client/scripts/brutesim.lua

   1 desc = [[
   2
   3   .-----------------------------------------------------------------.
   4  /  .-.                                                         .-.  \
   5 |  /   \                    BruteSim                           /   \  |
   6 | |\_.  |     (bruteforce simulation for multiple tags)       |    /| |
   7 |\|  | /|                      by                             |\  | |/|
   8 | `---' |                 Kenzy Carey                         | `---' |
   9 |       |                                                     |       |
  10 |       |-----------------------------------------------------|       |
  11 \       |                                                     |       /
  12  \     /                                                       \     /
  13   `---'                                                         `---'
  14 ]]
  15 author = [[ Kenzy Carey ]]
  16 usage = [[
  17
  18 USAGE:
  19 script run brutesim -r rfid_tag -f facility_code -b base_card_number -c count -t timeout -d direction
  20 option          argument                description
  21 ------          --------                -----------
  22 -r              *see below              RFID Tag: the RFID tag to emulate
  23 -f              0-999                   Facility Code: The facility code (dfx: country id, 14a: type)
  24 -b              0-65535                 Base Card Number: base card number to start from
  25 -c              1-65536                 Count: number of cards to try
  26 -t              .0-99999, pause         Timeout: timeout between cards (use the word 'pause' to wait for user input)
  27 -d              up, down                Direction: direction to move through card numbers
  28 -h                                      Show this
  29
  30 *SUPPORTED TAGS: pyramid, awid, fdx, jablotron, noralsy, presco, visa2000, 14a, hid
  31
  32 EXAMPLE:
  33 script run brutesim -r pyramid -f 10 -b 1000 -c 10 -t 1 -d down
  34 (the above example would bruteforce pyramid tags, starting at 10:1000, ending at 10:991, and waiting 1 second between each card)
  35 ]]
  36
  37 -- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
  38 -- The idea was based on proxbrute, but i needed more options, and support for different readers.
  39 -- I dont know LUA, so I used Brian Redbeards lf_bulk_program.lua script as a starting point, sorry if its kludgy.
  40
  41 getopt = require('getopt')                                                      -- Used to get get command line arguments
  42 bit32 = require('bit32')                                                        -- Used to convert FC/CN to hex
  43
  44 local function isempty(s)                                                       -- Check if a string is empty
  45         return s == nil or s == ''
  46 end
  47
  48 local function main(args)
  49
  50         print("")                                                               -- Print a blank line to make things look cleaner
  51
  52         for o, a in getopt.getopt(args, 'r:f:b:c:t:d:h') do                     -- Populate command like arguments
  53                 if o == 'r' then rfidtag = a end
  54                 if o == 'f' then facility = a end
  55                 if o == 'b' then baseid = a end
  56                 if o == 'c' then count = a end
  57                 if o == 't' then timeout = a end
  58                 if o == 'd' then direction = a end
  59                 if o == 'h' then return print(usage) end
  60         end
  61
  62         if isempty(rfidtag) then                                                -- Check to see if -r argument was passed
  63                 print("You must supply the flag -r (rfid tag)")
  64                 print(usage)
  65                 return
  66         end
  67                                                                                 -- Check what RFID Tag we are using
  68         if rfidtag == 'pyramid' then                                            -- For eaach RFID Tag:
  69                 consolecommand = 'lf pyramid sim'                               -- Set the console command
  70                 rfidtagname = 'Farpointe/Pyramid'                               -- Set the display name
  71                 facilityrequired = 1                                            -- Set if FC is required
  72         elseif rfidtag == 'awid' then
  73                 consolecommand = 'lf awid sim'
  74                 rfidtagname = 'AWID'
  75                 facilityrequired = 1
  76         elseif rfidtag == 'fdx' then                                            -- I'm not sure why you would need to bruteforce this ¯\_(ツ)_/¯
  77                 consolecommand = 'lf fdx sim'
  78                 rfidtagname = 'FDX-B'
  79                 facilityrequired = 1
  80         elseif rfidtag == 'jablotron' then
  81                 consolecommand = 'lf jablotron sim'
  82                 rfidtagname = 'Jablotron'
  83                 facilityrequired = 0
  84         elseif rfidtag == 'noralsy' then
  85                 consolecommand = 'lf noralsy sim'
  86                 rfidtagname = 'Noralsy'
  87                 facilityrequired = 0
  88         elseif rfidtag == 'presco' then
  89                 consolecommand = 'lf presco sim d'
  90                 rfidtagname = 'Presco'
  91                 facilityrequired = 0
  92         elseif rfidtag == 'visa2000' then
  93                 consolecommand = 'lf visa2000 sim'
  94                 rfidtagname = 'Visa2000'
  95                 facilityrequired = 0
  96         elseif rfidtag == '14a' then
  97                 consolecommand = 'hf 14a sim'
  98                 if facility == "1" then rfidtagname = 'MIFARE Classic'          -- Here we use the -f option to read the 14a type instead of the facility code
  99                 elseif facility == "2" then rfidtagname = 'MIFARE Ultralight'
 100                 elseif facility == "3" then rfidtagname = 'MIFARE Desfire'
 101                 elseif facility == "4" then rfidtagname = 'ISO/IEC 14443-4'
 102                 elseif facility == "5" then rfidtagname = 'MIFARE Tnp3xxx'
 103                 else
 104                         print("Invalid 14a type (-f) supplied. Must be 1-5")
 105                         print(usage)
 106                         return
 107                 end
 108                 facilityrequired = 0                                            -- Disable the FC required check, as we used it for type instead of FC
 109         elseif rfidtag == 'hid' then
 110                 consolecommand = 'lf hid sim'
 111                 rfidtagname = 'HID'
 112                 facilityrequired = 1
