CVE-2023-45866

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-45866 has a selected CVSS score of 6.3 (medium); EIP currently links 12 repository PoCs.

Description

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
12

Proofs of concept

12

Repository PoCs

GitHubSergeb250/BlueDuckyRepository PoCby Sergeb2501Exploit6 files

29.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

BlueDucky is a Python tool that exploits CVE-2023-45866 to inject keystrokes over Bluetooth. It connects to a target device's HID ports without authentication, then executes a DuckyScript payload to send arbitrary keyboard input.

Backdoor review

No backdoor observed in reviewed code

The reviewed code implements a Bluetooth HID attack tool (BlueDucky) exploiting CVE-2023-45866. It connects to a target, sends HID keyboard reports based on a user-supplied DuckyScript payload, and includes standard Bluetooth pairing and connection management. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload delivery was observed. The tool's behavior is consistent with its stated purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareBlueZLinux Bluetooth stack
Attack typesBluetooth HID spoofingKeystroke injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2023-45866 by establishing unauthenticated Bluetooth HID connections and injecting keystrokes. It does not merely detect the vulnerability; it performs the attack.

README.md:16-18BlueDucky.py:621-627BlueDucky.py:277-303

Requirements

  • Target device must be vulnerable to CVE-2023-45866 (unauthenticated Bluetooth HID connection).README.md:16-18
  • Attacker must have a Bluetooth adapter and be within range of the target.BlueDucky.py:66-77

Observed behavior

  • Registers an HID profile and sets the Bluetooth adapter class to 0x002540 (keyboard).BlueDucky.py:598-607
  • Connects to the target device on L2CAP ports 1 (SDP), 17 (HID Control), and 19 (HID Interrupt).BlueDucky.py:621-627
  • Parses a DuckyScript payload and sends HID keyboard reports (key presses and releases) to the target.BlueDucky.py:305-440
  • Sends raw HID reports for special commands like PRIVATE_BROWSER and VOLUME_UP.BlueDucky.py:327-348
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Bluetooth Hid Injection
CVE-2023-45866 exploitation via L2CAP HID keyboard reportsThe tool exploits a known vulnerability to inject keystrokes into unauthenticated Bluetooth HID hosts. This is the advertised functionality.BlueDucky.py:1-699README.md:16-20
Duckyscript Parser
process_duckyscript functionParses and executes DuckyScript commands (STRING, DELAY, ENTER, modifier combinations) to generate HID reports. This is the core payload delivery mechanism.BlueDucky.py:305-439
External Dependency
pydbus, pybluez, bluetoothUses standard Linux Bluetooth libraries for HID profile registration and L2CAP communication. No obfuscated or unexpected network activity.BlueDucky.py:1-5requirements.txt:1-8
Review boundaries

What the analysis did not establish

  • Only three of six repository files were provided as text; the remaining three files (utils/menu_functions.py, utils/register_device.py, and payloads directory) are omitted, so the full connection and pairing logic is not visible.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files in the repository were included.
  • Three additional files in the repository (total 6 files) were not included in the text evidence; their content is unknown.
  • Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
  • The review is limited to static analysis of the provided source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub0xBADACTOR/CVE-2023-45866Repository PoCby 0xBADACTOR0Exploit15 files

156.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a complete, interactive exploit wizard for CVE-2023-45866, a Bluetooth HID impersonation vulnerability. It guides an operator through scanning for a vulnerable Android device, selecting a keystroke injection profile (e.g., installing a malicious APK), and executing the attack by sending raw HID report bytes over L2CAP to gain remote access.

