 0x00
        Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
        Link policy:
        Link mode: SLAVE ACCEPT
        Name: '                                                                                                                                                                                                                                                       '
        Class: 0x000000
        Service Classes: Unspecified
        Device Class: Miscellaneous,
        HCI Ver: 1.1 (0x1) HCI Rev: 0x30d LMP Ver: 1.1 (0x1) LMP Subver: 0x30d
        Manufacturer: Cambridge Silicon Radio (10)

Can Scan OK.

Code:

bt ~ # hcitool scan hci0
Scanning ...
        00:18:42:EA:56:11       Dave
        00:1C:35:51:D1:5F       English

Can use sdptool browse

Code:

bt ~ # sdptool browse 00:18:42:EA:56:11
Browsing 00:18:42:EA:56:11 ...
Service Name: AVRCP Target
Service Description: Audio Video Remote Control
Service Provider: Symbian Software Ltd.
Service RecHandle: 0x10000
Service Class ID List:
  "AV Remote Target" (0x110c)
Protocol Descriptor List:
  "L2CAP" (0x0100)
    PSM: 23
  "AVCTP" (0x0017)
    uint16: 0x100
Profile Descriptor List:
  "AV Remote" (0x110e)
    Version: 0x0100

Service RecHandle: 0x10001
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 1

Service Name: OBEX Object Push
Service RecHandle: 0x10003
Service Class ID List:
  "OBEX Object Push" (0x1105)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 9
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "OBEX Object Push" (0x1105)
    Version: 0x0100

Service Name: Imaging
Service RecHandle: 0x10005
Service Class ID List:
  "Imaging Responder" (0x111b)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 15
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Imaging" (0x111a)
    Version: 0x0100

Service Name: Audio Source
Service RecHandle: 0x10007
Service Class ID List:
  "Audio Source" (0x110a)
Protocol Descriptor List:
  "L2CAP" (0x0100)
    PSM: 25
  "AVDTP" (0x0019)
    uint16: 0x100
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Advanced Audio" (0x110d)
    Version: 0x0100

Service Name: SyncMLClient
Service RecHandle: 0x1000b
Service Class ID List:
  UUID 128: 00000002-0000-1000-8000-0002ee000002
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 10
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "" (0x00000002-0000-1000-8000-0002ee000002)
    Version: 0x0100

Service Name: OBEX File Transfer
Service RecHandle: 0x1000c
Service Class ID List:
  "OBEX File Transfer" (0x1106)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 11
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "OBEX File Transfer" (0x1106)
    Version: 0x0100

Service Name: Nokia OBEX PC Suite Services
Service RecHandle: 0x1000d
Service Class ID List:
  UUID 128: 00005005-0000-1000-8000-0002ee000001
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 12
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "" (0x00005005-0000-1000-8000-0002ee000001)
    Version: 0x0100

Service Name: SyncML DM Client
Service RecHandle: 0x1000e
Service Class ID List:
  UUID 128: 00000004-0000-1000-8000-0002ee000002
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 13
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "" (0x00000004-0000-1000-8000-0002ee000002)
    Version: 0x0100

Service Name: Nokia SyncML Server
Service RecHandle: 0x1000f
Service Class ID List:
  UUID 128: 00005601-0000-1000-8000-0002ee000001
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 14
  "OBEX" (0x0008)
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "" (0x00005601-0000-1000-8000-0002ee000001)
    Version: 0x0100

Service Name: SIM Access
Service RecHandle: 0x10010
Service Class ID List:
  "SIM Access" (0x112d)
  "Generic Telephony" (0x1204)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 8
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "SIM Access" (0x112d)
    Version: 0x0101

Service Name: Dial-Up Networking
Service RecHandle: 0x10018
Service Class ID List:
  "Dialup Networking" (0x1103)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 2
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Dialup Networking" (0x1103)
    Version: 0x0100

Service Name: Hands-Free Audio Gateway
Service RecHandle: 0x10020
Service Class ID List:
  "Handfree Audio Gateway" (0x111f)
  "Generic Audio" (0x1203)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 3
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Handsfree" (0x111e)
    Version: 0x0105

Service Name: Headset Audio Gateway
Service RecHandle: 0x10021
Service Class ID List:
  "Headset Audio Gateway" (0x1112)
  "Generic Audio" (0x1203)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 4
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Headset" (0x1108)
    Version: 0x0100

I can see DUN2, SIM8, FTP11, OPUSH9

Lets change my hcid.conf.

