5l1v3r1 / fingertec-tool

A tool for communicating with FingerTec access control devices, as well as other ZKTeco based devices

Fingerpick

This is a tool for communicating with FingerTec access control devices, as well as other ZKTeco based devices. The options are as follows:

$ ./fingerpick.py 
usage: fingerpick.py [-h]
                     {create_user,list_users,brute_force,send_command,open_sesame}
                     ...

positional arguments:
  {create_user,list_users,brute_force,send_command,open_sesame}

optional arguments:
  -h, --help            show this help message and exit

Create User

create_user will create a new user on the target device.

$ ./fingerpick.py create_user -h
usage: fingerpick.py create_user [-h] [--user_id USER_ID]
                                 [--user_name USER_NAME] [--pin PIN]
                                 [--rfid RFID] [--commkey COMMKEY]
                                 host

positional arguments:
  host                  FingerTec Device IP address

optional arguments:
  -h, --help            show this help message and exit
  --user_id USER_ID     User ID to create. Default is 1337.
  --user_name USER_NAME
                        User name - max of 8 letters.
  --pin PIN             PIN - max of 5 characters. Default 1337.
  --rfid RFID           RFID card number.
  --commkey COMMKEY     COMM Key

List Users

list_users will list out all users currently enrolled on device.

$ ./fingerpick.py list_users -h 
usage: fingerpick.py list_users [-h] [--brute_force] [--commkey COMMKEY]
                                [--start START] [--end END]
                                host

positional arguments:
  host               FingerTec Device IP address

optional arguments:
  -h, --help         show this help message and exit
  --brute_force      Brute force comm key is necessary
  --commkey COMMKEY  COMM Key
  --start START      Start comm key id
  --end END          End comm key id

Brute Force

brute_force will brute force the COMM key (password) on the device. It will try with every key value from 1 to 99999. On an AC900, this takes about 3 days to exhaust completely.

$ ./fingerpick.py brute_force -h 
usage: fingerpick.py brute_force [-h] [--brute_force] [--start START]
                                 [--end END]
                                 host

positional arguments:
  host           FingerTec Device IP address

optional arguments:
  -h, --help     show this help message and exit
  --brute_force  Brute force comm key is necessary
  --start START  Start comm key id
  --end END      End comm key id

Send Command

send_command will send an arbitrary command to a device. This should be entered as an integer, and will be converted to little endian hex.

$ ./fingerpick.py send_command -h 
usage: fingerpick.py send_command [-h] [--commkey COMMKEY] [--fuzz FUZZ]
                                  host command data

positional arguments:
  host               FingerTec Device IP address
  command            Command (integer)
  data               Additional data (args) sent

optional arguments:
  -h, --help         show this help message and exit
  --commkey COMMKEY  COMM Key

Open Sesame

open_sesame unlocks the door for a specified amount of time.

$ ./fingerpick.py open_sesame -h  
usage: fingerpick.py open_sesame [-h] [--commkey COMMKEY] host delay

positional arguments:
  host               FingerTec Device IP address
  delay              Delay (in seconds) to keep the door open

optional arguments:
  -h, --help         show this help message and exit
  --commkey COMMKEY  COMM Key