git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/mifare_autopwn.lua

   1 local getopt = require('getopt')
   2 local reader = require('read14a')
   3 local cmds = require('commands')
   4
   5 example = "script run mifare_autopwn"
   6 author = "Martin Holst Swende"
   7 desc =
   8 [[
   9 This is a which automates cracking and dumping mifare classic cards. It sets itself into
  10 'listening'-mode, after which it cracks and dumps any mifare classic card that you
  11 place by the device.
  12
  13 Arguments:
  14         -d                              debug logging on
  15         -h                              this help
  16
  17 Output files from this operation:
  18         <uid>.eml               - emulator file
  19         <uid>.html              - html file containing card data
  20         dumpkeys.bin    - keys are dumped here. OBS! This file is volatile, as other commands overwrite it sometimes.
  21         dumpdata.bin    - card data in binary form. OBS! This file is volatile, as other commands (hf mf dump) overwrite it.
  22
  23 ]]
  24
  25 -------------------------------
  26 -- Some utilities
  27 -------------------------------
  28 local DEBUG = false
  29 local MIFARE_AUTH_KEYA = 0x60
  30 local MIFARE_AUTH_KEYB = 0x61
  31 ---
  32 -- A debug printout-function
  33 function dbg(args)
  34         if DEBUG then
  35                 print(":: ", args)
  36         end
  37 end
  38 ---
  39 -- This is only meant to be used when errors occur
  40 function oops(err)
  41         print("ERROR: ",err)
  42         return nil,err
  43 end
  44
  45 ---
  46 -- Usage help
  47 function help()
  48         print(desc)
  49         print("Example usage")
  50         print(example)
  51 end
  52
  53 ---
  54 -- Waits for a mifare card to be placed within the vicinity of the reader.
  55 -- @return if successfull: an table containing card info
  56 -- @return if unsuccessfull : nil, error
  57 function wait_for_mifare()
  58         while not core.ukbhit() do
  59                 res, err = reader.read1443a()
  60                 if res then return res end
  61                 -- err means that there was no response from card
  62         end
  63         return nil, "Aborted by user"
  64 end
  65
  66 function mfcrack()
  67         core.clearCommandBuffer()
  68         -- Build the mifare-command
  69         local cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 1, arg2 = 0, arg3 = MIFARE_AUTH_KEYA}
  70
  71         local retry = true
  72         while retry do
  73                 core.SendCommand(cmd:getBytes())
  74                 local key, errormessage = mfcrack_inner()
  75                 -- Success?
  76                 if key then return key end
  77                 -- Failure?
  78                 if errormessage then return nil, errormessage end
  79                 -- Try again..set arg1 to 0 this time.
  80
  81                 cmd = Command:new{cmd = cmds.CMD_READER_MIFARE, arg1 = 0, arg2 = 0, arg3 = MIFARE_AUTH_KEYA}
  82         end
  83         return nil, "Aborted by user"
  84 end
  85
  86 function mfcrack_inner()
  87         while not core.ukbhit() do
  88                 local result = core.WaitForResponseTimeout(cmds.CMD_ACK,1000)
  89                 if result then
  90
  91                         --[[
  92                         I don't understand, they cmd and args are defined as uint32_t, however,
  93                         looking at the returned data, they all look like 64-bit things:
  94
  95                         print("result", bin.unpack("HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH", result))
  96
  97                         FF      00      00      00      00      00      00      00      <-- 64 bits of data
  98                         FE      FF      FF      FF      00      00      00      00      <-- 64 bits of data
  99                         00      00      00      00      00      00      00      00      <-- 64 bits of data
 100                         00      00      00      00      00      00      00      00      <-- 64 bits of data
 101                         04      7F      12      E2      00             <-- this is where 'data' starts
 102
 103                         So below I use LI to pick out the "FEFF FFFF", don't know why it works..
 104                         --]]
 105                         -- Unpacking the arg-parameters
 106                         local count,cmd,isOK = bin.unpack('LI',result)
 107                         --print("response", isOK)--FF FF FF FF
 108                         if isOK == 0xFFFFFFFF then
 109                                 return nil, "Button pressed. Aborted."
