bettercap / gatt

Gatt is a Go package for building Bluetooth Low Energy peripherals

Join the project community on our server!

---

bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking WiFi networks, Bluetooth Low Energy devices, wireless HID devices and Ethernet networks.

Main Features

• WiFi networks scanning, deauthentication attack, clientless PMKID association attack and automatic WPA/WPA2 client handshakes capture.
• Bluetooth Low Energy devices scanning, characteristics enumeration, reading and writing.
• 2.4Ghz wireless devices scanning and MouseJacking attacks with over-the-air HID frames injection (with DuckyScript support).
• Passive and active IP network hosts probing and recon.
• ARP, DNS, NDP and DHCPv6 spoofers for MITM attacks on IPv4 and IPv6 based networks.
• Proxies at packet level, TCP level and HTTP/HTTPS application level fully scriptable with easy to implement javascript plugins.
• A powerful network sniffer for credentials harvesting which can also be used as a network protocol fuzzer.
• A very fast port scanner.
• A powerful REST API with support for asynchronous events notification on websocket to orchestrate your attacks easily.
• A very convenient web UI.
• More!

License

bettercap is made with ♥ by the dev team and it's released under the GPL 3 license.

Stargazers over time

gatt's Issues

Service data slice copy indexing UUID bytes

gatt/adv.go

Line 2000 in df6e615

copy(serviceData.Data, d[2:])

Shouldn't this line be:

copy(serviceData.Data, d[w:]) 

Seems like copy is indexing some bytes of the UUID in cases typeServiceData32 (Service Data 32-bit UUID) and typeServiceData128 (Service Data 128-bit UUID).

Bug in asm.s breaks build

A bug in this library breaks the build of bettercap:

LC_ALL=en_US.utf8 go get github.com/bettercap/bettercap
# github.com/bettercap/gatt/linux/socket
go/src/github.com/bettercap/gatt/linux/socket/asm.s:5:10: fatal error: textflag.h: No such file or directory
 #include "textflag.h"
          ^~~~~~~~~~~~
compilation terminated.

Bettercap ble.enum issues..

Prerequisites

Please, before creating this issue make sure that you read the README, that you are running the latest stable version and that you already searched other issues to see if your problem or request was already reported.

! PLEASE REMOVE THIS PART AND LEAVE ONLY THE FOLLOWING SECTIONS IN YOUR REPORT !

Description of the bug or feature request

Environment

Please provide:

• Bettercap version you are using ( 2.21.1 ).
• OS version and architecture you are using. (Parrot OS)
• Go version if building from sources. From this Github
• Command line arguments you are using. I've listed them under the steps
• Caplet code you are using or the interactive session commands.
• Full debug output while reproducing the issue ( bettercap -debug ... ).

Steps to Reproduce

1. su
2. bettercap
3. bettercap.recon on
4. bettercap.recon off
5. bettercap.show
6. Copy the Mac Address of the bluetooth device.
7. ble.enum Mac Address

Expected behavior: What you expected to happen
I expected it to show information on the bluetooth device.

Actual behavior: What actually happened

ble.enum 59:a6:91:88:3e:8e
[18:43:21] [sys.log] [inf] ble.recon connecting to 59:a6:91:88:3e:8e ...
» panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0x9bf0c2]

goroutine 283 [running]:
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleConnection(0xc0006882d0, 0xc000803003, 0x13, 0xffd)
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:364 +0x232
created by github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleLEMeta
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:411 +0x1bc

♥ ANY INCOMPLETE REPORT WILL BE CLOSED RIGHT AWAY ♥

hanging on macOS

The library is hanging on macOS High Sierra (latest), after some debugging, this message is correctly sent but no response is received on this channel, probably some of those XPC constants/structures/types changed.

idk ¯\_(ツ)_/¯

SendAndCheckResp crash when rsp has no elements

I'm not too familiar with this library but I saw this question on SO, which highlight an issue in the function

func (c *Cmd) SendAndCheckResp(cp CmdParam, exp []byte) error {
	rsp, err := c.Send(cp)
	if err != nil {
		return err
	}
	// Don't care about the response
	if len(exp) == 0 {
		return nil
	}
	// Check the if status is one of the expected value
	if !bytes.Contains(exp, rsp[0:1]) {
		return fmt.Errorf("HCI command: '0x%04x' return 0x%02X, expect: [%X] ", cp.Opcode(), rsp[0], exp)
	}
	return nil
}

when the rsp is empty, or have capacity zero. The problem seems to be when trying to access the first two elements on rsp on line

if !bytes.Contains(exp, rsp[0:1]) {
....

I think this issue could be avoided just checking if len(rsp) == 0, and respond appropriately, but again I'm not familiar with the library so a better solution could be suggested by another person. I just thought is worth to report the issue.

