mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-02-21 14:47:23 +08:00
revamp a bit ht2 readmes & makefiles
This commit is contained in:
Philippe Teuwen
parent
00bd76e99d
commit
837a53a75b
7 changed files with 117 additions and 123 deletions
|
|
@ -19,11 +19,11 @@ Attack 1
|
|||
Attack 1 is a nonce replay and length extension attack. This is an attack on
|
||||
a single HiTag2 RFID tag, given a single encrypted nonce and challenge
|
||||
response value pair (nR, aR) for the tag's UID. The attack runs entirely on
|
||||
the RFIDler with it acting like a RWD that replays the same encrypted nonce
|
||||
the Proxmark3 with it acting like a RWD that replays the same encrypted nonce
|
||||
and challenge response pair for every interaction; this fixes the key stream
|
||||
that the tag's PRNG outputs to the same stream for every interaction.
|
||||
|
||||
By brute forcing a subset of the encrypted command space, the RFIDler finds a
|
||||
By brute forcing a subset of the encrypted command space, the Proxmark3 finds a
|
||||
single valid encrypted command - invalid commands return a known unencrypted
|
||||
error response so finding a valid one is simply a case of trying different
|
||||
values until a response other than the error response is received.
|
||||
|
|
@ -31,7 +31,7 @@ values until a response other than the error response is received.
|
|||
It then bit flips the valid encrypted command to find the other 15 valid
|
||||
encrypted commands. By knowing the contents of page 0 - it's the UID that
|
||||
is presented in clear at the start of each interaction - it tries each
|
||||
encrypyted response in turn, assuming each to be the encrypted version of
|
||||
encrypted response in turn, assuming each to be the encrypted version of
|
||||
'read page 0 non-inverted' and each response to be the encrypted version of
|
||||
page 0.
|
||||
|
||||
|
|
@ -43,7 +43,7 @@ key stream = command ++ response XOR encrypted command ++ encrypted response
|
|||
|
||||
It then tests the potentially recovered key stream by creating an encrypted
|
||||
command that consumes as much of it as possible, re-initialising with the same
|
||||
encrypyted nonce and challenge response pair (to set the key stream to the
|
||||
encrypted nonce and challenge response pair (to set the key stream to the
|
||||
same stream as that which produced the encrypted command response it is
|
||||
testing), and then sending this extended encrypted command. If the response
|
||||
is not the error response, then the key stream is valid and the response is
|
||||
|
|
@ -53,7 +53,7 @@ When one of the valid encrypted commands satisfies this situation, the
|
|||
recovered key stream must be the output of the PRNG for the given encrypted
|
||||
nonce and challenge response pair.
|
||||
|
||||
The RFIDler then uses this key stream to encrypt commands and decrypt the
|
||||
The Proxmark3 then uses this key stream to encrypt commands and decrypt the
|
||||
responses, and therefore requests the contents of all 8 pages. Pages 1 and 2
|
||||
contain the encryption key.
|
||||
|
||||
|
|
@ -63,11 +63,11 @@ Attack 2
|
|||
Attack 2 is a time/space trade off to recover the key for situations where the
|
||||
tag has been configured to prevent reading of pages 1 and 2. This attack uses
|
||||
a pre-computed table of 2^37 PRNG states and resultant PRNG output, sorted on
|
||||
the PRNG output. The RFIDler is used to recover 2048 bits of key stream using
|
||||
the PRNG output. The Proxmark3 is used to recover 2048 bits of key stream using
|
||||
a modification of attack 1 and this is used to search the table for matching
|
||||
PRNG output. When the output is found, it is tested for validity (by testing
|
||||
previous or following PRNG output) and then the PRNG state is rolled back to
|
||||
the initialisation state, from which the unecrypted nonce and key can be
|
||||
the initialisation state, from which the unencrypted nonce and key can be
|
||||
recovered.
|
||||
|
||||
Attack 3
|
||||
|
|
@ -89,40 +89,49 @@ encrypted nonces and the keystream they should produce. Each guess is then
|
|||
expanded by 1 bit and the process iterates, with only the best guesses taken
|
||||
forward to the next iteration.
