Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
Hello everyone,
About a week back I was in a hotel with my family and managed to get four cards back home. Two of the cards are for room 418 and the other two are for room 419. Our checkout date was the 9th of August.
For fun I dumped the card's data and tried analyzing the hex data to see if I could find a pattern. Unfortunately I couldn't find such a pattern. Here is the hex data for all the cards: (I only included sector 1, since that was the only sector with data on it)
418:
UID = 23 2A 1D 27
data : 4D B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
data : 00 20 13 C1 82 00 0F F0 70 03 06 10 56 E4 59 00
data : 0A 29 9B DF 53 3B 8E 00 00 00 00 00 00 00 00 00
trailer: 00 00 00 00 00 00 FF 07 80 69 8A 19 D4 0C F2 B5
418:
UID = 01 26 1D F9
data : 4D B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
data : 00 20 13 C1 82 00 0F F0 E0 99 80 BF BA 34 2A 00
data : 1B 94 41 9B C0 0A 72 00 00 00 00 00 00 00 00 00
trailer: 00 00 00 00 00 00 FF 07 80 69 8A 19 D4 0C F2 B5
419:
UID = D5 A4 2A 2C
data : 4D B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
data : 00 20 13 C1 82 00 0F F1 28 DA 4E 4D 9D 80 EF 00
data : 55 1D 95 40 8F FD E2 00 00 00 00 00 00 00 00 00
trailer: 00 00 00 00 00 00 FF 07 80 69 8A 19 D4 0C F2 B5
419:
UID = F3 B0 29 26
data : 4D B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
data : 00 20 13 C1 82 00 0F F0 1B 22 55 AC 14 D3 DA 00
data : 17 72 4B 8F A7 28 FC 00 00 00 00 00 00 00 00 00
trailer: 00 00 00 00 00 00 FF 07 80 69 8A 19 D4 0C F2 B5
Key A/B = 8069 8A19 D40C F2B5 (block 1, rest is FFFF FFFF FFFF FFFF)
Access bits = FF 07 80 69
The cards are Mifare Classic 1K. It is possible that I overlooked something, but it is also possible that access control in the hotel was done using some sort of central server that communicates with all the readers.
Thanks in advance
- Roel
Offline
Hi Roel,
I stayed in a hotel with similar keys. I recognize the hex patterns. I also noticed the UID of the cards were not important. Copying the data to a card with a different GUI still worked. So either there is an algorithm in the door card readers, or there is a connecting to a central system, however since I was staying at a 3-star hotel, is unlikely.
So it would be hard to "crack the code", based on only a few card dumps.
Offline
when it comes to hotel systems, try log the date / time for your visit. See if you can spot that data from the card data.
Offline
Pages: 1