--- title: 'Cloning Mifare tags with a low budget in 2019' url: 'http://kernelpanic.cordier.work/en/blog/clone-mmifare-tag-acr122u-2019' markdown: 'http://kernelpanic.cordier.work/en/blog/clone-mmifare-tag-acr122u-2019.md' lang: en date: '2019-09-11' description: 'TL;DR it was more tedious than expected As a proud owner of an ACR122U NFC reader, I periodically try to read the content of my own cards, out of interest. This device can only work on the 13.56 MHz and is fairly limited compared to a Proxmark3, but is much cheaper, which is also an important facto…' taxonomy: category: - blog tag: - NFC - Mifare - mfcuk archives_month: - sep_2019 archives_year: - '2019' --- [ Blog ](http://kernelpanic.cordier.work/en) Cloning Mifare tags with a low budget in 2019 11 *Sep* #### [Cloning Mifare tags with a low budget in 2019](http://kernelpanic.cordier.work/en/blog/clone-mmifare-tag-acr122u-2019) [NFC](http://kernelpanic.cordier.work/en/tag:NFC) [Mifare](http://kernelpanic.cordier.work/en/tag:Mifare) [mfcuk](http://kernelpanic.cordier.work/en/tag:mfcuk) ![](http://kernelpanic.cordier.work/images/a/e/2/f/2/ae2f2ae1e6b8e31e617f32c707818ebae21552c5-badgeentree.jpg) # TL;DR it was more tedious than expected As a proud owner of an ACR122U NFC reader, I periodically try to read the content of my own cards, out of interest. This device can only work on the 13.56 MHz and is fairly limited compared to a Proxmark3, but is much cheaper, which is also an important factor to the broke penetration tester that I am. You can find one on Amazon for less than $30; however, be careful to avoid chinese conterfeit devices, as the hardware is not always correctly supported by the libnfc drivers. ## Please let me in It had been a while since the last time I used it, but I was pretty confident about my memories regarding Mifare cracking. So i fired up [mfoc](https://github.com/nfc-tools/mfoc), to try and dump the content of the targetted card using the usual default keys. Unfortunately, the card did not use any of them. ![Mfoc does not find any default keys](http://kernelpanic.cordier.work/user/pages/01.blog/clone-mmifare-tag-acr122u-2019/mfoc_no_default_keys.png) Well that's a shame, but we can deal with it. I moved on to the DarkSide attack using [mfcuk](https://github.com/nfc-tools/mfcuk). ![Mfcuk_found_erroneous_keys](http://kernelpanic.cordier.work/user/pages/01.blog/clone-mmifare-tag-acr122u-2019/2019-09-11-195609_617x367_scrot.png) So far, so good ! ## Oh boy. Well that was unexpected. Somehow, the key that had been recovered by mfcuk is faulty and cannot be used in a nested attack with mfoc (I later realized that only the last bytes of the recovered key were correct). I use archlinux with the blackarch repositories, so the installed version is 0.3.8-8, which seems broken with ACR122U, most likely because of this [issue](https://github.com/nfc-tools/mfcuk/issues/21). Unfortunately, many people seemed to have the same issue, even using newer versions of mfcuk. Loooking up the internets using the almighty search engine, I stumbled upon this [Gist](https://gist.github.com/ceres-c/b84935799f5d65a4e41328d3ceaa075c) which gives us a good match between mfcuk r65 and libnfc 1.5.1. Of couse, you can find a curated script [here](https://github.com/ArnCo/install_mfcuk.sh.git), to save you the hassle of compiling. ## Finally! Alright, let's mf\*\*k this tag. Please follow the exact instructions below, in this precise order and as **root**, or something, somehow, somewhere will go wrong. 