|
||||
|
||||
Usage details
|
||||
-------------
|
||||
Usage details: Attack 1
|
||||
-----------------------
|
||||
|
||||
Attack 1 requires a valid tag and a valid encrypted nonce and challenge
|
||||
response pair. The attacker needs to obtain a valid tag and then use this to
|
||||
obtain a valid encrypted nonce and challenge response pair. This can be
|
||||
acheived by using the RFIDler 'SNIFF-PWM S' command (having previously cleared
|
||||
the nonce storage with 'SNIFF-PWM C'), placing the coil on the RWD and
|
||||
achieved by using the Proxmark3 `lf hitag sniff` command, placing the coil on the RWD and
|
||||
presenting the valid tag. The encrypted nonce and challenge response pairs
|
||||
can then be read out with the 'SNIFF-PWM L' command. These values can then
|
||||
be used to attack the tag with 'HITAG2-CRACK <nR> <aR>'.
|
||||
can then be read out. These values can then
|
||||
be used to attack the tag with `lf hitag ht2crack <nR> <aR>`.
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM C
|
||||
RFIDler: SNIFF-PWM S
|
||||
Capture encrypted nonce and challenge response pair (nR, aR).
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM L
|
||||
RFIDler: HITAG2-CRACK <nR> <aR>
|
||||
**TODO** example
|
||||
```
|
||||
pm3 --> lf hitag sniff
|
||||
pm3 --> lf hitag ht2crack <nR> <aR>
|
||||
```
|
||||
|
||||
Usage details: Attack 2
|
||||
-----------------------
|
||||
|
||||
Attack 2 requires the same resources as attack 1, plus a pre-computed table.
|
||||
The table can be generated on a disk with >1.5TB of storage, although it takes
|
||||
some time (allow a couple of days).
|
||||
some time (allow a couple of days, privilege SSD). This can be
|
||||
achieved by using the Proxmark3 `lf hitag sniff` command, placing the coil on the RWD and
|
||||
presenting the valid tag. The encrypted nonce and challenge response pairs
|
||||
can then be read out. These values can then
|
||||
be used to attack the tag with `lf hitag ht2keystream <nR> <aR>`.
|
||||
|
||||
**TODO** example
|
||||
```
|
||||
./ht2crack2buildtable
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM C
|
||||
RFIDler: SNIFF-PWM S
|
||||
Capture encrypted nonce and challenge response pair (nR, aR).
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM L
|
||||
RFIDler: UID
|
||||
RFIDler: HITAG2-KEYSTREAM <nR> <aR>
|
||||
Copy/paste the key stream to a file.
|
||||
./ht2crack2search <key stream file> <tag UID> <nR>
|
||||
pm3 --> lf hitag sniff
|
||||
pm3 --> lf hitag ht2keystream <nR> <aR>
|
||||
```
|
||||
|
||||
It creates a file `Hitag2_<UID>_<nR>_<aR>_keystream.txt`.
|
||||
|
||||
```
|
||||
./ht2crack2search Hitag2_<UID>_<nR>_<aR>_keystream.txt <UID> <nR>
|
||||
```
|
||||
|
||||
Usage details: Attack 3
|
||||
-----------------------
|
||||
|
||||
Attack 3 requires only interaction with the RWD and does not require a valid
|
||||
tag, although it does require a HiTag2 tag that the RWD will initially respond
|
||||
|
|
@ -130,77 +139,47 @@ to; e.g. you could potentially use any HiTag2 tag as long as the RWD starts
|
|||
the crypto handshake with it. It requires >=136 encrypted nonce and challenge
|
||||
response pairs for the same tag UID.
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM C
|
||||
RFIDler: SNIFF-PWM S
|
||||
Capture >=136 encrypted nonce and challenge response pairs (nR, aR).
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM L
|
||||
RFIDler: UID
|
||||
Copy/paste the encrypted nonce and challenge response pairs into a file.
|
||||
./ht2crack3 <tag UID> <nR aR file>
|
||||
**TODO** will be ht2 sim or sniff with actual tag ?
|
||||
|
||||
```
|
||||
pm3 --> lf hitag sniff l
|
||||
```
|
||||
|
||||
It creates a file `Hitag2_<UID>_<nR>_<aR>_collection.txt`.
|
||||
Stop once you got enough pairs.
