0xBADACTOR/CVE-2023-45866

GitHubRepository PoCExploit

PoC files

15 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a complete, interactive exploit wizard for CVE-2023-45866, a Bluetooth HID impersonation vulnerability. It guides an operator through scanning for a vulnerable Android device, selecting a keystroke injection profile (e.g., installing a malicious APK), and executing the attack by sending raw HID report bytes over L2CAP to gain remote access.

Backdoor review

No backdoor observed in reviewed code

The reviewed text evidence describes a complete, self-contained proof-of-concept exploit for CVE-2023-45866. All code and documentation is focused on the stated purpose: exploiting a Bluetooth HID impersonation vulnerability to inject keystrokes and install a Meterpreter payload on a vulnerable Android device. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit was observed. The binary APK payload is flagged as uninspected, which is a material limitation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonCShell
Target softwareAndroidBlueZ
Attack typesBluetooth HID spoofingKeystroke injectionRemote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, functional code designed to actively exploit CVE-2023-45866. It includes a C tool to establish unauthorized Bluetooth HID connections and send keystrokes, a Python engine to generate the malicious HID payloads, and a wizard script to orchestrate the full attack chain, resulting in remote code execution on the target. This goes beyond mere detection or scanning.

poc/hid_inject.c:1-30poc/bt-hid-wizard.py:1-18poc/hid_attack.py:1-18

Requirements

  • A vulnerable Android device (patch level before December 2023) with Bluetooth enabled and the screen unlocked.README.md:22-24poc/bt-hid-wizard.py:828-831
  • The attacker must be within Bluetooth range (typically 2-30 meters) of the target device.poc/bt-hid-wizard.py:845-849
  • For the APK installation profile, the malicious APK must be pre-staged on the target device's storage.README.md:103-106

Observed behavior

  • The wizard script (bt-hid-wizard.py) interactively collects the target's Bluetooth MAC address and the desired attack profile from the operator.poc/bt-hid-wizard.py:324-345poc/bt-hid-wizard.py:480-495
  • The Python engine (hid_attack.py) converts a YAML keystroke profile into a sequence of 10-byte USB HID boot keyboard reports.poc/hid_attack.py:275-319
  • The C tool (hid_inject.c) connects to the target device over Bluetooth L2CAP on the HID Control (PSM 0x0011) and HID Interrupt (PSM 0x0013) channels and transmits the generated HID report bytes.poc/hid_inject.c:280-305poc/hid_inject.c:313-339
  • The attack chain culminates in the target device executing the injected keystrokes, which can install a malicious APK that calls back to a Metasploit handler, providing the attacker with a remote shell.README.md:120-133poc/bt-hid-wizard.py:1110-1121
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Bluetooth HID keystroke injection to install a Meterpreter APKThe entire codebase is dedicated to exploiting CVE-2023-45866. The wizard (bt-hid-wizard.py) guides the operator through connecting to a target, the engine (hid_attack.py) generates HID reports, and the C tool (hid_inject.c) transmits them over L2CAP. The declared goal is to install a Meterpreter APK for remote access.README.md:3-11poc/bt-hid-wizard.py:9-18poc/hid_inject.c:1-30
Binary Payload
payloads/invoices.apkThe repository includes a pre-built APK described as a 'malicious meterpreter APK'. The binary content was not analyzed, which is a limitation of this review.README.md:44-46
Operator Guidance
Extensive warnings and legal disclaimersThe documentation and wizard code contain multiple, prominent warnings about legal restrictions, authorized use only, and the need for a controlled lab environment. This is consistent with a legitimate security research tool and does not indicate deception.README.md:3-26poc/bt-hid-wizard.py:180-192
Review boundaries

What the analysis did not establish

  • The evidence packet includes one binary file (payloads/invoices.apk) that was not analyzed. Its contents are only known from the surrounding text descriptions.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its operational reliability is not verified.
  • The binary file 'payloads/invoices.apk' was flagged as BINARY and was not analyzed. Its behavior cannot be verified from the supplied text evidence alone.
  • Nine other files in the repository were omitted from the text evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1