search

insecurityofthings / jackit

JackIt - Exploit Code for Mousejack
811 stars 145 forks source link

Microsoft Keyboards bug #29

Closed pand0rausa closed 7 years ago

pand0rausa commented 7 years ago

I am currently testing a lot of different keyboards. One thing that I have noticed is that all of the Microsoft keyboards (Microsoft Wireless 900 Desktop, MS Wireless 2000 and the Sculpt specifically) have an issue where, no matter the channel that is detected they are xmitting on, jackit will send the attack on channel 29. According to the testing done by Bastille at a minimum the 900 and 2000 are vulnerable. For example, I'll have something like this:

Key  Address        Channel   Count   Seen      Type                   Packet
1  AA:1D:6F:99:68  70,50       3   0:00:02 ago   Microsoft HID    08:90:27:01:DB:20:40:00:02:00:00:00:00:00:00:00:00:00:F8

Ping success on channel 29
Sending attack to AA:1D:6F:99:68 [Microsoft HID] on channel 29

The attack finishes but nothing happens. This happens on 3 different MS keyboards (always channel 29).

Update: Finally got an attack where the MS combo was on channel 29 and the attack was sent to the same channel. The attack looks like it should have worked but nothing happened on the victim box.

infamy commented 7 years ago

Some of the Microsoft keyboards can get patched if used with a windows 10 machine. See the readme.