|
||||
|
||||
```
|
||||
./ht2crack3 <UID> Hitag2_<UID>_<nR>_<aR>_collection.txt
|
||||
```
|
||||
|
||||
Usage details: Attack 4
|
||||
-----------------------
|
||||
|
||||
Attack 4 requires the same information as attack 3, but only 16-32 encrypted
|
||||
nonce and challenge response pairs are required.
|
||||
./ht2crack4 -u <tag UID> -n <nR aR file> [-N <number of nonces to use>]
|
||||
[-t <table size>]
|
||||
|
||||
```
|
||||
pm3 --> lf hitag sniff l
|
||||
```
|
||||
|
||||
It creates a file `Hitag2_<UID>_<nR>_<aR>_collection.txt`.
|
||||
Stop once you got enough pairs.
|
||||
|
||||
```
|
||||
./ht2crack4 -u <UID> -n Hitag2_<UID>_<nR>_<aR>_collection.txt [-N <number of nonces to use>] [-t <table size>]
|
||||
```
|
||||
|
||||
Start with -N 16 and -t 500000. If the attack fails to find the key, double
|
||||
the table size and try again, repeating if it still fails.
|
||||
|
||||
Once the key has been recovered using one of these attacks, the RFIDler can
|
||||
Usage details: Next steps
|
||||
-------------------------
|
||||
|
||||
Once the key has been recovered using one of these attacks, the Proxmark3 can
|
||||
be configured to operate as a RWD and will capture tags using that key.
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: HITAG2-READER <KEY>
|
||||
|
||||
Both the SNIFF-PWM and HITAG2-READER commands can be used as AUTORUN commands
|
||||
for when the RFIDler is powered from a USB power supply without interaction.
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM C
|
||||
RFIDler: AUTORUN SNIFF-PWM S
|
||||
RFIDler: SAVE
|
||||
Capture encrypted nonce and challenge response pairs.
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SNIFF-PWM L
|
||||
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: HITAG2-CLEARSTOREDTAGS
|
||||
RFIDler: AUTORUN HITAG2-READER <KEY> S
|
||||
RFIDler: SAVE
|
||||
Capture tags.
|
||||
RFIDler: HITAG2-COUNTSTOREDTAGS
|
||||
RFIDler: HITAG2-LISTSTOREDTAGS [START] [END]
|
||||
|
||||
|
||||
Tags can be copied with standard RFIDler commands.
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: COPY
|
||||
RFIDler: VTAG
|
||||
Replace original tag with a blank tag.
|
||||
RFIDler: CLONE <blank tag password/key - defaults to 4d494b52>
|
||||
|
||||
OR:
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SET VTAG HITAG2
|
||||
RFIDler: VWRITE 0 <page 0 contents>
|
||||
RFIDler: VWRITE 1 <page 1 contents>
|
||||
...
|
||||
RFIDler: VWRITE 7 <page 7 contents>
|
||||
RFIDler: VTAG
|
||||
Place blank tag on coil.
|
||||
RFIDler: CLONE <blank tag password/key - defaults to 4d494b52>
|
||||
|
||||
OR:
|
||||
|
||||
RFIDler: SET TAG HITAG2
|
||||
RFIDler: SET VTAG HITAG2
|
||||
RFIDler: VWRITE 0 <all 8 page contents with no spaces>
|
||||
RFIDler: VTAG
|
||||
Place blank tag on coil.
|
||||
RFIDler: CLONE <blank tag password/key - defaults to 4d494b52>
|
||||
**TODO** example
|
||||
|
||||
Tags can be copied with standard Proxmark3 commands.
