Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

Pages: 1

#1 2022-02-28 23:02:46

smiig
Contributor
Registered: 2022-02-28
Posts: 3

Hardnested attack fails

Hello, I'm new to the forum and everything related to RFID cards. But I consider myself above average with tech things and I can read and use google, so I got this far.

My objective is to clone my work id tag to magic 1k card (and later to a implant).

Computer I'm using is MacBook pro, Monterey 12.2.1
I bought a Proxmark 3 easy from KSEC: https://cyborg.ksecsolutions.com/product/proxmark3-easy-iceman-rrg/

I followed this guide to start using the device: https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md
I had some issues, because computer didn't communicate with the device, but then I realised I had to install using command "install --with-generic proxmark3" and got into client.

Now I started trying to clone the card using various guides from Internet. I found out that I have a hardened tag and have to use hardnested command. However, it fails after some time and goes to some sort of loop until it stops after it can't communicate with Proxmark3.

Here is some info of what I got out of the card:

[ CLIENT ]
  RRG/Iceman/master/v4.14831 2022-01-11 19:17:19
  compiled with............. Clang/LLVM Apple LLVM 13.0.0 (clang-1300.0.29.30)
  platform.................. OSX / aarch64
  Readline support.......... present
  QT GUI support............ present
  native BT support......... absent
  Python script support..... absent
  Lua SWIG support.......... present
  Python SWIG support....... absent

 [ PROXMARK3 ]
  firmware.................. PM3 GENERIC

 [ ARM ]
  bootrom: RRG/Iceman/master/v4.14831 2022-01-11 19:17:19
       os: RRG/Iceman/master/v4.14831 2022-01-11 19:17:19
  compiled with GCC 10.2.1 20201103 (release)

 [ FPGA ] 
  LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
  HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
  HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev B
  --= Embedded Processor: ARM7TDMI
  --= Internal SRAM size: 64K bytes
  --= Architecture identifier: AT91SAM7Sxx Series
  --= Embedded flash memory 512K bytes ( 53% used )

[usb] pm3 --> hf search
[!] ⚠️  No known/supported 13.56 MHz tags found //This is due my tag was poorly placed under the antenna
[usb] pm3 --> hf search
 ?  Searching for ISO14443-A tag...          
[+]  UID: ** ** ** ** // I got the UID of course out of the tag
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard
[=] 
[=] --- Tag Signature
[=]  IC signature public key name: NXP Mifare Classic MFC1C14_x
[=] IC signature public key value: 044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF
[=]     Elliptic curve parameters: NID_secp128r1
[=]              TAG IC Signature: 51FFB28E2BE0BCD7BBD43188451E1F5CF53C87180A1FCF0D59D04B542F909C9C
[+]        Signature verification: successful
[?] Hint: try `hf mf` commands


[+] Valid ISO 14443-A tag found

Then I tried autopwn

[usb] pm3 --> hf mf autopwn
[!] ⚠️  no known key was supplied, key recovery might fail
[+] loaded 42 keys from hardcoded default array
[=] running strategy 1
[=] Chunk 0,8s | found 30/32 keys (42)
[=] running strategy 2
[=] Chunk 0,8s | found 30/32 keys (42)
[+] target sector   0 key type A -- found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector   0 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  12 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  12 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  13 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  13 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  14 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  14 key type B -- found valid key [ FFFFFFFFFFFF ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time 
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 10 threads and no SIMD core                 |                 |
[=]        0 |       0 | Brute force benchmark: 70 million (2^26,1) keys/s       | 140737488355328 |   23d
[=]       11 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |   23d
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]       18 |     111 | Apply bit flip properties                               |     98935341056 | 23min
[=]       19 |     223 | Apply bit flip properties                               |     11551013888 |  3min
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]       20 |     334 | Apply bit flip properties                               |      8017751552 |  2min
[#] AcquireEncryptedNonces: Auth1 error
[=]       21 |     445 | Apply bit flip properties                               |      6910669312 |  2min
[#] AcquireEncryptedNonces: Auth1 error
[=]       22 |     556 | Apply bit flip properties                               |      4382818304 |   62s
[#] AcquireEncryptedNonces: Can't select card (UID)
[#] AcquireEncryptedNonces: Auth1 error
[=]       23 |     665 | Apply bit flip properties                               |      4054659584 |   58s
[#] AcquireEncryptedNonces: Can't select card (UID)
[#] AcquireEncryptedNonces: Auth1 error
[=]       24 |     777 | Apply bit flip properties                               |      3769234176 |   54s
[=]       25 |     887 | Apply bit flip properties                               |      3677658112 |   52s
[#] AcquireEncryptedNonces: Auth1 error
[=]       25 |     999 | Apply bit flip properties                               |      3677658112 |   52s
[=]       26 |    1111 | Apply bit flip properties                               |      3677658112 |   52s
[=]       27 |    1221 | Apply bit flip properties                               |      3677658112 |   52s
[=]       27 |    1331 | Apply bit flip properties                               |      3677658112 |   52s
[-] ⛔ No match for the First_Byte_Sum (131), is the card a genuine MFC Ev1?

