syedusama5556/BlueDucky

GitLabRepository PoCExploit

PoC files

16 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitLab
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

BlueDucky is a Python tool that exploits CVE-2023-45866 to inject HID keyboard reports over Bluetooth without user authorization. It registers a fake HID profile, pairs without user interaction using a 'NoInputNoOutput' agent, connects to L2CAP ports 17 and 19, and executes DuckyScript payloads to send keystrokes to the target.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files implement a Bluetooth HID attack tool (BlueDucky) targeting CVE-2023-45866. The code establishes Bluetooth connections, registers an HID keyboard profile, and sends keystrokes from a DuckyScript payload. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed in the supplied text evidence. The tool's functionality is consistent with its stated purpose as a proof-of-concept exploit.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareBlueZLinux Bluetooth stack
Attack typesBluetooth HID spoofingkeystroke injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2023-45866 by establishing unauthorized Bluetooth connections and injecting HID keyboard reports. It does not merely detect or scan for the vulnerability; it performs the full attack chain: profile registration, unauthorized pairing, L2CAP connection, and keystroke injection.

BlueDucky.py:609-638BlueDucky.py:726-729README.md:16-18

Requirements

  • Linux system with a Bluetooth adapter and BlueZ stackREADME.md:33
  • Target device with Bluetooth enabled and vulnerable to CVE-2023-45866README.md:16-18
  • Python dependencies: pybluez, pydbus, dbus, GLibBlueDucky.py:1-5

Observed behavior

  • Registers a Bluetooth HID profile (keyboard) via D-Bus ProfileManager1utils/register_device.py:32-219
  • Registers a 'NoInputNoOutput' pairing agent to bypass user authorizationutils/register_device.py:17-29
  • Connects to target over L2CAP on ports 1 (SDP), 17 (HID Control), and 19 (HID Interrupt)BlueDucky.py:632-638
  • Sends HID keyboard reports (keystrokes) based on DuckyScript payloadsBlueDucky.py:181-192BlueDucky.py:315-449
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Bluetooth Hid Exploit
CVE-2023-45866The tool exploits a Bluetooth HID host vulnerability to inject keystrokes without user authorization.BlueDucky.py:1-759README.md:16-18
Duckyscript Payload Execution
process_duckyscript functionParses and executes DuckyScript commands to send HID keyboard reports over Bluetooth.BlueDucky.py:315-449
Bluetooth Pairing Agent
NoInputNoOutput agentRegisters a Bluetooth pairing agent that accepts connections without user interaction, enabling the exploit.utils/register_device.py:17-29
Review boundaries

What the analysis did not establish

  • Two Python bytecode files (utils/__pycache__/menu_functions.cpython-311.pyc and utils/__pycache__/register_device.cpython-311.pyc) are present but not analyzed; their source counterparts are included and analyzed.
  • The file __init__.py is listed as unavailable as text, but its absence does not affect the classification as the core exploit logic is fully present in the analyzed files.
  • Two Python bytecode files (utils/__pycache__/menu_functions.cpython-311.pyc, utils/__pycache__/register_device.cpython-311.pyc) were present but not analyzed; their corresponding source files were reviewed and showed no backdoor behavior.
  • One text file (__init__.py) was listed as unavailable as text and not reviewed.
  • Three non-text media files (images) were not analyzed.
  • The review is limited to static analysis of the provided text; dynamic behavior or network traffic was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1