|
||||
|
||||
**TODO** example
|
||||
|
|
@ -1,24 +1,22 @@
|
|||
WARN=-Wall
|
||||
INCLUDE=-I../include
|
||||
CFLAGS=-c $(WARN) $(INCLUDE)
|
||||
CFLAGS?=-Wall
|
||||
# Linux libs
|
||||
LIBS=-pthread -D_GNU_SOURCE
|
||||
# Mac libs
|
||||
# LIBS=
|
||||
|
||||
all: ht2crack2buildtable.c ht2crack2search.c ht2crack2gentest.c hitagcrypto.o utilpart.o ht2crack2utils.o
|
||||
cc $(WARN) -o ht2crack2buildtable ht2crack2buildtable.c hitagcrypto.o ht2crack2utils.o $(LIBS)
|
||||
cc $(WARN) -o ht2crack2search ht2crack2search.c hitagcrypto.o utilpart.o ht2crack2utils.o $(LIBS)
|
||||
cc $(WARN) -o ht2crack2gentest ht2crack2gentest.c hitagcrypto.o utilpart.o ht2crack2utils.o $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2crack2buildtable ht2crack2buildtable.c hitagcrypto.o ht2crack2utils.o $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2crack2search ht2crack2search.c hitagcrypto.o utilpart.o ht2crack2utils.o $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2crack2gentest ht2crack2gentest.c hitagcrypto.o utilpart.o ht2crack2utils.o $(LIBS)
|
||||
|
||||
ht2crack2utils.o: ht2crack2utils.c ht2crack2utils.h
|
||||
cc $(CFLAGS) ht2crack2utils.c
|
||||
$(CC) $(CFLAGS) -c ht2crack2utils.c
|
||||
|
||||
hitagcrypto.o: hitagcrypto.c hitagcrypto.h
|
||||
cc $(CFLAGS) hitagcrypto.c
|
||||
$(CC) $(CFLAGS) -c hitagcrypto.c
|
||||
|
||||
utilpart.o: utilpart.c util.h
|
||||
cc $(CFLAGS) utilpart.c
|
||||
$(CC) $(CFLAGS) -c utilpart.c
|
||||
|
||||
clean:
|
||||
rm -rf *.o ht2crack2buildtable ht2crack2search ht2crack2gentest
|
||||
|
|
|
|||
|
|
@ -15,15 +15,19 @@ Calculate DATAMAX = free RAM available / 65536, and then round down to a power o
|
|||
|
||||
The Makefile is configured for linux. To compile on Mac, edit it and swap the LIBS= lines.
|
||||
|
||||
```
|
||||
make clean
|
||||
make
|
||||
|
||||
```
|
||||
|
||||
Run ht2crack2buildtable
|
||||
-----------------------
|
||||
|
||||
Make sure you are in a directory on a disk with at least 1.5TB of space.
|
||||
|
||||
```
|
||||
./ht2crack2buildtable
|
||||
```
|
||||
|
||||
Wait a very long time. Maybe a few days.
|
||||
|
||||
|
|
@ -36,19 +40,28 @@ original files. It will then exit and you'll have your shiny table.
|
|||
Test with ht2crack2gentests
|
||||
---------------------------
|
||||
|
||||
```
|
||||
./ht2crack2gentests NUMBER_OF_TESTS
|
||||
```
|
||||
|
||||
to generate NUMBER_OF_TESTS test files. These will all be named
|
||||
keystream.key-KEYVALUE.uid-UIDVALUE.nR-NRVALUE
|
||||
|
||||
Test a single test with
|
||||
./runtest.sh KEYSTREAMFILE
|
||||
|
||||
```
|
||||
./runtest.sh KEYSTREAMFILE
|
||||
```
|
||||
or manually with
|
||||
|
||||
```
|
||||
./ht2crack2search KEYSTREAMFILE UIDVALUE NRVALUE
|
||||
```
|
||||
|
||||
or run all tests with
|
||||
```
|
||||
./runalltests.sh
|
||||
```
|
||||
|
||||
Feel free to edit the shell scripts to find your tools. You might want to create a
|
||||
symbolic link to your sorted/ directory called 'sorted' to help ht2crack2seach find the
|
||||
|
|
@ -63,6 +76,6 @@ Search for key in real keystream
|
|||
Recover 2048 bits of keystream from the target RFID tag with the RFIDler. You will have had
|
||||
to supply an NR value and you should know the tag's UID (you can get this using the RFIDler).
