ble_ctf_infinity - Advanced: Bluetooth low energy capture the flag

项目说明

![Follow Hackgnar]()

Index

Building and installing the CTF

CTF architecture

Contributing to the project

FAQ

BLE Capture the Flag v2.0

Welcome to BLE CTF Infinity! This project is the continuation of my first BLE CTF. If you have not done the first of my CTF or are new to Bluetooth LE, I recommend you start there. The BLE CTF Infinity project is more challenging than the first .

The purpose of BLE CTF is to teach the core concepts of Bluetooth Low Energy client and ser. While it has also been built to be fun, it was built with the intent to teach and reinforce core concepts that are needed to plunge into the world of Bluetooth hacking. After completing this CTF, you should ha you need to start fiddling with any BLE GATT device you can find.

Getting Started

Assuming you have the CTF flashed to an ESP32 and are ready to go, read on.

It is recommended that you have a Linux box (OSX/Win + Linux ) with a Bluetooth controller or a Bluetooth USB dongle to do the CTF. On your Linux machine you should install Bluetooth tools such as Bluez tools (hcitool, gatttool, bluetoothctl etc). For some flags, it is also useful to install wireshark/tshark, bleah, bettercap, etc.

Once your ESP32 is powered up, it will automatically start you off on the CTFs main dashboard. This dashboard is a GATT server that shows you your current status on all flags. It is also the location where you will submit all of your flag once you solve the challenges. Finally, it also functions as na system to go to flags you want to work on. Lets give it a try.

Find your CTFs Bluetooth MAC address if you don't already have it. Look for a GATT ser "BLE_CTF_SCORE"

Output:

Take a look at your dashboard with the tool of your choice (ie gatttool, bleah, bettercap, etc). The following is generated with an ugly gist I use:

Output:

| Handle | Characteristic | Permissions | Value |
| --- | --- | --- | --- |
| 0x0018 | 00002a01-0000-1000-8000-00805f9b34fb | READ | |
| 0x001a | 00002aa6-0000-1000-8000-00805f9b34fb | READ | |
| 0x002a | 0000ff01-0000-1000-8000-00805f9b34fb | READ | docs: |
| 0x002c | 0000ff02-0000-1000-8000-00805f9b34fb | READ | Flags complete: 0 /10 |
| 0x002e | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Submit flags here |
| 0x0030 | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Write 0x0000 to 0x00FF to goto flag |
| 0x0032 | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Write 0xC1EA12 to reset all flags |
| 0x0034 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 0: Incomplete |
| 0x0036 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 1: Incomplete |
| 0x0038 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 2: Incomplete |
| 0x003a | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 3: Incomplete |
| 0x003c | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 4: Incomplete |
| 0x003e | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 5: Incomplete |
| 0x0040 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 6: Incomplete |
| 0x0042 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 7: Incomplete |
| 0x0044 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 8: Incomplete |
| 0x0046 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 9: Incomplete |

Above you can see:

Handles that show the status of each flag in the CTF

A handle for submitting CFT flag

A handle for na to each flag

A handle for clearing your score on the CTF

Lets na to Flag 1 and take a look:

Output:

Don't worry about the abo. You will get a similar error each time you na to a different flag or scoreboard. Its una because of the way the CTF was architected.

Now, lets take a look at the flag 1 GATT server

Output:

| Handle | Characteristic | Permissions | Value |
| --- | --- | --- | --- |
| 0x0003 | 00002a05-0000-1000-8000-00805f9b34fb | WRITE NOTIFY | Characteristic value/descriptor read failed: Attribute can't be read|
| 0x0016 | 00002a00-0000-1000-8000-00805f9b34fb | READ | FLAG_1 |
| 0x0018 | 00002a01-0000-1000-8000-00805f9b34fb | READ | |
| 0x001a | 00002aa6-0000-1000-8000-00805f9b34fb | READ | |
| 0x002a | 0000ff01-0000-1000-8000-00805f9b34fb | READ | goodbye 👋 |
| 0x002c | 0000ff02-0000-1000-8000-00805f9b34fb | READ | Characteristic value/descriptor read failed: Request attribute has encountered an unlikely error|
| 0x002e | 0000ff03-0000-1000-8000-00805f9b34fb | READ WRITE | write here to goto to scoreboard |

Whoh! That's a whole different GATT server! How did you do that? I thought you could only host a single GATT server on one Bluetooth device!

Now lets return back to the scoreboard:

Assuming we found a flag value of 234567890, this is how you would submit it:

Then if we look at the dashboard again, you can see it shows we completed a flag

| Handle | Characteristic | Permissions | Value |
| --- | --- | --- | --- |
| 0x0018 | 00002a01-0000-1000-8000-00805f9b34fb | READ | |
| 0x001a | 00002aa6-0000-1000-8000-00805f9b34fb | READ | |
| 0x002a | 0000ff01-0000-1000-8000-00805f9b34fb | READ | docs: |
| 0x002c | 0000ff02-0000-1000-8000-00805f9b34fb | READ | Flags complete: 1 /10 |
| 0x002e | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Submit flags here |
| 0x0030 | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Write 0x0000 to 0x00FF to goto flag |
| 0x0032 | 0000ff02-0000-1000-8000-00805f9b34fb | READ WRITE | Write 0xC1EA12 to reset all flags |
| 0x0034 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 0: Incomplete |
| 0x0036 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 1: Complete |
| 0x0038 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 2: Incomplete |
| 0x003a | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 3: Incomplete |
| 0x003c | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 4: Incomplete |
| 0x003e | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 5: Incomplete |
| 0x0040 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 6: Incomplete |
| 0x0042 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 7: Incomplete |
| 0x0044 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 8: Incomplete |
| 0x0046 | 0000ff01-0000-1000-8000-00805f9b34fb | READ | Flag 9: Incomplete |

项目信息

开发语言：C

Star 数：71

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Advanced: Bluetooth low energy capture the flag展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。