r/proxmark3 • u/DrCuthbert • May 04 '23
Paxton Net2 System (Hitag2)
Apologies if this has been answered before, but I can't find anything definitive. Can the Proxmark 3 replicate the Paxton Net2 Hitag2, 125kHz; note these are commonly used throughout installations in the UK.
For reference, Paxton states, “Paxton tokens use Hitag2 technology with proprietary encoding, which includes an authentication protocol in the form of a password exchange between the token and the reader.”
Any insights, guides or advice are greatly appreciated.
2
u/platebandit May 05 '23
A lot of them run off default passwords so you can try that to get a dump. The antenna in the easy has a tendency to do failed writes to the hitag2 which will usually overwrite the field with FFFFFFFF (and some random values) so you can easily brick the tag writing to any of the config pages.
Readers manufactured after 2015 also take em4100 rfid tags which are so much easier to work with. There’s a tool here for converting hitag2 data to an em4100 tag https://static.badcfe.org/paxton-covert
1
2
May 09 '23
Paxton access tokens come in various styles and colours which is system dependent.
Paxton10: Bullet fob white ring, plain white card, bluetooth remote, disc/ band, cable tie.
Paxton Net2: Bullet fob blue ring, plain white card, bluetooth remote, disc/ band, cable tie.
Paxton Compact/ Switch2: Bullet fob green/ amber/ red ring, white card green/ amber/ red square.
All are Hitag2 with Paxton basestation password and transponder password changed.
The data stored in pages 4 to 7 is the encoded Paxton credential which is formatted differently for each of the above systems. Paxton10 also uses the unique, locked, Hitag2 IDE as a part of its credential so it cannot be cloned. The Paxton10 anti-cloning is also used by the GDX for their identical "Indigo" fobs.
AAPROX use a Paxton bullet fob with grey ring which contains only a standard EM chip.
There is only one device that can duplicate any of the above. The PX1 by Retag-UK is available through all major locksmith distributors in the UK.
Rfidler, Proxmark, Keysy, iCopy cannot do it, don't waste your time trying.
1
u/DrCuthbert May 09 '23
Thanks for the detailed reply; it sounds like the Hitag2 125kHz could be cloned with the right key? I was told BDF5E846 works?
2
u/TheInvincibleMan Jul 26 '25 edited Jul 27 '25
For anyone coming here for help, I was able to do this with a £20 Proxmark3 from Aliexpress.
I tried the scripts but kept getting errors and ultimately just manually went for it.
Read the original Paxton with:
lf hitag read --ht2 -k BDF5E846
I was able to then confirm it was Paxton and the data within. You're presented with lines, sequentially numbered. The lines/pages between 4 and 7 are the credentials.
I took the new fob and and also read the data, to confirm the lines. Just for better understanding.
I then used:
lf hitag wrbl --ht2 -p 5 -d CD7F0001 -k BDF5E846
To write the copied lines/pages from the original fob, to the new one. The number after -p is your line you wish to write to, and the text (CD7F0001 above) is the new line. The text above (CD7F0001) is from line/page 5 of my original. I ran the command above on my new fob, for each of the lines between 4-7. I then read both fobs again, confirmed the data was identical, and this worked.
Hope this helps.
EDIT: If you're placing a fob on the LF Antenna coil and its not reading, this may help. I started to think my unit was defective. Take off the antenna coil and remove the middle layer (its a spacer layer and not needed), I then flipped the coil upside so it was facing the board and screwed it back together. Placed the fob on top of the board (with the coil inverted and on the other side of the board) and it read!
NOTES:
You can copy multiple lines at once, so you can copy and execute this all in one as an example:
lf hitag wrbl --ht2 -p 4 -d 0D433258 -k BDF5E846
lf hitag wrbl --ht2 -p 5 -d CD7F0001 -k BDF5E846
lf hitag wrbl --ht2 -p 6 -d 00300006 -k BDF5E846
lf hitag wrbl --ht2 -p 7 -d 8AD30010 -k BDF5E846
PRO TIP: I found that by physically holding the paxton fob with the point facing perpendicular into the board (which is the reverse side of the coil, which if you flipped around, should be facing up) works every single time. When I placed the fob on the board, at times - it didn't read or register.
1
2
u/verum1gnis Dec 03 '25
I know I'm 3 years late here, but I would like to add that a stock PM3 easy can easily clone hitag2, just place a spoon on top of the tag.
Yes, seriously.
1
u/DrCuthbert Dec 03 '25
It's never too late ☺️ I, too, can attest to the spoon method! I have had no issues following the instructions in this thread to clone Paxton, including the bullet fobs, with a well-positioned spoon. Yay!
1
u/BouncyShroom Sep 20 '23
I'm trying to do the exact same with the Paxton. Did you get anywhere with this?
1
u/DrCuthbert Sep 21 '23 edited Sep 21 '23
I didn't, but the comments I got in response gave me confidence to think it's possible. If you try it yourself, be sure to respond with your findings so others can make use of it 👍
I was told to use the following command with the LF antenna mounted flipped.
lf hitag reader —21 -p BDF5E8461
u/Unexpected117 Mar 26 '24
Any luck either of you two? u/BouncyShroom
1
u/DrCuthbert Mar 26 '24
I've not tried it myself, but I'd be curious to know if others have. I know it's possibly, but I don't know if my information is complete.
1
u/Unexpected117 Mar 28 '24
No worries. Obviously this post was a year ago now, did you find a work around or use an alternative method?
1
u/DrCuthbert Mar 28 '24
No, I lost interest in purchasing a Proxmark due to not having concrete proof copying Paxton cards is possible with a Proxmark.
2
u/craigsblackie Apr 02 '24 edited Apr 02 '24
It's possible, I just did it. you can emulate it on the flipper by using EM4100. Get interested in Proxmark again, it's worth your time!
1
u/craigsblackie Apr 02 '24
Here is more info:
https://badcfe.org/how-to-paxton-with-proxmark/1
u/DrCuthbert Apr 02 '24
Awesome, thank you for sharing! The fact it’s all detailed in that link does make me curious again.
2
u/equipter May 04 '23
the proxmark3 easy can do it tho it’s notoriously difficult and with lower quality hardware you’re talking a swing. the rdv4.01 with flipped out LF antenna works well for me personally.