Send call is successful but receives an empty response with nrf52840 dongle as bluetooth usb

Hi,

I use this on Ubuntu 20.04 and Raspberry Pi OS 5.10 but this is not a Linux related issue.

I'm having an issue when I use ble.recon on with a different bluetooth dongle.

When I use it with a dongle using Realtek RTL8761b drivers ( MPOW MPBH456AB ) it works well, but when I use a NordicSemi nrf52840 dongle ( https://www.nordicsemi.com/Products/Development-hardware/nrf52840-dongle ) which is my goal, flashed with Zephyr RTOS' hci_usb sample ( https://github.com/zephyrproject-rtos/zephyr/tree/main/samples/bluetooth/hci_usb ) which is supposed to turn any micro controller using bluetooth into a regular bluetooth dongle that any computer is supposed to recognize as, it throws this error:

>> ble.recon on
   panic: runtime error: slice bounds out of range [:1] with capacity 0

   goroutine 1 [running]:
   github.com/bettercap/gatt/linux/cmd.(*Cmd).SendAndCheckResp(0x1c637c0, 0xa0c760, 0x1c64fe8, 0x1c6501c, 0x1, 0x1, 0x0, 0x0)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]/linux/cmd/cmd.go:98 +0x1b4
   github.com/bettercap/gatt/linux.(*HCI).resetDevice(0x18ac0a0, 0x93dc10, 0x18ac0a0)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]/linux/hci.go:273 +0x2f0
   github.com/bettercap/gatt/linux.NewHCI(0xffffffff, 0x184fd01, 0xff, 0x2, 0x0, 0x0)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]/linux/hci.go:90 +0x4c0
   github.com/bettercap/gatt.NewDevice(0x184fd1c, 0x2, 0x2, 0x3c, 0x184fd24, 0x1, 0x1)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]/device_linux.go:57 +0x114
   github.com/bettercap/bettercap/modules/ble.(*BLERecon).Configure(0x18a2780, 0x0, 0x4)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/modules/ble/ble_recon.go:165 +0x1cc
   github.com/bettercap/bettercap/modules/ble.(*BLERecon).Start(0x18a2780, 0x1, 0x1b2c001)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/modules/ble/ble_recon.go:183 +0x1c
   github.com/bettercap/bettercap/modules/ble.NewBLERecon.func1(0x0, 0x0, 0x0, 0x84f358, 0xc)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/modules/ble/ble_recon.go:56 +0x1c
   github.com/bettercap/bettercap/session.(*ModuleHandler).Exec(0x1b2c0c0, 0x0, 0x0, 0x0, 0x0, 0x0)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/session/module_handler.go:74 +0x80
   github.com/bettercap/bettercap/session.(*Session).Run(0x18fb2c0, 0x1c64e30, 0xc, 0x1, 0x1)
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/session/session.go:416 +0x284
   main.main()
    /home/pi/go/pkg/mod/github.com/bettercap/[email protected]+incompatible/main.go:94 +0x8c8

The problem is only when I'm using the nrf dongle, otherwise it works with the host's bluetooth and the other realtek dongle.

The nrf dongle works with the BlueZ stack, here are the results:

bluetoothctl ( has a BD address ) Scan does work

$ sudo bluetoothctl
  Agent registered
  [bluetooth]# list
  Controller EB:XX:XX:XX:XX:XX BlueZ 5.50 [default]

btmgmt ( finds the controller ) Scan does work

$ sudo btmgmt --index 0
   [hci0]# auto-power
   Found controller with index 0
   [hci0]# find -l

So, I assume the dongle works well with BlueZ, being the Linux official bluetooth stack it's a good sign, but I thought that Bettercap was also using BlueZ and in that sense the dongle should work.

The problem seems to come from https://github.com/bettercap/gatt/blob/master/linux/cmd/cmd.go#L98

Thank you so much for your help !

Increase available bytes when sending json data

I always get the error "requested write 42 bytes, 22 available" and I can't find a way to increase the available data size.

Cannot build or install on mac 10.13.6

╭─ ~/gopath/src/gith….com/bett…rcap/gatt 
╰─ go build .
# github.com/bettercap/gatt/xpc
xpc_wrapper_darwin.c:41:9: warning: implicit declaration of function 'Block_copy' is invalid in C99 [-Wimplicit-function-declaration]
xpc_wrapper_darwin.c:41:9: error: invalid block pointer conversion passing 'int' to parameter of type 'xpc_handler_t _Nonnull' (aka 'void (^)(xpc_object_t _Nonnull)')
/usr/include/xpc/connection.h:318:16: note: passing argument to parameter 'handler' here

Unbundle xpc and gioctl

xpc and gioctl are bundled. Distribution packages should depend on other packages rather than on bundled code.

