Environment: attack host and target phone under the same LAN; the target phone has Bluetooth turned on, but the hidden
Simple principle: learned that the target phone turned on Bluetooth, through the Bluegranger to the target phone to send backdoor procedures, with MSF infiltration mobile phone
Detailed process:
1.Load Bluetooth device and scan, no Bluetooth device found:Hciconfighciconfig Hci0 uphcitool ScanPhone-Side settings:
2.Use the Fang tool to scan the hidden Bluetooth device, you can set the scan range, the default is 000000000000>>>ffffffffff; in order to faster, here set the range is smaller, the actual is not necessarily so simple!Fang-r Range-Sfang-r b0aa3618e5d8-b0aa3618e5f4-sOK, sweep to a myteelphone device:
3.To force a Bluetooth device to connect using the Blueranger tool:blueranger.sh
Mobile-side display:
4.Use MSF to generate the backdoor and start listening, then send the backdoor to the target phone with the system's own Bluetooth software, and the target phone will pop up a dialog box to accept the file.assume that this person clicks accept and run the program：
Penetration success!
Summary: The ping process for a good phone cannot successfully reach the mandatory link, and each attempt to link on the target phone will pop up the pairing request box, this effect can make the target phone does not use the phone properly, but this is not the desired effect.
[KALI_BT] A less-than-perfect process of forcing links and penetrating smartphones via Bluetooth