 113         else                                                                    -- Display error and exit out if bad RFID tag was supplied
 114                 print("Invalid rfid tag (-r) supplied")
 115                 print(usage)
 116                 return
 117         end
 118
 119         if isempty(baseid) then                                                 -- Display error and exit out if no starting id is set
 120                 print("You must supply the flag -b (base id)")
 121                 print(usage)
 122                 return
 123         end
 124
 125         if isempty(count) then                                                  -- Display error and exit out of no count is set
 126                 print("You must supply the flag -c (count)")
 127                 print(usage)
 128                 return
 129         end
 130
 131         if facilityrequired == 1 then                                           -- If FC is required
 132                 facilitymessage = " - Facility Code: "                          -- Add FC to status message
 133                 if isempty(facility) then                                       -- If FC was left blank, display warning and set FC to 0
 134                         print("Using 0 for the facility code as -f was not supplied")
 135                         facility = 0
 136                 end
 137         else                                                                    -- If FC is not required
 138                 facility = ""                                                   -- Clear FC
 139                 facilitymessage = ""                                            -- Remove FC from status message
 140         end
 141
 142         if isempty(timeout) then                                                -- If timeout was not supplied, show warning and set timeout to 0
 143                 print("Using 0 for the timeout as -t was not supplied")
 144                 timeout = 0
 145         end
 146
 147         if isempty(direction) then                                              -- If direction was not supplied, show warning and set direction to down
 148                 print("Using down for direction as -d was not supplied")
 149                 direction = 'down'
 150         end
 151
 152         if tonumber(count) < 1 then
 153                 print("Count -c must be set to 1 or higher")
 154                 return
 155         else
 156                 count = count -1                                                -- Make our count accurate by removing 1, because math
 157         end
 158
 159         if direction == 'down' then                                             -- If counting down, set up our for loop to count down
 160                 endid = baseid - count
 161                 fordirection = -1
 162         elseif direction == 'up' then                                           -- If counting up, set our for loop to count up
 163                 endid = baseid + count
 164                 fordirection = 1
 165         else                                                                    -- If invalid direction was set, show warning and set up our for loop to count down
 166                 print("Invalid direction (-d) supplied, using down")
 167                 endid = baseid - count
 168                 fordirection = -1
 169         end
 170
 171                                                                                 -- The code below was blatantly stolen from Brian Redbeard's lf_bulk_program.lua script
 172         function toBits(num,bits)
 173                 bits = bits or math.max(1, select(2, math.frexp(num)))
 174                 local t = {}
 175                 for b = bits, 1, -1 do
 176                         t[b] = math.fmod(num, 2)
 177                         num = math.floor((num - t[b]) / 2)
 178                 end
 179                 return table.concat(t)
 180         end
 181
 182         local function evenparity(s)
 183                 local _, count = string.gsub(s, "1", "")
 184                 local p = count % 2
 185                 if (p == 0) then
 186                         return(false)
 187                 else
 188                         return(true)
 189                 end
 190         end
 191
 192         local function isempty(s)
 193                 return s == nil or s == ''
 194         end
 195
 196         local function cardHex(i,f)
 197                 fac = bit32.lshift(f,16)
 198                 id = bit32.bor(i, fac)
 199                 stream=toBits(id,26)
 200                 high = evenparity(string.sub(stream,0,12)) and 1 or 0
 201                 low = not evenparity(string.sub(stream,13)) and 1 or 0
 202                 bits = bit32.bor(bit32.lshift(id,1), low)
 203                 bits = bit32.bor(bits, bit32.lshift(high,25))
 204                 preamble = bit32.bor(0, bit32.lshift(1,5))
 205                 bits = bit32.bor(bits, bit32.lshift(1,26))
 206                 return ("%04x%08x"):format(preamble,bits)
 207         end
 208                                                                                         -- End stolen code
 209
 210
 211         print("")                                                                       -- Display status message
 212         print("BruteForcing "..rfidtagname..""..facilitymessage..""..facility.." - CardNumber Start: "..baseid.." - CardNumber End: "..endid.." - TimeOut: "..timeout)
 213         print("")
 214         for cardnum = baseid,endid,fordirection do                                      -- Loop through for each count (-c)
 215                 if rfidtag == 'hid' then cardnum = cardHex(cardnum, facility) end       -- If rfid tag is set to HID, convert card to HEX using the stolen code above
 216                 core.console(consolecommand..' '..facility..' '..cardnum)               -- Send command to proxmark
 217                 if timeout == 'pause' then                                              -- If timeout is set to pause, wait for user input
 218                         print("Press enter to continue ...")
 219                         io.read()
 220                 else                                                                    -- Otherwise sleep for timeout duration
 221                         os.execute("sleep "..timeout.."")
 222                 end
 223         end
 224         core.console('hw ping')                                                         -- Ping the proxmark to stop emulation and see if its still responding
 225
 226 end                                                                                     -- Go bye bye
 227
 228
 229 main(args)                                                                              -- Do the thing