1. Blacklist the drivers that may interfere with the reader ``` echo "blacklist nfc" > /etc/modprobe.d/blacklist-libnfc.conf echo "blacklist pn533" > /etc/modprobe.d/blacklist-libnfc.conf echo "blacklist pn533_usb" > /etc/modprobe.d/blacklist-libnfc.conf ``` 2. Launch pcscd -f to make sure that the right drivers are properly loaded 3. Plug in your NFC reader **WITHOUT ANY TAG NEARBY** and wait for it to initialize (fix red light) 4. Put the tag you want to copy on the reader (the light should turn green) 5. Use DarkSide attack to recover one key with mcuk > LD\_LIBRARY\_PATH=whereveryouputyourlibs/builds/nfc/libnfc-1.5.1/libnfc/.libs mfcuk-r65/src/mfcuk -C -R 0:A -s 250 -S 250 -v 3 6. Once your first key is recovered, use mfoc to perform a nested attack (your reader might be freezed at this point so you may want to perform steps 2 to 4 one more time) > mfoc -k yourrecoveredkey -O mifare.dmp 7. Flash your card with the dumped data (including the UID) > nfc-mfclassic W ab chinese\_card.dmp mifare.dmp 8. Open only your own door, I am not liable in case you are trying to do anything illegal ## Bonus track If your eyes do not parse your card's hex data natively, you can display it in a nearly human friendly format using the excellent [mfdread](https://github.com/zhovner/mfdread.git) which makes the memory layout crystal clear. ![Mifare_memory_layout](http://kernelpanic.cordier.work/user/pages/01.blog/clone-mmifare-tag-acr122u-2019/mem_layout.png) Need **offensive security services**, or **application security support**? [**CryptID has got you covered**](https://cryptid.fr)! [ Next Post](http://kernelpanic.cordier.work/en/blog/dvid-bluetooth-writeup) [Previous Post ](http://kernelpanic.cordier.work/en/blog/privilege-escalation-opnsense-pfsense-cve-2019) #### Search #### Random Article [ I'm Feeling Lucky!](http://kernelpanic.cordier.work/en/random) #### Some Text Widget Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna. #### Popular Tags [NFC](http://kernelpanic.cordier.work/en/tag:NFC) [Mifare](http://kernelpanic.cordier.work/en/tag:Mifare) [mfcuk](http://kernelpanic.cordier.work/en/tag:mfcuk) [DVID](http://kernelpanic.cordier.work/en/tag:DVID) [Hardware](http://kernelpanic.cordier.work/en/tag:Hardware) [Bluetooth](http://kernelpanic.cordier.work/en/tag:Bluetooth) [security](http://kernelpanic.cordier.work/en/tag:security) [CVE](http://kernelpanic.cordier.work/en/tag:CVE) [OPNsense](http://kernelpanic.cordier.work/en/tag:OPNsense) [pfSense](http://kernelpanic.cordier.work/en/tag:pfSense) [sysadmin](http://kernelpanic.cordier.work/en/tag:sysadmin) [ZFS](http://kernelpanic.cordier.work/en/tag:ZFS) [mkinitcpio](http://kernelpanic.cordier.work/en/tag:mkinitcpio) [dropbear](http://kernelpanic.cordier.work/en/tag:dropbear) #### Archives - [ 1 April 2023 ](http://kernelpanic.cordier.work/blog/archives_month:apr_2023) - [ 1 March 2023 ](http://kernelpanic.cordier.work/blog/archives_month:mar_2023) - [ 1 November 2019 ](http://kernelpanic.cordier.work/blog/archives_month:nov_2019) - [ 1 September 2019 ](http://kernelpanic.cordier.work/blog/archives_month:sep_2019) - [ 1 May 2019 ](http://kernelpanic.cordier.work/blog/archives_month:may_2019) - [ 1 August 2018 ](http://kernelpanic.cordier.work/blog/archives_month:aug_2018) #### Syndicate [ Atom 1.0](http://kernelpanic.cordier.work/en/blog.atom) [ RSS](http://kernelpanic.cordier.work/en/blog.rss) --- ## Navigation - Parent: [Blog](http://kernelpanic.cordier.work/en/index.md) - Previous: [DVID (Damn Vulnerable IoT Device) Bluetooth write up](http://kernelpanic.cordier.work/en/blog/dvid-bluetooth-writeup.md) - Next: [Privilege escalation on OPNsense / pfSense, or why code review is necessary (CVE-2019-11816)](http://kernelpanic.cordier.work/en/blog/privilege-escalation-opnsense-pfsense-cve-2019.md)