Newbie and HID Corporate 1000

Tairros · April 3, 2023, 7:26pm

Hey everyone!
I have been searching the forums for information on this and while I have found similar information, nothing that is exact to mine except one, but that one never got any replies.

I’m trying to clone my work badge that comes up as a HID corporate 1000 card.

I am brand new here and this is my first time using the proxmark and trying to clone anything.

Any guidance would be appreciated.

Currently I have an xEM and an xNT. Not implanted yet as I am debating buying a NExT instead.
Yes I know about the flexClass Implant as well and will get that if it ends up being necessary of course.

Here is the info I have so far:

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 575) Raw: 80000000802002000000000024000808800200080300000000000300

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset
[usb] pm3 → hf search
[|] Searching for iCLASS / PicoPass tag…
[+] iCLASS / Picopass CSN: B8 D4 F2 12 FF FF 12 E0

[+] Valid iCLASS tag / PicoPass tag found

[usb] pm3 → hf iclass dump --ki 0
[+] Using AA1 (debit) key[0] AE A6 84 A6 DA B2 32 78
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 31 (0x1F)
.

[=] --------------------------- Tag memory ----------------------------

[+] saving dump file - 19 blocks read
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-3.bin
[+] saved 152 bytes to binary file hf-iclass-B8D4F212FFFF12E0-dump-3.bin
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-3.eml
[+] saved 19 blocks to text file hf-iclass-B8D4F212FFFF12E0-dump-3.eml
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-3.json
[+] saved to json file hf-iclass-B8D4F212FFFF12E0-dump-3.json
[?] Try hf iclass decrypt -f to decrypt dump file
[?] Try hf iclass view -f to view dump file

[usb] pm3 → hf iclass decrypt -f hf-iclass-B8D4F212FFFF12E0-dump
[+] loaded 152 bytes from binary file hf-iclass-B8D4F212FFFF12E0-dump
[+] loaded 16 bytes from binary file iclass_decryptionkey.bin
[!] Actual file len 152 vs HID app-limit len 144
[=] Setting limit to 144
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.bin
[+] saved 152 bytes to binary file hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.bin
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.eml
[+] saved 19 blocks to text file hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.eml
[=] FILE PATH: hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.json
[+] saved to json file hf-iclass-B8D4F212FFFF12E0-dump-decrypted-2.json

[=] --------------------------- Tag memory ----------------------------

[=] Block 7 decoder
[+] Binary… 111001001001010001101001000001111010
[=] Wiegand decode
hid preamble detected
[+] [C1k35s ] HID Corporate 1000 35-bit std FC: 586 CN: 215101 parity ( ok )
[=] found 1 matching format
[=] -----------------------------------------------------------------
[usb] pm3 → hf iclass view -f hf-iclass-B8D4F212FFFF12E0-dump
[+] loaded 152 bytes from binary file hf-iclass-B8D4F212FFFF12E0-dump

[=] --------------------------- card ---------------------------
[+] CSN: B8 D4 F2 12 FF FF 12 E0 uid
[+] Config: 12 FF FF FF E9 1F FF 3C Card configuration
[+] E-purse: FF FF FF FF B9 F9 FF FF Card challenge, CC
[+] Kd: 68 01 1A B7 EF 33 9C F8 debit key
[+] Kc: FF FF FF FF FF FF FF FF credit key ( hidden )
[+] AIA: FF FF FF FF FF FF FF FF Application Issuer area
[=] -------------------- card configuration --------------------
[=] Raw: 12 FF FF FF E9 1F FF 3C
[=] 12… app limit
[=] FFFF ( 65535 )… OTP
[=] FF… block write lock
[=] E9… chip
[=] 1F… mem
[=] FF… EAS
[=] 3C fuses
[=] Fuses:
[+] mode… Application (locked)
[+] coding… ISO 14443-2 B / 15693
[+] crypt… Secured page, keys not locked
[=] RA… Read access not enabled
[=] PROD0/1… Default production fuses
[=] -------------------------- Memory --------------------------
[=] 16 KBits/16 App Areas ( 2048 bytes )
[=] 1 books / 8 pages
[=] First book / first page configuration
[=] Config | 0 - 5 ( 0x00 - 0x05 ) - 6 blocks
[=] AA1 | 6 - 18 ( 0x06 - 0x12 ) - 13 blocks
[=] AA2 | 19 - 31 ( 0x13 - 0x1F ) - 18 blocks
[=] ------------------------- KeyAccess ------------------------
[=] * Kd, Debit key, AA1 Kc, Credit key, AA2 *
[=] Read AA1… debit
[=] Write AA1… debit
[=] Read AA2… credit
[=] Write AA2… credit
[=] Debit… debit or credit
[=] Credit… credit

[=] --------------------------- Tag memory ----------------------------

[=] No credential found

Pilgrimsmaster · April 4, 2023, 1:17am

You wont be able to clone it to xNT or NExT, But can you ask about enrolling?

The system may not recognise them, But if it is purely UID based, you maybe able to enroll them.

I would suggest you get yourself an NTAG216 Test card, and see if it is possible

philidelphiaChickens · April 4, 2023, 3:22pm

Ohhhhh boy. Those theoretically are compatible with flexClass, but likely impossible actually to copy current credentials over. I’d go the route @Pilgrimsmaster suggested and try enrolling first.

Tairros · April 4, 2023, 8:05pm

@Pilgrimsmaster I appreciate the thought. I honestly didn’t really think about just asking to enroll.
They will probably deny me, just knowing the company, but worth a shot!
Unfortunately I can’t really look into that until after the 24th since I’m currently on medical leave.

I will look into that NTAG216 test card!

@philidelphiaChickens Good to know for at least thinking about. I think I will go ahead and ask about enrolling and then take it from there depending on how that goes.

Pilgrimsmaster · April 5, 2023, 1:27am

THIS is often the case regarding how you play your cards.
Do you ask them and have them deny you, and make them aware
OR
Try everything in your means to fly below the Radar.

Good Luck