I have always been fascinated by computers and software in general. In my daily life, I face a lot of software and ask myself how those systems are made and how they work. A couple of years ago when I joined my first college I faced a software program called 'Packet Tracer'. This program was not only used in class to let us exercise network configuration, but it would also be used for our networking exam.

Crack Activity Wizard Password Cisco Packet Tracer 7
Free Packet Tracer Cisco

If you try to open a.pka file, you won't be able to read anything in clear. Let's look at how packet Tracer handles those files and see if we can get them clear without knowing the activity wizard password. (I'm using OllyDbg for the reversing/debugging that follows.) Launch PT (Packet Tracer) and attach Olly to it. Cisco Packet Tracer 7.1 Release. Cisco Packet Tracer is a comprehensive, networking technology teaching and learning program that offers a unique combination of realistic simulation and visualization experiences, assessment and activity authoring capabilities, and opportunities for multiuser collaboration and competition.

And that's when everything got a lot more interesting. After I found out that the software is used as an official exam I had to look at how it works and how secure it is. But after a quick look, I noticed there wasn't much protection at all. Did the developers forgot to put it in, or did they think students at high school/college aren't capable of reversing such software?

We may never know the reason why there is no proper security in place, but I can tell you, this student over here nailed it! I managed to exploit the software in multiple ways, resulting in (almost) instant completion of the exam or other malicious acts.

What is Packet Tracer?

Like I said before, Packet Tracer is a tool that's used for examination. The tool is developed by the company named Cisco and they seem to advertise it as a free tool for school/students to help teach students about configuring networks and all.

As you may know, Cisco is also a hardware vendor... have a close look at Packet Tracer and you will see that they only have Cisco related hardware in their virtual environment. This makes sense knowing that the software is free. It's a sneaky marketing strategy to advertise their hardware like that to students that haven't got the chance yet to look at competing companies.

More info about Packet Tracer can be found at https://www.netacad.com/courses/packet-tracer

Fun fact, when you download and open Packet Tracer, a login screen shows up forcing you to log in. You can simply 'bypass' the login screen by temporarily disabling your internet connection and Packet Tracer won't show the login screen anymore, allowing you to use the software without the need for valid login credentials.

We could also patch the login screen so it would never show up, but then we basically 'crack' the software, which is kind of illegal.

Let's get Hacking

While looking at the files that are located in the Packet Tracer folder, I noticed some DLLs contain 'Qt5' in their names. This means Packet Tracer is most likely using the Qt5 framework.

After attempting to reverse the file saving/loading I noticed that the qt5 framework had a SQL library that was used inside Packet Tracer. The first thing that came to mind was hooking those functions to find out what packet tracing is doing with them. One function took my attention after I had a rough look at the exported functions from the Qt5Sql.dll, the one named 'exec'. There are two of those functions, so I googled for 'Qt5Sql' and found the official documentation for the function at https://doc.qt.io/qt-5/qsqlquery.html#exec

Before we can write any code we do have to find out what Packet Tracer does with those functions, so I just slap a breakpoint on the start of both functions and have a look at which arguments (if any) they have. We see that only one of the 'exec()' functions use arguments, according to the Qt5 documentation the one without arguments requires the function 'prepare(const QString &query)' to be called before the arguments less 'exec()' in order to execute something.

Also note that there is another function called 'execBatch(QSqlQuery::BatchExecutionMode mode = ValuesAsRows)' which is used to execute multiple SQL queries, but spoiler alert... Packet Tracers doesn't seem to have that one in its import tables, meaning it's not being used (or there must be some nasty obfuscation, but that's unlikely to be the case).

For real, there is no obfuscation nor any kind of anti-debugging features present inside Packet Tracer... It's Free Real Estate! (for hackers)

Alright, back to PacketTracer, I'm about to open up my favorite debugging software -- Cheat Engine -- and start breakpointing the SQL execution functions to see what's going. Once the breakpoint is placed we have to trigger it, this should be done by triggering some kind of event (such as a button click in Packet Tracer) that requires read/write from the SQL database. My first guess would be opening a .pka file (aka Packet Tracer Activity file), such files contain information about the exercise, the virtual environment, and most importantly, they must somehow contain the answers. Packet Tracer gives live feedback about the current status of the environment, it will increase or decrease the current score depending on which configuration you modify.

The ultimate goal for an attacker would be extracting the answers from the .pka file and then solving the current exercise with those answers. In theory, this should be possible since none of the answers are stored on a server since the application does not require an internet connection.

Writing some code

To better analyze what the function is doing we could write a quick hook using Cheat Engine 'Auto Assabmle' feature. The feature allows you to write assembly instructions, has support for labels, and can do neat things such as allocating memory that then can be used by our hook.

If you thought that Cheat Engine was just for searching values and then modifying those then you are wrong ;).

First, we open up the Memory View. Then click on to tools > Auto Assembly and a new window should pop up. In this window, we can write assembly code and then write it into memory by pressing the 'Execute' button.

Since the scope of this article is not about Cheat Engine I won't go into great details about what and how this works, but if you do want to learn more about it you may find this link helpful: https://wiki.cheatengine.org/index.php?title=Cheat_Engine:Auto_Assembler

Now copy the code below and past it in the Auto Assembler window.

The above code may look a bit complex, but all it does is create a hook at location 'Qt5Sql.dll'+2050, which is the Qt5 SQL exec() function that we have breakpointed previously.

We investigated that function and noticed that the second argument (rdx) holds the Qt5 String structure, but since the actual array of chars is located at [rdx+0x18], we make use of 'add rcx,18' to obtain our string. The SQL query string pointer is then moved into the 'sql_query' address (this address is allocated by Cheat Engine) and the hook then continues the normal execution of the function.

Now go back to Cheat Engine's main window, click on 'Add Address Manually' and then enter 'sql_query' as the Address. Cheat Engine is smart enough to recognize that 'sql_query' represents the address that we have (global)allocated by executing 'globalalloc(sql_query,1024)' in our Auto Assembler script. Do not forget to set the address type to 'Text' and enable the checkbox 'Unicode', this is done so that Cheat Engine knows it's looking at a wchar string.

Now the next time that the Qt5Sql.QSqlQuery::exec() function gets executed we will see the SQL query gets written to the 'sql_query' location. This will happen so fast that you won't be able to see all the queries going through. To fix this we can place a breakpoint under our hook so that the process is paused right after writing the SQL query to the 'sql_query' address.

In the image below you can see exactly where I have placed my breakpoint.

And this is how the 'sql_query' address in the Cheat Engine table looks like after the breakpoint got hit.

Analyzing the SQL queries

Now we can finally start analyzing all the incoming SQL queries we are getting. I went to Packet Tracer and loaded in a new .pka file, my breakpoint got triggered almost immediately. Below

Cisco Packet Tracer Activity Wizard Password Crack