ccob / pivert

PIVert - PIV smart card emulator

Introduction

PIVert is a NIST SP 800-73 PIV smart card emulator. You can supply PIVert with a PFX file containing a certificate and corresponding private key and the tool will emulate the card to Windows as a genuine PIV card. The card can then be used for authentication over RDP, Citrix and VMWare Horizon using the build in smart card redirection feature.

Usage

Installation

On a clean machine that hasn’t used PIVert before, the first step is to install the BixVReader virtual smart card reader driver. WARNING, this does install a self-signed trusted root certificate authority certificate since the driver is self-signed using a test certificate. The install step also sets the AllowCertificatesWithNoEKU group policy option. Without this option, only certificates with the Smartcard Logon EKU are offered for authentication. With this option enabled, certificates with the User Authentication EKU are also available for authentication.

.\PIVert.exe install
[=] AllowCertificatesWithNoEKU on SmartCard Credential Provider not set, enabling...
[+] Enabled AllowCertificatesWithNoEKU on SmartCard Credential Provider
[=] Writing BixVReader.ini config to C:\Windows
[=] Installing driver signing certificate into Root and Trusted Publishers local machine store
[=] Installing driver MSI
[+] Installer completed

Emulating a PIV Card

To emulate a PIV card using a PFX file, you simply specify the PFX file and PFX password as command line arguments.

.\PIVert.exe .\Administrator.pfx password
[=] Connected to Smartcard Data Pipe
[=] Connected to Smartcard Event Pipe
[+] Connected Virtal Smart Card Driver
[+] Virtual card inserted
[=] Press ESC to exit, or any other key to remove and reinsert the virtual card?
[=] Unsupported INS ca with CLA 0
[=] Request for PIV DataObject: CardHolderUniqieID
[=] Request for PIV DataObject: CertPIVAuth
[=] Request for PIV DataObject: CertSign
[=] Request for PIV DataObject: CertKeyMan
[=] Request for PIV DataObject: CertCardAuth
[=] Request for PIV DataObject: KeyHistory
[=] Request for PIV DataObject: CertPIVAuth
[=] Request for PIV DataObject: CertSign
[=] Request for PIV DataObject: CertCardAuth
[=] Request for PIV DataObject: CardHolderUniqieID
[=] Request for PIV DataObject: CertKeyMan
[=] Request for PIV DataObject: KeyHistory

There does appear to be a bug in the driver (or potentially my code :D) were sometimes the virtual card insertion is not detected by Windows due issues reading the ATR from the virtual card. To combat this issue you can press any key other than ESC to virtually remove and re-insert the card. You’ll know when this as happened as you won’t see the requests for DataObjects on start-up like above.

Acknowledgements

• Fabio Ottavi for BixVReader UDMF driver ([https://www.codeproject.com/Articles/134010/An-UMDF-Driver-for-a-Virtual-Smart-Card-Reader])
• Frank Morgner and the Virtual Smart Card Project ([https://github.com/frankmorgner/vsmartcard/tree/master/virtualsmartcard])
• Yibico and the Yubikey .NET SDK which some code has made it's way into PIVert ([https://github.com/Yubico/Yubico.NET.SDK])

pivert's Issues

what are log prefixes?

• [!] is for errors
• [+] for success, i guess?
• what about [=]?
• others?

Failed to connect to Virtual Smart Card, is the driver installed?

The following happens on Server 2019 (build 17763.2931).

• I have installed using PIVert.exe install
• In device manager I can see the "Bix Virtual Smart Card Reader"
• when calling PIVert.exe mypfx password I get the following error:

[!] Failed to connect to Virtual Smart Card, is the driver installed?

When installing the driver again, I get slightly different behaviour:

[=] Connected to Smartcard Event Pipe
[+] Connected Virtal Smart Card Driver
[+] Virtual card inserted
[=] Press ESC to exit, or any other key to remove and reinsert the virtual card?
[=] Unsupported INS ca with CLA 0
[=] Unsupported INS ca with CLA 0
[+] Virtual card removed
[+] Virtual card inserted```

However when I start an RDP connection it doesn't give me access to a smartcard nor is there a smart card visible in device manager (just the smart card reader)

I can see the following in the eventlog:
Could not get device ID for smart card in reader Virtual Smart Card Pipe Reader 0. The return code is 2148532239. (https://www.magnumdb.com/search?q=0x8010000F -> SCARD_E_PROTO_MISMATCH)

and 

Smart Card Reader 'Virtual Smart Card Pipe Reader 0' rejected IOCTL SET_PROTOCOL: The request is not supported.  If this error persists, your smart card or reader may not be functioning correctly.

Command Header: 03 00 00 00