Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2020-08-27 02:22:26

iceman
Administrator
Registered: 2013-04-25
Posts: 6,695
Website

reading SEOS card?

A user over at the discord server sniffed his SEOS card,  as seen below,  where I extracted the commands send by the reader and make the equivelent for Proxmark3.   You can now get the same data out of your card but I have no idea what the command APDU's does.
When I say the same,  its the same until the last command.   That one gives an error on my card vs the users card.


[usb] pm3 --> hf search

[+]  UID: 0x 4x 8x 0x 
[+] ATQA: 00 01
[+]  SAK: 20 [1]
[+] Possible types:
[+]    MIFARE Plus 2K/4K / Plus EV1 2K/4K
[+]    MIFARE Plus CL2 2K/4K / Plus CL2 EV1 2K/4K
[+]  ATS: 05 78 77 80 02 9C 3A 
[+]        -  TL : length is 5 bytes
[+]        -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8 (FSC = 256)
[+]        - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]
[+]        - TB1 : SFGI = 0 (SFGT = (not needed) 0/fc), FWI = 8 (FWT = 1048576/fc)
[+]        - TC1 : NAD is NOT supported, CID is supported

[+] Valid ISO14443-A tag found

* RRG/Iceman repo based commands *

clear
hf 14a raw -s -c -p d01100
hf 14a apdu -k 00a404000aa000000440000101000100
hf 14a apdu -k 80a504001306112b0601040181e43801010201180101020200
hf 14a apdu -k 00870001047c02810000
hf 14a apdu -k 008700012c7c2a8228ba59c0ace0edc4c550f0053d4857c3ab74153cb7f1e507fcf12437acd30e7eff8bc138a26cd62ef200
hf 14a apdu -d 0ccb3fff168508dce59bd2a233b32d97008e0820f5d036ead124ee
hf 14a list

Ouputs:

[usb] pm3 --> hf 14a raw -s -c -p d01100
Card selected. UID[4]:
08 D8 E1 93
received 3 bytes
D0 73 87

[usb] pm3 --> hf 14a apdu -k 00a404000aa000000440000101000100
>>>>[keep ] 00 A4 04 00 0A A0 00 00 04 40 00 01 01 00 01 00
<<<< 6F 0C 84 0A A0 00 00 04 40 00 01 01 00 01 90 00
[+] APDU response: 90 00 - Command successfully executed (OK).

[usb] pm3 --> hf 14a apdu -k 80a504001306112b0601040181e43801010201180101020200
>>>>[keep ] 80 A5 04 00 13 06 11 2B 06 01 04 01 81 E4 38 01 01 02 01 18 01 01 02 02 00
<<<< CD 02 09 07 85 40 CD 12 99 54 6D E8 33 BD 73 2B 63 9A 63 C6 DA 14 F5 DF 9C 4E 07 F4 DB BF 4D A7 29 08 E8 A7 94 23 3A E9 94 7B 70 05 55 A2 F9 5E 8A 93 0C 47 01 B0 02 A5 08 0A B2 2E 37 60 D6 69 41 F5 23 85 CB 61 8E 08 9E BA AE 38 15 08 9E 47 90 00
[+] APDU response: 90 00 - Command successfully executed (OK).

[usb] pm3 --> hf 14a apdu -k 00870001047c02810000
>>>>[keep ] 00 87 00 01 04 7C 02 81 00 00
<<<< 7C 0A 81 08 CF 57 F4 A3 59 2C 30 BC 90 00
[+] APDU response: 90 00 - Command successfully executed (OK).

[usb] pm3 --> hf 14a apdu -k 008700012c7c2a8228ba59c0ace0edc4c550f0053d4857c3ab74153cb7f1e507fcf12437acd30e7eff8bc138a26cd62ef200
>>>>[keep ] 00 87 00 01 2C 7C 2A 82 28 BA 59 C0 AC E0 ED C4 C5 50 F0 05 3D 48 57 C3 AB 74 15 3C B7 F1 E5 07 FC F1 24 37 AC D3 0E 7E FF 8B C1 38 A2 6C D6 2E F2 00
<<<< 7C 2A 82 28 71 F8 FE 38 48 66 44 E0 E2 FB 31 55 BC 27 7D 56 D0 48 0E D0 BF A4 42 9A FE 74 04 E7 10 20 E4 23 13 A2 70 74 66 3A 1A CD 90 00
[+] APDU response: 90 00 - Command successfully executed (OK).

