Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2023-07-31 05:28:16

jamesmac10
Contributor
Registered: 2023-05-20
Posts: 4

Ultralight C fare card dump and key

Interesting ultralight c fare card dump - feel free to delete!
[=] --- Tag Information --------------------------
[+]       TYPE: MIFARE Ultralight C (MF0ULC)
[+]        UID: 04 03 C5 CA 4D 61 81
[+]     UID[0]: 04, NXP Semiconductors Germany
[+]       BCC0: 4A ( ok )
[+]       BCC1: 67 ( ok )
[+]   Internal: 48 ( default )
[+]       Lock: 80 01  - 1000000000000001
[+] OneTimePad: 00 00 00 00  - 00000000000000000000000000000000

--- UL-C Configuration
Higher Lockbits [40/0x28]: 00 00 00 00  - 0000000000000000
         Counter [41/0x29]: 00 00 00 00  - 0000000000000000
           Auth0 [42/0x2A]: 30 00 00 00  page 48/0x30 and above need authentication
           Auth1 [43/0x2B]: 00 00 00 00  read and write access restricted
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------
[=] Trying some default 3des keys
[#] Cmd Error: 00
[#] Authentication failed
[#] Cmd Error: 00
[#] Authentication failed
[#] Cmd Error: 00
[#] Authentication failed
[+] Found default 3des key:
[=]     deskey1 [44/0x2C]: 42 52 45 41  [BREA]
[=]     deskey1 [45/0x2D]: 4B 4D 45 49  [KMEI]
[=]     deskey2 [46/0x2E]: 46 59 4F 55  [FYOU]
[=]     deskey2 [47/0x2F]: 43 41 4E 21  [CAN!]
[=] 3des key: 49454D4B41455242214E4143554F5946
[+] TYPE: MIFARE Ultralight C (MF0ULC)
[+] Reading tag memory...
[#] Cmd Error: 00
[#] Read block 44 error

[=] MFU dump file information
[=] -------------------------------------------------------------
[=] Version..... 00 00 00 00 00 00 00 00
[=] TBD 0....... 00 00
[=] TBD 1....... 00
[=] Signature... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=]              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] Counter 0... 00 00 00
[=] Tearing 0... 00
[=] Counter 1... 00 00 00
[=] Tearing 1... 00
[=] Counter 2... 00 00 00
[=] Tearing 2... 00
[=] Max data page... 42 ( 172 bytes )
[=] Header size..... 56 bytes

[=] -------------------------------------------------------------
[=] block#   | data        |lck| ascii
[=] ---------+-------------+---+------
[=] DYNAMIC LOCK: 00 00 00
[=]   0/0x00 | 04 03 C5 4A |   | ...J
[=]   1/0x01 | CA 4D 61 81 |   | .Ma.
[=]   2/0x02 | 67 48 80 01 |   | gH..
[=]   3/0x03 | 00 00 00 00 | 0 | ....
[=]   4/0x04 | 02 00 00 10 | 0 | ....
[=]   5/0x05 | 00 06 01 10 | 0 | ....
[=]   6/0x06 | 11 FF 00 00 | 0 | ....
[=]   7/0x07 | 63 69 84 11 | 1 | ci..
[=]   8/0x08 | 33 16 66 28 | 1 | 3.f(
[=]   9/0x09 | 00 00 00 00 | 0 | ....
[=]  10/0x0A | 00 00 00 00 | 0 | ....
[=]  11/0x0B | 00 00 00 00 | 0 | ....
[=]  12/0x0C | 00 00 00 00 | 0 | ....
[=]  13/0x0D | 00 00 00 00 | 0 | ....
[=]  14/0x0E | 00 00 00 00 | 0 | ....
[=]  15/0x0F | 00 00 00 00 | 0 | ....
[=]  16/0x10 | 00 00 00 00 | 0 | ....
[=]  17/0x11 | 00 00 00 00 | 0 | ....
[=]  18/0x12 | 00 00 00 00 | 0 | ....
[=]  19/0x13 | 00 00 00 00 | 0 | ....
[=]  20/0x14 | 00 00 00 00 | 0 | ....
[=]  21/0x15 | 00 00 00 00 | 0 | ....
[=]  22/0x16 | 00 00 00 00 | 0 | ....
[=]  23/0x17 | 00 00 00 00 | 0 | ....
[=]  24/0x18 | 00 00 00 00 | 0 | ....
[=]  25/0x19 | 00 00 00 00 | 0 | ....
[=]  26/0x1A | 00 00 00 00 | 0 | ....
[=]  27/0x1B | 00 00 00 00 | 0 | ....
[=]  28/0x1C | 00 00 00 00 | 0 | ....
[=]  29/0x1D | 00 00 00 00 | 0 | ....
[=]  30/0x1E | 00 00 00 00 | 0 | ....
[=]  31/0x1F | 00 00 00 00 | 0 | ....
[=]  32/0x20 | 00 00 00 00 | 0 | ....
[=]  33/0x21 | 00 00 00 00 | 0 | ....
[=]  34/0x22 | 00 00 00 00 | 0 | ....
[=]  35/0x23 | 00 00 00 00 | 0 | ....
[=]  36/0x24 | 00 00 00 00 | 0 | ....
[=]  37/0x25 | 00 00 00 00 | 0 | ....
[=]  38/0x26 | 00 00 00 00 | 0 | ....
[=]  39/0x27 | 00 00 00 00 | 0 | ....
[=]  40/0x28 | 00 00 00 00 | 0 | ....
[=]  41/0x29 | 00 00 00 00 | 0 | ....
[=]  42/0x2A | 30 00 00 00 | 0 | 0...
[=]  43/0x2B | 00 00 00 00 | 0 | ....
[=] ---------------------------------

Last edited by jamesmac10 (2023-08-06 06:52:02)

Offline

Board footer

Powered by FluxBB