- Joined
- Dec 30, 2024
- Messages
- 420
- Reaction score
- 219
- Points
- 62
- Website
- blackhatpakistan.net
- Points
- 1,303
- USD
- 1,303
Carding ends at cash. Every BIN sheet, every non-VBV list, every fullz pack is a promise the machine has to honor, and the ATM is where that promise either pays out or exposes you. Two lanes feed the same cash: the harvest lane — skimmers, shims, overlays, PIN-pad cameras — feeds you digits, and the software lane — XFS malware, switch-message tricks, the whole FastCash/Ploutus family — talks directly to the dispenser in the machine's own protocol. This is the machine-side map of 2026: what the public forensics actually say about the malware families, what the harvest hardware looks like this year, the ISO8583 withdrawal message the switch believes, a dump-triage parser for when digits land on your bench, and the session discipline that turns a dispensed stack into landed money without lighting up the counterfeits-and-anomaly team. Post your lane - best bench-to-cash field log gets pinned, first fifteen get the extended triage script.
TL;DR - The cashout machine has two inputs. Harvest: magnetic shimmers and deep-insert readers sit on the card path and lift track data, overlay PIN pads and pinhole cameras capture the code, and the combo is dump-plus-PIN material that a cloned stripe walks straight out at any mag-stripe-accepting ATM. Software: malware families intercept or impersonate the switch conversation the ATM already speaks — IBM X-Force's FastCash family (AIX/PowerPC, Hidden Cobra lineage) rides the transaction authorization path so withdrawals approve without a live card present, Ploutus-D and its Windows/XFS cousins drive the cash dispenser through the XFS CEN commands, and the P4WNP1-style Pi Zero frames plug into the machine's service path and fire dispense orders from a $15 board. The forensics repos are real and linked below: fboldewin's XFS_DIRECT jackpotting analysis (173 stars), FastCashMalwareDissected, the Ploutus-D cyberforensics walkthrough, plus sparkfunX's Skimmer_Scanner (347 stars) for the detection side — skimmers still leak their Bluetooth module identities and that's free wins. Code: an ISO8583 0200 withdrawal builder showing exactly the message shape a switch treats as cash, and a Track2/dump triage parser (structure, Luhn, family, expiry age, dupes) for sorting material the moment it arrives. Defense side: jitter PIN pads, anti-shim bezels, dispense-vs-authorization reconciliation, USB/service-port locks, and Bluetooth reconnaissance around the machine. Discipline: separate harvest from dispense by days, match session size to the machine's published limits, never the same lane twice, cash into the ledger — 22602's calculator does the math. Six questions, scoreboard, checklist, FAQ.
THE TWO LANES
- Harvest lane — reads the card and the code. Shimmers thin enough to ride under the chip contact plate, deep-insert readers hiding behind the card throat, magnetic heads grafted onto the bezel path, overlay keypads with a battery and a pinhole, phone-camera wafers in brochure holders. Output: track data plus digits.
- Software lane — speaks to the machine. Malware inside the ATM's OS or a board piggybacked on the service port that issues dispenser commands, intercepts the authorization response so a decline reads as approve, or forges the withdrawal request outright. Output: notes, with no card anywhere near the machine.
- The join — both lanes end in the same three steps: triage the material, pair it with a machine that will honor it, dispense inside the limits that keep you off the anomaly report. The lanes are separate lives on purpose: digits harvested Monday, dispensed Thursday, never on the camera's shift rotation.
THE HARVEST LANE, 2026 STATE
The hardware got thinner and the tell stayed the same. Shimmers — foil-thin boards that slip under the chip contacts and read the stripe as the card passes — leave no bulge, but they still need a partner for the code, which is why overlays and pinhole cameras did not disappear. What did change is radio hygiene: cheap Bluetooth modules still announce themselves by name (HC-05-class modules, generic SPP signatures), and that is exactly what the detection side scans for. sparkfunX/Skimmer_Scanner (347 stars) built a mobile Bluetooth scanner around that tell for gas-pump skimmers — the same 2.4 GHz sweep around an ATM fascia flags unsolicited devices that should not be advertising from inside a metal cabinet. Gas pump skimmers went through the same evolution and the pump-attacker pattern — deep insert plus Bluetooth exfil plus a magnetic overlay — is now the template taught on both sides. The material that falls out of a clean harvest is track data plus digits, and everything downstream depends on how well it is triaged before anyone touches a machine — which is what the second code block is for.