[usb] pm3 --> hf 14a apdu -d 0ccb3fff168508dce59bd2a233b32d97008e0820f5d036ead124ee
>>>>[] 0C CB 3F FF 16 85 08 DC E5 9B D2 A2 33 B3 2D 97 00 8E 08 20 F5 D0 36 EA D1 24 EE
[=] APDU: case=0x03 cla=0x0c ins=0xcb p1=0x3f p2=0xff Lc=0x16(22) Le=0x00(0)
<<<< 67 00
[+] APDU response: 67 00 - Wrong length
[usb] pm3 --> hf 14a list
[=] downloading tracelog data from device
[+] Recorded activity (trace len = 575 bytes)
[=] start = start of start frame end = end of frame. src = source of transfer
[=] ISO14443A - all times are in carrier periods (1/13.56MHz)

      Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
          0 |        992 | Rdr |52(7)                                                                    |     | WUPA
       2116 |       4484 | Tag |01  00                                                                   |     |
       7040 |       9504 | Rdr |93  20                                                                   |     | ANTICOLL
      10564 |      16452 | Tag |08  d8  e1  93  a2                                                       |     |
      19200 |      29664 | Rdr |93  70  08  d8  e1  93  a2  4c  78                                       |  ok | SELECT_UID
      30788 |      34372 | Tag |20  fc  70                                                               |     |
      36096 |      40864 | Rdr |e0  80  31  73                                                           |  ok | RATS
      42692 |      50820 | Tag |05  78  77  80  02  9c  3a                                               |  ok |
      63232 |      69088 | Rdr |d0  11  00  52  a6                                                       |  ok |
      70980 |      74500 | Tag |d0  73  87                                                               |     |
     390528 |     412576 | Rdr |02  00  a4  04  00  0a  a0  00  00  04  40  00  01  01  00  01  00  fe   |     |
            |            |     |6b                                                                       |  ok |
     430660 |     452676 | Tag |02  6f  0c  84  0a  a0  00  00  04  40  00  01  01  00  01  90  00  fb   |     |
            |            |     |e3                                                                       |  ok |
     766848 |     799200 | Rdr |03  80  a5  04  00  13  06  11  2b  06  01  04  01  81  e4  38  01  01   |     |
            |            |     |02  01  18  01  01  02  02  00  2a  71                                   |  ok |
     878788 |     878788 | Tag |03  cd  02  09  07  85  40  cd  12  99  54  6d  e8  33  bd  73  2b  63   |     |
            |            |     |9a  63  c6  da  14  f5  df  9c  4e  07  f4  db  bf  4d  a7  29  08  e8   |     |
            |            |     |a7  94  23  3a  e9  94  7b  70  05  55  a2  f9  5e  8a  93  0c  47  01   |     |
            |            |     |b0  02  a5  08  0a  b2  2e  37  60  d6  69  41  f5  23  85  cb  61  8e   |     |
            |            |     |08  9e  ba  ae  38  15  08  9e  47  90  00  93  22                       |  ok |
    1293440 |    1308512 | Rdr |02  00  87  00  01  04  7c  02  81  00  00  70  5c                       |  ok |
    1332420 |    1352068 | Tag |02  7c  0a  81  08  cf  57  f4  a3  59  2c  30  bc  90  00  73  d8       |  ok |
    1676160 |    1737312 | Rdr |03  00  87  00  01  2c  7c  2a  82  28  ba  59  c0  ac  e0  ed  c4  c5   |     |
            |            |     |50  f0  05  3d  48  57  c3  ab  74  15  3c  b7  f1  e5  07  fc  f1  24   |     |
            |            |     |37  ac  d3  0e  7e  ff  8b  c1  38  a2  6c  d6  2e  f2  00  2a  cc       |  ok |
    1880132 |    1936644 | Tag |03  7c  2a  82  28  71  f8  fe  38  48  66  44  e0  e2  fb  31  55  bc   |     |
            |            |     |27  7d  56  d0  48  0e  d0  bf  a4  42  9a  fe  74  04  e7  10  20  e4   |     |
            |            |     |23  13  a2  70  74  66  3a  1a  cd  90  00  06  9a                       |  ok |
    2254208 |    2288864 | Rdr |02  0c  cb  3f  ff  16  85  08  dc  e5  9b  d2  a2  33  b3  2d  97  00   |     |
            |            |     |8e  08  20  f5  d0  36  ea  d1  24  ee  1a  48                           |  ok |
    2297412 |    2303300 | Tag |02  67  00  f1  38                                                       |     |

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#2 2020-09-01 20:13:57

higbnua3rwxg
Contributor
Registered: 2019-03-07
Posts: 3

Re: reading SEOS card?

I was looking through a device the other day and found this information in the setup.

Seos Configuration

ADF OID : 2A8570811E1000070000020000

Total Tag : 08

Tag : C0

My knowledge on RFID is limited and i'm not sure how helpful (if at all )this is though.

Offline

#3 2020-09-02 05:03:05

iceman
Administrator
Registered: 2013-04-25
Posts: 6,695
Website

Re: reading SEOS card?

Which device is this?  You got a picture of it? Tried sniffing some traffic?


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#4 2020-09-02 11:06:18

higbnua3rwxg
Contributor
Registered: 2019-03-07
Posts: 3

Re: reading SEOS card?

Sorry, it is from an “Invixium TITAN” a non-HID, biometric reader with a configuration page for smart cards. I would hope they wouldn’t auto fill any sensitive information on the default seos configuration but don’t know enough about it to tell.

Offline

Board footer

Powered by FluxBB