Link to this headingMIFARE Ultralight C

  • 3DES Authentication

Documentation

Link to this headingMIFARE Ultralight C Gen1A

  • Password Authentication

Example Key: 49454D4B41455242214E4143554F5946h

Link to this headingMIFARE Ultralight C DirectWrite

Link to this headingMIFARE Ultralight C Magic

Change UID Card:

[usb] pm3 --> hf mfu setuid --uid 01020304050607 [=] Please ignore possible transient BCC warnings [usb] pm3 --> hf mfu info [=] --- Tag Information -------------------------- [+] TYPE: MIFARE Ultralight C (MF0ULC) ( magic ) [+] UID: 01 02 03 04 05 06 07 [+] UID[0]: 01, Motorola UK [+] BCC0: 88 ( ok ) [+] BCC1: 00 ( ok ) [+] Internal: 00 ( not default ) [+] Lock: 00 00 - 0000000000000000 [+] OneTimePad: FF FF FF FF - 11111111111111111111111111111111 --- UL-C Configuration Higher Lockbits [40/0x28]: 00 00 00 00 - 0000000000000000 Counter [41/0x29]: 00 00 00 00 - 0000000000000000 Auth0 [42/0x2A]: 00 00 00 00 default Auth1 [43/0x2B]: FF FF FF FF write access restricted [=] ------------------------ Fingerprint ----------------------- [=] Reading tag memory... [=] ------------------------------------------------------------ [#] Warning: HF field is off [#] Warning: HF field is off [!!] Error: tag didn't answer to READ magic

Link to this headingMIFARE Ultralight Nano

  • ISO/IEC 14443A & NFC Forum Type 2 Tag
  • 40 byte user memory
  • ECC-supported NXP originality signature
  • Usage
    • Single use

Documentation

Link to this headingProxmark Commands

Read a Ultralight Nano:

[usb] pm3 --> hf mfu info [=] --- Tag Information -------------------------- [+] TYPE: MIFARE Ultralight Nano 40bytes (MF0UNH00) [+] UID: 04 89 FC 6A F6 59 80 [+] UID[0]: 04, NXP Semiconductors Germany [+] BCC0: F9 ( ok ) [+] BCC1: 45 ( ok ) [+] Internal: 48 ( default ) [+] Lock: 00 C0 - 0000000011000000 [+] OneTimePad: 00 00 00 00 - 00000000000000000000000000000000 [=] --- Tag Silicon Information [=] Wafer Counter: 17514189 ( 0x10B3ECD ) [=] Wafer Coordinates: x 137, y 252 (0x89, 0xFC) [=] Test Site: 2 [=] --- Tag Version [=] Raw bytes: 00 04 03 01 02 00 0B 03 [=] Vendor ID: 04, NXP Semiconductors Germany [=] Product type: Ultralight [=] Product subtype: 01, 17 pF [=] Major version: 02 [=] Minor version: 00 [=] Size: 0B, (64 <-> 32 bytes) [=] Protocol type: 03, ISO14443-3 Compliant [=] --- Tag Configuration [=] cfg0 [7/0x07]: 00 00 00 00 [=] - strong modulation mode disabled [=] - page 0 and above need authentication [=] cfg1 [8/0x08]: 00 00 00 00 [=] - Unlimited password attempts [=] - NFC counter disabled [=] - NFC counter not protected [=] - user configuration writeable [=] - write access is protected with password [=] - 00, Virtual Card Type Identifier is not default [=] PWD [9/0x09]: 00 00 00 00 - (cannot be read) [=] PACK [10/0x0A]: 00 00 - (cannot be read) [=] RFU [10/0x0A]: 00 00 - (cannot be read) [+] --- Known EV1/NTAG passwords [!] password not known [?] Hint: try `hf mfu pwdgen -r` to get see known pwd gen algo suggestions [=] ------------------------ Fingerprint ----------------------- [=] Reading tag memory... [=] ------------------------------------------------------------

Link to this headingUltralite C

Try to Bruteforce:

[usb] pm3 --> hf mfu info [=] --- Tag Information -------------------------- [+] TYPE: MIFARE Ultralight C (MF0ULC) [+] UID: 04 BA B3 94 1F 15 89 [+] UID[0]: 04, NXP Semiconductors Germany [+] BCC0: 85 ( ok ) [+] BCC1: 17 ( ok ) [+] Internal: 48 ( default ) [+] Lock: 00 00 - 0000000000000000 [+] OTP: 00 00 00 00 - 00000000000000000000000000000000 [=] --- Tag Silicon Information [=] Wafer Counter: 16950258 ( 0x102A3F2 ) [=] Wafer Coordinates: x 442, y 691 (0x1BA, 0x2B3) [=] Test Site: 4 [=] [=] --- Fingerprint [+] GT23SC4489 [=] [+] --- Known UL-C 3DES keys [=] n/a [usb] pm3 --> hf mfu cchk -f /home/generalzero/Downloads/proxmark3/client/dictionaries/mfulc_default_keys.dic [+] Loaded 7 keys from dictionary file `/home/generalzero/Downloads/proxmark3/client/dictionaries/mfulc_default_keys.dic` 🕑 Testing 0/ 7 ( 0.0 % ) [=] Time spent 0.1s [=] Authentication attempts: 7 [=] Speed: 111.1 auths/s