THE SOFTWARE LANE: XFS, FASTCASH, PLOUTUS-D
Under the fascia, almost every ATM runs the same conversation: Windows or Linux driving a XFS (Extensions for Financial Services) manager, which speaks CEN commands to the peripherals — card reader, PIN pad, encrypting keypad, and the dispenser. That standardization is the whole attack surface. The public forensics tell a consistent story:
- fboldewin/ATM-Jackpotting-P4WNP1-style-with-malware-XFS_DIRECT - 173 stars. The P4WNP1 frame analysis: a Pi Zero-class board planted inside the machine, wired to the service path, pushing XFS_DIRECT dispense requests. Fifteen dollars of hardware behind a locked door.
- fboldewin/FastCashMalwareDissected - Operation Fast Cash dissected: the AIX/PowerPC family (Hidden Cobra lineage) that sits on the switch conversation and flips withdrawal authorizations to approve — no dispenser driver needed, because the switch itself is fooled into blessing the cash.
- sastraadiwiguna-.../Ploutus-D-Cyberforensics - 12 stars. Ploutus-D on Windows ATMs: keypad-driven cash-recycler control through the XFS manager — the classic jackpot, walked through forensically.
- gdborton/ploutus - the original leaked lineage (2014), small but instructive: how little code sits between a service command and a stack of notes.
- The pattern across all four: nobody breaks the dispenser's physics. They command it through the interface it was built to obey, from a position (inside the OS, on the service bus, on the switch path) where the machine cannot tell orders from its own software.
CODE: THE MESSAGE THE SWITCH BELIEVES
Every dispense in the software lane — legit or faked — bottoms out in one ISO8583 message: a 0200 financial request carrying PAN, amount, terminal ID and a trace number, answered by a 0210 where field 39 says "00" and the machine counts notes. Reading this builder teaches the exact anatomy FastCash manipulated — the request/response pair, the fields that make a withdrawal look local and routine. Layouts vary by switch (LLVAR positions, bitmap extension); the constants are marked so you can align them against any public switch spec.
Code:
import random, datetime
PAN = "4111111111111111" # test PAN - replace with your own lab card
PROC_CODE = "020000" # cash withdrawal - confirm per switch spec
AMOUNT = "000000150000" # 1500.00 in minor units, no decimal point
EXPIRY = "2512" # YYMM
CCY = "784" # ISO4217 numeric (AED example)
TERM_ID = "TERM0001" # ATM terminal identifier
now = datetime.datetime.now()
def de(n): # data element -> bitmap bit (1-based)
return 1 << (64 - n)
fields = {
2: PAN, # PAN (LLVAR)
3: PROC_CODE, # processing code
4: AMOUNT, # transaction amount
7: now.strftime("%m%d%H%M%S"), # transmission date/time
11: "%06d" % random.randint(1, 999999), # STAN - trace number
14: EXPIRY, # card expiration
18: "6011", # MCC - ATM/cash disbursement
35: "?%s101000000000000" % EXPIRY, # track2 (discretionary trimmed)
37: "%012d" % random.randint(0, 999999999999), # retrieval ref no.
41: TERM_ID, # card acceptor terminal ID
42: "ACCT00000000001", # acceptor ID
49: CCY, # currency
}
bitmap = 0
for n in fields:
bitmap |= de(n)
mti = "0200" # financial request
head = mti + "%016X" % bitmap # primary bitmap, 16 hex chars
body = ""
for n in sorted(fields):
v = str(fields[n])
body += ("%02d%s" % (len(v), v)) if n in (2, 35) else v # LLVAR vs fixed
msg = head + body
print("MTI :", mti)
print("BITMAP :", "%016X" % bitmap)
print("FIELDS :", sorted(fields))
print("MESSAGE:", msg)
print("LENGTH :", len(msg))
# switch answers 0210: field 39 "00" = approved, "05"/"14" = decline,
# "61" = exceeds withdrawal limit, "51" = insufficient funds.
# The dispenser only moves when BOTH sides agree.
CODE: THE TRIAGE BENCH
Material that arrives unsorted gets people caught: stale expiries tried at counters, duplicate PANs burned twice in one session, family mismatches routed to the wrong lane. This parser eats raw Track2 lines or PAN|MMYY|CVC rows, validates structure and Luhn, flags family and expiry age, and dedupes before anything moves to session planning. Run it the moment a harvest lands — the sort order it prints is the working order.