Backdoor review

No backdoor observed in reviewed code

The reviewed text evidence describes a complete, self-contained proof-of-concept exploit for CVE-2023-45866. All code and documentation is focused on the stated purpose: exploiting a Bluetooth HID impersonation vulnerability to inject keystrokes and install a Meterpreter payload on a vulnerable Android device. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit was observed. The binary APK payload is flagged as uninspected, which is a material limitation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonCShell
Target softwareAndroidBlueZ
Attack typesBluetooth HID spoofingKeystroke injectionRemote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, functional code designed to actively exploit CVE-2023-45866. It includes a C tool to establish unauthorized Bluetooth HID connections and send keystrokes, a Python engine to generate the malicious HID payloads, and a wizard script to orchestrate the full attack chain, resulting in remote code execution on the target. This goes beyond mere detection or scanning.

poc/hid_inject.c:1-30poc/bt-hid-wizard.py:1-18poc/hid_attack.py:1-18

Requirements

  • A vulnerable Android device (patch level before December 2023) with Bluetooth enabled and the screen unlocked.README.md:22-24poc/bt-hid-wizard.py:828-831
  • The attacker must be within Bluetooth range (typically 2-30 meters) of the target device.poc/bt-hid-wizard.py:845-849
  • For the APK installation profile, the malicious APK must be pre-staged on the target device's storage.README.md:103-106

Observed behavior

  • The wizard script (bt-hid-wizard.py) interactively collects the target's Bluetooth MAC address and the desired attack profile from the operator.poc/bt-hid-wizard.py:324-345poc/bt-hid-wizard.py:480-495
  • The Python engine (hid_attack.py) converts a YAML keystroke profile into a sequence of 10-byte USB HID boot keyboard reports.poc/hid_attack.py:275-319
  • The C tool (hid_inject.c) connects to the target device over Bluetooth L2CAP on the HID Control (PSM 0x0011) and HID Interrupt (PSM 0x0013) channels and transmits the generated HID report bytes.poc/hid_inject.c:280-305poc/hid_inject.c:313-339
  • The attack chain culminates in the target device executing the injected keystrokes, which can install a malicious APK that calls back to a Metasploit handler, providing the attacker with a remote shell.README.md:120-133poc/bt-hid-wizard.py:1110-1121
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Bluetooth HID keystroke injection to install a Meterpreter APKThe entire codebase is dedicated to exploiting CVE-2023-45866. The wizard (bt-hid-wizard.py) guides the operator through connecting to a target, the engine (hid_attack.py) generates HID reports, and the C tool (hid_inject.c) transmits them over L2CAP. The declared goal is to install a Meterpreter APK for remote access.README.md:3-11poc/bt-hid-wizard.py:9-18poc/hid_inject.c:1-30
Binary Payload
payloads/invoices.apkThe repository includes a pre-built APK described as a 'malicious meterpreter APK'. The binary content was not analyzed, which is a limitation of this review.README.md:44-46
Operator Guidance
Extensive warnings and legal disclaimersThe documentation and wizard code contain multiple, prominent warnings about legal restrictions, authorized use only, and the need for a controlled lab environment. This is consistent with a legitimate security research tool and does not indicate deception.README.md:3-26poc/bt-hid-wizard.py:180-192
Review boundaries

What the analysis did not establish

  • The evidence packet includes one binary file (payloads/invoices.apk) that was not analyzed. Its contents are only known from the surrounding text descriptions.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its operational reliability is not verified.
  • The binary file 'payloads/invoices.apk' was flagged as BINARY and was not analyzed. Its behavior cannot be verified from the supplied text evidence alone.
  • Nine other files in the repository were omitted from the text evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubpentestfunctions/BlueDuckyRepository PoCby pentestfunctions1,886Not analyzed16 files

845.2 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubEason-zz/BluetoothDuckyRepository PoCby Eason-zz13Not analyzed12 files

31.1 KiB

GitHub
PoC details
GitHubjjjjjjjj987/cve-2023-45866-pyRepository PoCby jjjjjjjj9870Not analyzed3 files

358 B

GitHub
PoC details
GitHubcisnarfu/BluepopRepository PoCby cisnarfu0Not analyzed23 files

37.0 KiB

GitHub
PoC details
GitHubAvishekDhakal/CVE-2023-45866_EXPLOITSRepository PoCby AvishekDhakal2Not analyzed9 files