|
||||
|
||||
```
|
||||
./ht2crack2search KEYSTREAMFILE UIDVALUE NRVALUE
|
||||
|
||||
|
||||
```
|
||||
|
|
@ -1,17 +1,15 @@
|
|||
WARN=-Wall
|
||||
INCLUDE=-I../include
|
||||
CFLAGS=-c $(WARN) $(INCLUDE)
|
||||
CFLAGS?=-Wall
|
||||
LIBS=
|
||||
|
||||
all: ht2crack3.c ht2test.c hitagcrypto.o utilpart.o
|
||||
cc $(WARN) -o ht2crack3 ht2crack3.c hitagcrypto.o utilpart.o -lpthread $(LIBS)
|
||||
cc $(WARN) -o ht2test ht2test.c hitagcrypto.o utilpart.o $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2crack3 ht2crack3.c hitagcrypto.o utilpart.o -lpthread $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2test ht2test.c hitagcrypto.o utilpart.o $(LIBS)
|
||||
|
||||
hitagcrypto.o: hitagcrypto.c hitagcrypto.h
|
||||
cc $(CFLAGS) hitagcrypto.c
|
||||
$(CC) $(CFLAGS) -c hitagcrypto.c
|
||||
|
||||
utilpart.o: utilpart.c util.h
|
||||
cc $(CFLAGS) utilpart.c
|
||||
$(CC) $(CFLAGS) -c utilpart.c
|
||||
|
||||
clean:
|
||||
rm -rf *.o ht2crack3 ht2test
|
||||
|
|
|
|||
|
|
@ -5,9 +5,10 @@ ht2crack3
|
|||
Build
|
||||
-----
|
||||
|
||||
```
|
||||
make clean
|
||||
make
|
||||
|
||||
```
|
||||
|
||||
Run
|
||||
---
|
||||
|
|
@ -17,7 +18,9 @@ encrypted nonces and challenge response values. They should be in hex with
|
|||
one pair per line, e.g.:
|
||||
0x12345678 0x9abcdef0
|
||||
|
||||
```
|
||||
./ht2crack3 UID NRARFILE
|
||||
```
|
||||
|
||||
UID is the UID of the tag that you used to gather the nR aR values.
|
||||
NRARFILE is the file containing the nR aR values.
|
||||
|
|
@ -31,5 +34,6 @@ are valid (for high-powered demonstrations only, really) then you can use
|
|||
the ht2test program to check them. It's otherwise massively pointless and a
|
||||
complete waste of space.
|
||||
|
||||
```
|
||||
./ht2test NRARFILE KEY UID
|
||||
|
||||
```
|
||||
|
|
@ -1,18 +1,17 @@
|
|||
WARN=-Wall
|
||||
CFLAGS=-c $(WARN) $(INCLUDE)
|
||||
CFLAGS?=-Wall
|
||||
LIBS=-lpthread
|
||||
|
||||
all: ht2crack4.c HardwareProfile.h rfidler.h util.h utilpart.o hitagcrypto.o ht2crack2utils.o
|
||||
cc $(WARN) -o ht2crack4 ht2crack4.c utilpart.o hitagcrypto.o ht2crack2utils.o $(LIBS)
|
||||
$(CC) $(CFLAGS) -o ht2crack4 ht2crack4.c utilpart.o hitagcrypto.o ht2crack2utils.o $(LIBS)
|
||||
|
||||
utilpart.o: utilpart.c util.h
|
||||
cc $(CFLAGS) utilpart.c
|
||||
$(CC) $(CFLAGS) -c utilpart.c
|
||||
|
||||
hitagcrypto.o: hitagcrypto.c hitagcrypto.h
|
||||
cc $(CFLAGS) hitagcrypto.c
|
||||
$(CC) $(CFLAGS) -c hitagcrypto.c
|
||||
|
||||
ht2crack2utils.o: ht2crack2utils.c ht2crack2utils.h
|
||||
cc $(CFLAGS) ht2crack2utils.c
|
||||
$(CC) $(CFLAGS) -c ht2crack2utils.c
|
||||
|
||||
clean:
|
||||
rm -rf *.o ht2crack4
|
||||
|
|
|
|||
|
|
@ -5,9 +5,10 @@ ht2crack4
|
|||
Build
|
||||
-----
|
||||
|
||||
```
|
||||
make clean
|
||||
make
|
||||
|
||||
```
|
||||
|
||||
Run
|
||||
---
|
||||
|
|
@ -17,7 +18,9 @@ encrypted nonces and challenge response values. They should be in hex with
|
|||
one pair per line, e.g.:
|
||||
0x12345678 0x9abcdef0
|
||||
|
||||
```
|
||||
./ht2crack4 -u UID -n NRARFILE [-N nonces to use] [-t table size]
|
||||
```
|
||||
|
||||
UID is the UID of the tag that you used to gather the nR aR values.
|
||||
NRARFILE is the file containing the nR aR values.
|
||||
Loading…
Reference in a new issue