Code:
import re, datetime
FAMILY = [(r"^4", "VISA"), (r"^5[1-5]", "MASTERCARD"), (r"^2(?:2[2-9]|3[0-9]|4[0-8])", "MASTERCARD2"),
(r"^3[47]", "AMEX"), (r"^6(?:011|5|4[4-9])", "DISCOVER"), (r"^35", "JCB"),
(r"^3(?:0[0-5]|6|8)", "DINERS"), (r"^39", "JCB"), (r"^50", "MAESTRO")]
def luhn(n):
s, alt = 0, (len(n) % 2 == 0)
for i, c in enumerate(n):
d = int(c)
if (i % 2 == 0) == alt:
d *= 2
d -= 9 if d > 9 else d
s += d
return s % 10 == 0
def parse(line):
line = line.strip()
if not line or line.startswith("#"):
return None
pan = exp = cvc = ""
if line[0] in ";Dd": # raw track2
body = line.strip("?").lstrip(";Dd")
sep = "=" if "=" in body else "D"
pan, rest = body.split(sep, 1)
exp, cvc = rest[:4], (re.sub(r"\D", "", rest)[4:7] if len(rest) > 6 else "")
elif "|" in line: # PAN|MMYY|CVC rows
parts = [p.strip() for p in line.split("|")]
pan, exp = parts[0], parts[1] if len(parts) > 1 else ""
cvc = parts[2] if len(parts) > 2 else ""
else:
pan = re.sub(r"\D", "", line)
return re.sub(r"\D", "", pan), exp, cvc
seen, rows, dupes = set(), [], 0
for raw in open("dumps.txt", encoding="utf-8", errors="replace"):
r = parse(raw)
if not r:
continue
pan, exp, cvc = r
if len(pan) < 13:
rows.append((pan.ljust(19), "SHORT", "-", "-", "REJECT")); continue
key = pan[:-4] # dedupe on stable prefix
if key in seen:
dupes += 1
continue
seen.add(key)
fam = next((f for p, f in FAMILY if re.match(p, pan)), "UNKNOWN")
ok = "PASS" if luhn(pan) else "FAIL"
fresh = "-"
if len(exp) == 4 and exp[:2].isdigit() and exp[2:].isdigit():
try:
d = datetime.date(2000 + int(exp[:2]), int(exp[2:]), 1)
fresh = "STALE" if d < datetime.date.today() else "LIVE"
except ValueError:
fresh = "BADEXP"
masked = pan[:6] + "*" * (len(pan) - 10) + pan[-4:]
rows.append((masked.ljust(19), fam, ok, fresh, "DUP" if False else ("CVC:" + (cvc or "-")))
print("%-19s %-11s %-4s %-6s %-10s" % ("PAN", "FAMILY", "LUHN", "EXP", "NOTE"))
for r in rows:
print("%-19s %-11s %-4s %-6s %-10s" % r)
print("----")
print("parsed: %d | dupes dropped: %d | live: %d | stale: %d" % (
len(rows), dupes,
sum(1 for r in rows if r[3] == "LIVE"),
sum(1 for r in rows if r[3] == "STALE")))
# next: pair LIVE+PASS rows with PIN material, schedule sessions
# against machine limits - never two withdrawals from one lane per day.SESSION DISCIPLINE: WHERE LANES DIE
Jackpots and skims end in the same police reports for the same reasons: the dispense did not match the authorization, the same lane was used twice, or the cash hit a wallet that had touched it before. The countermeasures are public — ATM operators reconcile dispensed-note counts against switch authorizations hourly, alert on repeated small withdrawals from one terminal, and Bluetooth-sweep fascias on a route. So the discipline is arithmetic: session size stays under the machine's published per-transaction and per-day limits (most retail ATMs cap $400-$1000 per transaction), the trace numbers you generate never repeat, dispense days are separated from harvest days by enough time that camera footage from one is irrelevant to the other, and every session's take goes into the ledger — same calculator, same GO/HOLD rules as card-to-cash. A lane dies when money moves in a pattern; it lives when the pattern is boring.