2.4 KiB

GitHub
PoC details
GitHubChedrian07/CVE-2023-45866-POCRepository PoCby Chedrian070Not analyzed28 files

94.3 KiB

GitHub
PoC details
GitHubDanyw24/blueXploitRepository PoCby Danyw2416Not analyzed10 files

48.7 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubxG3nesis/RustyInjectorRepository PoCby xG3nesis1Not analyzed16 files

549.4 KiB

GitHub
PoC details
GitHubladyg00se/CVE-2023-45866_WIPRepository PoCby ladyg00se0Not analyzed4 files

43.2 KiB

GitHub
PoC details
GitLabsyedusama5556/BlueDuckyRepository PoCby syedusama55560Exploit16 files

845.2 KiB

GitLab
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

BlueDucky is a Python tool that exploits CVE-2023-45866 to inject HID keyboard reports over Bluetooth without user authorization. It registers a fake HID profile, pairs without user interaction using a 'NoInputNoOutput' agent, connects to L2CAP ports 17 and 19, and executes DuckyScript payloads to send keystrokes to the target.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files implement a Bluetooth HID attack tool (BlueDucky) targeting CVE-2023-45866. The code establishes Bluetooth connections, registers an HID keyboard profile, and sends keystrokes from a DuckyScript payload. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed in the supplied text evidence. The tool's functionality is consistent with its stated purpose as a proof-of-concept exploit.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareBlueZLinux Bluetooth stack
Attack typesBluetooth HID spoofingkeystroke injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2023-45866 by establishing unauthorized Bluetooth connections and injecting HID keyboard reports. It does not merely detect or scan for the vulnerability; it performs the full attack chain: profile registration, unauthorized pairing, L2CAP connection, and keystroke injection.

BlueDucky.py:609-638BlueDucky.py:726-729README.md:16-18

Requirements

  • Linux system with a Bluetooth adapter and BlueZ stackREADME.md:33
  • Target device with Bluetooth enabled and vulnerable to CVE-2023-45866README.md:16-18
  • Python dependencies: pybluez, pydbus, dbus, GLibBlueDucky.py:1-5

Observed behavior

  • Registers a Bluetooth HID profile (keyboard) via D-Bus ProfileManager1utils/register_device.py:32-219
  • Registers a 'NoInputNoOutput' pairing agent to bypass user authorizationutils/register_device.py:17-29
  • Connects to target over L2CAP on ports 1 (SDP), 17 (HID Control), and 19 (HID Interrupt)BlueDucky.py:632-638
  • Sends HID keyboard reports (keystrokes) based on DuckyScript payloadsBlueDucky.py:181-192BlueDucky.py:315-449
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Bluetooth Hid Exploit
CVE-2023-45866The tool exploits a Bluetooth HID host vulnerability to inject keystrokes without user authorization.BlueDucky.py:1-759README.md:16-18
Duckyscript Payload Execution
process_duckyscript functionParses and executes DuckyScript commands to send HID keyboard reports over Bluetooth.BlueDucky.py:315-449
Bluetooth Pairing Agent
NoInputNoOutput agentRegisters a Bluetooth pairing agent that accepts connections without user interaction, enabling the exploit.utils/register_device.py:17-29
Review boundaries

What the analysis did not establish

  • Two Python bytecode files (utils/__pycache__/menu_functions.cpython-311.pyc and utils/__pycache__/register_device.cpython-311.pyc) are present but not analyzed; their source counterparts are included and analyzed.
  • The file __init__.py is listed as unavailable as text, but its absence does not affect the classification as the core exploit logic is fully present in the analyzed files.
  • Two Python bytecode files (utils/__pycache__/menu_functions.cpython-311.pyc, utils/__pycache__/register_device.cpython-311.pyc) were present but not analyzed; their corresponding source files were reviewed and showed no backdoor behavior.
  • One text file (__init__.py) was listed as unavailable as text and not reviewed.
  • Three non-text media files (images) were not analyzed.
  • The review is limited to static analysis of the provided text; dynamic behavior or network traffic was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

Showing 12 of 16