Do you have any plan to un-bundle them?

panic: runtime error: slice bounds out of range

goroutine 314289 [running]:
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt.(*Advertisement).unmarshall.func1(0x0, 0x0, 0x0, 0xc000764016, 0x7, 0x1a, 0x10, 0xc000a9a530, 0xa96687, 0xc000a9a570)
        /root/gocode/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/adv.go:1986 +0x14f
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt.(*Advertisement).unmarshall(0xc0018061a0, 0xc000764014, 0x9, 0x1c, 0x14, 0x30)
        /root/gocode/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/adv.go:2021 +0x448
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt.(*device).Init.func3(0xc000e7c550)
        /root/gocode/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/device_linux.go:97 +0x6d
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleAdvertisement(0xc0008a0120, 0xc000dc2003, 0x15, 0xffd)
        /root/gocode/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:299 +0x2e7
created by github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleLEMeta
        /root/gocode/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:415 +0x16b

Undefined: central on FreeBSD 11.2

Running FreeBSD 11.2-RELEASE, and using go.1.11.1 amd64.

After running:

go get -v github.com/bettercap/bettercap

I receive the following error:

github.com/bettercap/bettercap
# github.com/bettercap/gantt
go/src/github.com/bettercap/gantt/central.go:118:11: undefined: central

link to source error line

This is a fresh install of FreeBSD and go.
Any suggestions?

Thanks,
Pete

Panic on linux when advertisementData has a length of 255

panic: runtime error: slice bounds out of range [2:0]

How to reproduce: Run the discoverer.go example, and have some BLE device nearby that has a 255 byte-long advertisement data, so that

gatt/adv.go

Lines 2008 to 2013 in df6e615

	l, t := b[0], b[1]
	if int(l) < 1 || len(b) < int(1+l) {
	return errors.New("invalid advertise data")
	}
	d := b[2 : 1+l]

causes 1 + l to overflow to 0.

I also received this error from the ble.recon bettercap module.

Fixes: I am not familiar with the bluetooth spec, so I am not sure if such a length is valid. Nor am I sure what device was causing the error.
If this is not standard and should not be allowed, then adding a check and returning an error would solve the problem. Otherwise, l, t := uint(b[0]), b[1] prevents the overflow.

ignore l2cap signal

I am running a custom service for BLE device. While trying to connect my mobile app with GATT server, it throws following log:

ignore l2cap signal:[ 06 00 05 00 13 02 02 00 00 00 ]

No communication is further carried out after this log message appears.

When enable go modules feature, will fail to go get

OS: Ubuntu 18.04.1 LTS
GO VERSION: go1.11.12 linux/amd64

When I used "go get github.com/bettercap/gatt", it will throw error:
root:/home/root/code/tmp1/ipc#go get github.com/bettercap/gatt
go build github.com/mgutz/logxi/v1: no Go files in

Onconnect Callbacks

Hi,

does anyone know from where we will get the callback or listeners.

another runtime error: invalid memory

Getting an invalid memory address or nil pointer dereference error when using ble.enum.
Note: this error happened in previous versions as well.

Environment

Please provide:

Bettercap Version: v2.23 (latest release)
OS: Ubuntu 18
Go version: n/a
cmd-line argument: sudo bettercap --debug
caplet: n/a
full debug output:

...
» ble.enum aa:bb:cc:dd:ee:ff
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] got 1 devices
[13:14:19] [sys.log] [dbg] ble.recon initializing device (id:-1) ...
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] dev: hci0 up
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] dev: hci0 reset
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] dev: hci0 down
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] dev: hci0 opened
[13:14:19] [sys.log] [dbg] ble.recon [gatt.log] hci.mainLoop started
[13:14:19] [sys.log] [inf] ble.recon connecting to aa:bb:cc:dd:ee:ff ...
[13:14:19] [sys.log] [dbg] ble.recon state changed to PoweredOn
[13:14:19] [sys.log] [dbg] ble.recon current device was not cleaned: &{ **** }
» panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0x9d4702]

goroutine 3354 [running]:
github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleConnection(0xc0000b4ab0, 0xc000612003, 0x13, 0xffd)
/path/to/go/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:364 +0x232
created by github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux.(*HCI).handleLEMeta
/path/to/go/src/github.com/bettercap/bettercap/vendor/github.com/bettercap/gatt/linux/hci.go:411 +0x206

Steps to Reproduce

1. Install latest version
2. Run sudo bettercap --debug
3. ble.recon on; ble.enum
4. also: ble.write throws this error for me.

I imagine this will be hard to reproduce as this is not a strange use-case...

Expected behavior: Not a crash

Actual behavior: This crash