TEST YOURSELF: SIX QUESTIONS
Score honestly: (1) name the two lanes and what each one outputs. (2) a shimmer alone is useless without what second component, and why? (3) what does the ATM's XFS manager sit between, and why does that make standardization the attack surface? (4) FastCash and Ploutus-D differ in which part of the conversation they compromise — switch authorization or dispenser command — name both correctly. (5) run the 0200 builder: which field tells the switch how much to dispense, and what field in the 0210 answers "yes"? (6) your triage prints five LIVE/PASS rows — what three facts decide their session order? Zero to one: you read the titles. Two to three: you understand the map, go run real numbers through the triage. Four plus: you can brief a crew on where each lane dies — post your version.
POST YOUR LANE
Scoreboard format: lane (harvest/software), machine model or switch class, what triage printed (count of LIVE/PASS), session size vs machine limit, and the one countermeasure that would have caught your pattern — posted as a field log, own-rig or research framing, no third-party bragging in the open. Cleanest bench-to-cash log gets pinned to the Carding-method node, first fifteen posters get the extended triage script via PM — Luhn + structure + dedupe plus a 200-entry BIN country/family table and proxy-liveness check for the material that routes through mixed lanes.
OPERATOR CHECKLIST
- Harvest first, hands off the machine afterward — reads and dispenses live separate weeks, separate rigs, separate routes.
- Triage on arrival — structure, Luhn, family, expiry age, dedupe. Nothing moves downstream with a FAIL or a STALE row attached.
- Pair material before session — dump family matches lane acceptance, PIN paired only with the cards that need it, proxy/geo consistent with the PAN's issue country.
- Recon the machine — model, per-transaction and per-day limits, camera angle and service-port access, note-cassette type, whether it still honors mag stripe.
- Session arithmetic — take stays under the printed limits, trace numbers never repeat, one dispense per lane per day maximum, in and out inside a shift-change blind spot.
- Cash into the ledger — take, lane cost, machine count, running EV. 22602's calculator decides GO/HOLD, not gut feeling.
- Post-mortem every run — what moved, what almost flagged, what the reconciliation window looked like. Write it down while the machine's logs are still rolling.
FAQ
- Q: FastCash vs Ploutus-D — which one actually moves the money?
A: Both, through different joints. FastCash corrupts the authorization side so the switch blesses withdrawals that were never legitimate; Ploutus-D drives the dispenser through XFS commands from inside the ATM's OS. Public forensics show both families cycling for years — the family matters less than which conversation you can reach.
- Q: Is jackpotting still alive in 2026 if operators locked their USB ports?
A: Physical access moved on when ports got locked — service-bus implants and switch-path attacks do not need the front door. Port locks kill the 2016-era plug-and-play script, not the class.
- Q: Why does the code talk about XFS?
A: Because it is the universal middleman: card reader, keypad and dispenser all speak CEN commands through the XFS manager on virtually every deployed ATM. Understand that interface and you understand where every software-lane family parks itself.
- Q: What actually trips a jackpot detection?
A: Reconciliation, mostly — dispensed-note counts that do not match authorization records, repeat small withdrawals from one terminal, cassette levels dropping against traffic patterns. The malware rarely gets caught; the arithmetic does.
- Q: Do skimmers still work with chip-and-PIN everywhere?
A: The stripe still exists on every card and plenty of lanes still fall back to it — that is why shimmers sit under the chip contacts and read the stripe during insertion. Chip raises the bar, the fallback path keeps the lane alive.
- Q: First step for someone with no material at all?
A: Bench setup, not field work — get the triage running against sample dumps, learn the 0200/0210 conversation, and read the four forensics repos above end to end. The lanes reward patience and punish rushed first runs.
RELATED
CVV vs Fullz vs Logs - The Complete Material Guide
EMV Chip Reader Writer 2026 - Bench to Cashout
Carding Tools 2026: BIN Checkers & Validators
Cashout Pipeline 2026: Material to Landed Money
