Sergeb250/BlueDucky

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

BlueDucky is a Python tool that exploits CVE-2023-45866 to inject keystrokes over Bluetooth. It connects to a target device's HID ports without authentication, then executes a DuckyScript payload to send arbitrary keyboard input.

Backdoor review

No backdoor observed in reviewed code

The reviewed code implements a Bluetooth HID attack tool (BlueDucky) exploiting CVE-2023-45866. It connects to a target, sends HID keyboard reports based on a user-supplied DuckyScript payload, and includes standard Bluetooth pairing and connection management. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload delivery was observed. The tool's behavior is consistent with its stated purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareBlueZLinux Bluetooth stack
Attack typesBluetooth HID spoofingKeystroke injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2023-45866 by establishing unauthenticated Bluetooth HID connections and injecting keystrokes. It does not merely detect the vulnerability; it performs the attack.

README.md:16-18BlueDucky.py:621-627BlueDucky.py:277-303

Requirements

  • Target device must be vulnerable to CVE-2023-45866 (unauthenticated Bluetooth HID connection).README.md:16-18
  • Attacker must have a Bluetooth adapter and be within range of the target.BlueDucky.py:66-77

Observed behavior

  • Registers an HID profile and sets the Bluetooth adapter class to 0x002540 (keyboard).BlueDucky.py:598-607
  • Connects to the target device on L2CAP ports 1 (SDP), 17 (HID Control), and 19 (HID Interrupt).BlueDucky.py:621-627
  • Parses a DuckyScript payload and sends HID keyboard reports (key presses and releases) to the target.BlueDucky.py:305-440
  • Sends raw HID reports for special commands like PRIVATE_BROWSER and VOLUME_UP.BlueDucky.py:327-348
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Bluetooth Hid Injection
CVE-2023-45866 exploitation via L2CAP HID keyboard reportsThe tool exploits a known vulnerability to inject keystrokes into unauthenticated Bluetooth HID hosts. This is the advertised functionality.BlueDucky.py:1-699README.md:16-20
Duckyscript Parser
process_duckyscript functionParses and executes DuckyScript commands (STRING, DELAY, ENTER, modifier combinations) to generate HID reports. This is the core payload delivery mechanism.BlueDucky.py:305-439
External Dependency
pydbus, pybluez, bluetoothUses standard Linux Bluetooth libraries for HID profile registration and L2CAP communication. No obfuscated or unexpected network activity.BlueDucky.py:1-5requirements.txt:1-8
Review boundaries

What the analysis did not establish

  • Only three of six repository files were provided as text; the remaining three files (utils/menu_functions.py, utils/register_device.py, and payloads directory) are omitted, so the full connection and pairing logic is not visible.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files in the repository were included.
  • Three additional files in the repository (total 6 files) were not included in the text evidence; their content is unknown.
  • Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
  • The review is limited to static analysis of the provided source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1