Code:

nano /etc/bluetooth/hcid.conf

Changed necessary to match the guide on page 1.

Now to restart bluetooth services

Code:

bt ~ # bash /etc/rc.d/rc.bluetooth restart
Stopping Bluetooth subsystem:  pand dund rfcomm hidd sdpd hcid.
Starting Bluetooth subsystem:  hcid passkeys.

Now I do mknod and sdptool commands but for my channels.

Code:

bt ~ # mknod -m 666 /dev/rfcomm0 c 216 2
bt ~ # mknod -m 666 /dev/rfcomm1 c 216 9
bt ~ # mknod -m 666 /dev/rfcomm2 c 216 11
bt ~ # sdptool add --channel=2 DUN
bt ~ # sdptool add --channel=9 OPUSH
bt ~ # sdptool add --channel=11 FTP

So now I should be all set up right?

Code:

bluebugger -c 2 -a MAC info

Code:

bluebugger 0.1 ( MaJoMu | www.codito.de )
-----------------------------------------

Target Device:  '00:18:42:EA:56:11'
Target Name:    'Dave'

Cannot open '/dev/rfcomm0': Connection refused

Before the "Cannot open" error I get prompted for a passkey which seems to work.

Channel 2 and 11 both do this.

If I use 9, I get "Do you want to receive message from ...". Hitting yes makes bluiebugger just hang there till I CTRL-C.

I did

Code:

 bash /etc/rc.d/rc.bluetooth start

just to be sure. It started hcid and passkeys.

For info if you need it:

Code:

bt ~ # hciconfig hci* revision
hci0:   Type: USB
        BD Address: 08:00:46:CC:9C:A1 ACL MTU: 192:8 SCO MTU: 64:8
        HCI 16.7.5
        Chip version: BlueCore02-External
        Max key size: 56 bit
        SCO mapping:  PCM

Code:

bt ~ # hcitool cc 00:18:42:EA:56:11
bt ~ # hcitool auth 00:18:42:EA:56:11
Not connected

Code:

bt ~ # bccmd psget -s 0x0000 0x02bf
USB product identifier: 0x0002 (2)

Ok, I think I included everything. Can you see what is wrong?

I want to get this working so bad, spent 3 days solid on this

**drgr33n** · 04-09-2008, 01:08 PM

Ok everything looks good and passkey agent looks like it is running, try searching with your phone and linking via the phone.

Also could you go through the process again and record the process with hcidump. Send it over and I will assist more.

**hongman** · 04-09-2008, 04:57 PM

Thanks a lot Dr, it will probably be tomorrow now but watch this space!

Do I just run hcidump -w dumpfile?

**drgr33n** · 04-09-2008, 05:01 PM

np m8t yes just upload the dumpfile.

Also I may be a day answering because I had a hdd meltdown last nite and I'm now running from the bt3 live cd until I rebuild later

**hongman** · 04-09-2008, 05:08 PM

Thanks, sorry to hear about your HDD

I really wanna try bluesmash but I'm running Live CD :P maybe they could include it in next BT3 release

I'm not linux savvy enough to incorporate it into my Live CD myself yet :P

One thing, once this is all working I should be able to pull info from my phone without pairing right?

**hongman** · 04-09-2008, 05:55 PM

Code:

http://rapidshare.de/files/39069491/dump.html

That is the dump file. I used the command above with hcidump and this is the order I did things:

hcitool scan hci0
sdptool browse MAC
edited hcid.conf as above
mknod + sdptool add
hcitool browse hci0 (decided to try a colleagues Nokia N92)
bluebugger info

Thanks in advance. The log file is not parsed by the way.

BackTrack Linux - Penetration Testing Distribution

Thread: [New Tutorial For BT3 ONLY]One bluetooth post to rule them all!

Thread Tools

Search Thread

Display

Posting Permissions