Then I tried to adjust the position of the tag with same results until one attempt made some progress.

 pm3 --> hf mf autopwn
[!] ⚠️  no known key was supplied, key recovery might fail
[+] loaded 42 keys from hardcoded default array
[=] running strategy 1
[=] Chunk 0,8s | found 30/32 keys (42)
[=] running strategy 2
[=] Chunk 0,8s | found 30/32 keys (42)
[+] target sector   0 key type A -- found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector   0 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  12 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  12 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  13 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  13 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  14 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  14 key type B -- found valid key [ FFFFFFFFFFFF ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time 
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 10 threads and no SIMD core                 |                 |
[=]        0 |       0 | Brute force benchmark: 994 million (2^29,9) keys/s      | 140737488355328 |    2d
[=]        2 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    2d
[=]        4 |     112 | Apply bit flip properties                               |     16693114880 |   17s
[=]        5 |     224 | Apply bit flip properties                               |      5809804800 |    6s
[=]        6 |     335 | Apply bit flip properties                               |      3771770368 |    4s
[=]        7 |     446 | Apply bit flip properties                               |      3771770368 |    4s
[=]        8 |     556 | Apply bit flip properties                               |      3677658112 |    4s
[=]        8 |     667 | Apply bit flip properties                               |      3677658112 |    4s
[=]        9 |     779 | Apply bit flip properties                               |      3677658112 |    4s
[=]       10 |     889 | Apply bit flip properties                               |      3677658112 |    4s
[=]       11 |     999 | Apply bit flip properties                               |      3677658112 |    4s
[=]       12 |    1109 | Apply Sum property. Sum(a0) = 136                       |             nan |  nand
[=]       13 |    1220 | Apply bit flip properties                               |             nan |  nand
[=]       13 |    1330 | Apply bit flip properties                               |             nan |  nand
[=]       14 |    1439 | Apply bit flip properties                               |             nan |  nand
[=]       15 |    1548 | Apply bit flip properties                               |             nan |  nand
[=]       16 |    1659 | Apply bit flip properties                               |             nan |  nand
[=]       17 |    1768 | Apply bit flip properties                               |             nan |  nand
[=]       18 |    1876 | Apply bit flip properties                               |             nan |  nand
[=]       19 |    1985 | Apply bit flip properties                               |             nan |  nand
[=]       20 |    2094 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]       20 |    2203 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       21 |    2313 | Apply bit flip properties                               |             nan |  nand
[=]       22 |    2420 | Apply bit flip properties                               |             nan |  nand
[=]       23 |    2527 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       24 |    2635 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       25 |    2744 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       26 |    2850 | Apply bit flip properties                               |             nan |  nand
[=]       26 |    2954 | Apply bit flip properties                               |             nan |  nand
[=]       27 |    3062 | Apply bit flip properties                               |             nan |  nand
[=]       28 |    3169 | Apply bit flip properties                               |             nan |  nand
[=]       29 |    3275 | Apply bit flip properties                               |             nan |  nand
[=]       30 |    3381 | Apply bit flip properties                               |             nan |  nand
[=]       31 |    3481 | Apply bit flip properties                               |             nan |  nand
[=]       32 |    3585 | Apply bit flip properties                               |             nan |  nand
[=]       32 |    3691 | Apply bit flip properties                               |             nan |  nand
[=]       33 |    3798 | Apply bit flip properties                               |             nan |  nand
[=]       34 |    3906 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       35 |    4013 | Apply bit flip properties                               |             nan |  nand
[=]       36 |    4121 | Apply bit flip properties                               |             nan |  nand
[=]       37 |    4226 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth1 error
[=]       38 |    4333 | Apply bit flip properties                               |             nan |  nand
[#] AcquireEncryptedNonces: Auth2 error len=1
[=]       38 |    4435 | Apply bit flip properties                               |             nan |  nand
[=]       39 |    4536 | Apply bit flip properties                               |             nan |  nand

The problem is that at this point it just loops "apply bit flip" etc and some times gives "AcquireEncryptedNonces: Auth1 error" or "AcquireEncryptedNonces: Auth2 error len=1". I tried to keep it running as long as it went until it stopped saying no communication with Proxmark3.

For example this guide shows that hardnested attack should only take about 20 lines (or time, is this seconds?) https://brandonhinkel.com/2018/08/08/breaking-hardened-mifare-proxmark3.html. But my thing went all the way to over 2000 lines.

Any suggestions what to try next? Have I installed something wrong or do I have to keep positioning the tag again to get better signal? Any other attacks I could try?

Last edited by smiig (2022-02-28 23:04:04)

Offline

#2 2022-03-02 23:08:06

smiig
Contributor
Registered: 2022-02-28
Posts: 3

Re: Hardnested attack fails

Some update. I tried autopwn multiple times and finally got key for sector 15 A. Now I need to get it for sector B aswell, but it seems to be tricky. Little help here?

Offline

#3 2022-03-25 09:52:47

Pebrok
Contributor
Registered: 2022-01-30
Posts: 4

Re: Hardnested attack fails

Same problem for me : endless "apply bit fit" and "nan", and after 20+ minutes, the Proxmark3 disconnects.. Very frustrating.

Offline

Pages: 1

Board footer

Powered by FluxBB