 110                         elseif isOK == 0xFFFFFFFE then
 111                                 return nil, "Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
 112                         elseif isOK == 0xFFFFFFFD then
 113                                 return nil, "Card is not vulnerable to Darkside attack (its random number generator is not predictable). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
 114                         elseif isOK == 0xFFFFFFFC then
 115                                 return nil, "The card's random number generator behaves somewhat weird (Mifare clone?). You can try 'script run mfkeys' or 'hf mf chk' to test various known keys."
 116                         elseif isOK ~= 1 then
 117                                 return nil, "Error occurred"
 118                         end
 119
 120
 121                         -- The data-part is left
 122                         -- Starts 32 bytes in, at byte 33
 123                         local data = result:sub(33)
 124
 125                         -- A little helper
 126                         local get = function(num)
 127                                 local x = data:sub(1,num)
 128                                 data = data:sub(num+1)
 129                                 return x
 130                         end
 131
 132                         local uid,nt,pl = get(4),get(4),get(8)
 133                         local ks,nr = get(8),get(4)
 134
 135                         local status, key = core.nonce2key(uid, nt, nr, pl, ks)
 136                         if not status then return status,key end
 137
 138                         if status > 0 then
 139                                 print("Key not found (lfsr_common_prefix problem)")
 140                                 -- try again
 141                                 return nil,nil
 142                         else
 143                                 return key
 144                         end
 145                 end
 146         end
 147         return nil, "Aborted by user"
 148 end
 149
 150 function nested(key,sak)
 151         local typ = 1
 152         if 0x18 == sak then --NXP MIFARE Classic 4k | Plus 4k
 153                 typ = 4
 154         elseif 0x08 == sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
 155                 typ= 1
 156         elseif 0x09 == sak then -- NXP MIFARE Mini 0.3k
 157                 typ = 0
 158         elseif  0x10 == sak then-- "NXP MIFARE Plus 2k"
 159                 typ = 2
 160         elseif  0x01 == sak then-- "NXP MIFARE TNP3xxx 1K"
 161                 typ = 1
 162         else
 163                 print("I don't know how many sectors there are on this type of card, defaulting to 16")
 164         end
 165         local cmd = string.format("hf mf nested %d 0 A %s d",typ,key)
 166         core.console(cmd)
 167 end
 168
 169 function dump(uid)
 170         core.console("hf mf dump")
 171         -- Save the global args, those are *our* arguments
 172         local myargs = args
 173         -- Set the arguments for htmldump script
 174         args =("-o %s.html"):format(uid)
 175         -- call it
 176         require('../scripts/htmldump')
 177
 178         args =""
 179         -- dump to emulator
 180         require('../scripts/dumptoemul')
 181         -- Set back args. Not that it's used, just for the karma...
 182         args = myargs
 183 end
 184
 185 ---
 186 -- The main entry point
 187 function main(args)
 188
 189         local verbose, exit,res,uid,err,_,sak
 190         local seen_uids = {}
 191         local print_message = true
 192         -- Read the parameters
 193         for o, a in getopt.getopt(args, 'hd') do
 194                 if o == "h" then help() return end
 195                 if o == "d" then DEBUG = true end
 196         end
 197
 198         while not exit do
 199                 if print_message then
 200                         print("Waiting for card or press any key to stop")
 201                         print_message = false
 202                 end
 203                 res, err = wait_for_mifare()
 204                 if err then return oops(err) end
 205                 -- Seen already?
 206                 uid = res.uid
 207                 sak = res.sak
 208                 if not seen_uids[uid] then
 209                         -- Store it
 210                         seen_uids[uid] = uid
 211                         print("Card found, commencing crack on UID", uid)
 212                         -- Crack it
 213                         local key, cnt
 214                         res,err = mfcrack()
 215                         if not res then return oops(err) end
 216                         -- The key is actually 8 bytes, so a
 217                         -- 6-byte key is sent as 00XXXXXX
 218                         -- This means we unpack it as first
 219                         -- two bytes, then six bytes actual key data
 220                         -- We can discard first and second return values
 221                         _,_,key = bin.unpack("H2H6",res)
 222                         print("Found valid key: "..key);
 223
 224                         -- Use nested attack
 225                         nested(key,sak)
 226                         -- Dump info
 227                         dump(uid)
 228                         print_message = true
 229                 end
 230         end
 231 end
 232
 233 -- Call the main
 234 main(args)