[OFFER] Cisco CML Crack for 2.7 and 2.8

[TonyQ]

All versions of CML up to at least 2.8 can be cracked by simply changing two bytes.
This guide assumes that you have knowledge of Linux and can use a hex editor.

This is the hidden content, please

• Sign In
• or
• Sign Up

Edited February 15, 2025 by TonyQ

[JMMJ69]

On 2/15/2025 at 9:11 AM, TonyQ said:

All versions of CML up to at least 2.8 can be cracked by simply changing two bytes.
This guide assumes that you have knowledge of Linux and can use a hex editor.

Hidden Content

 

  Hide contents

1. block telemetry
   either run your cml server in an isolated network or assign a static ip with an invalid gateway during setup
   go to https://<cml-server>:9090 and login as sysadmin
   go to Tools, System Administration, Telemetry and disable it (not possible in 2.8 with the default free license!)

2. login as sysadmin at the console

3. change ssh server settings (e.g. sudo nano /etc/ssh/sshd_config)
   change '#Port 22' to 'Port 1122'
   change 'KbdInteractiveAuthentication no' or '#KbdInteractiveAuthentication' to 'KbdInteractiveAuthentication yes'
   save
   run 'sudo systemctl restart ssh'
   
4. use a scp client like winscp to copy '/var/local/virl2/.local/lib/smart/libsmartunified.so' to your computer

5. modify this file with a hex editor
   CML 2.7.2-26:
   offset 0x1E2865: change 0x74 to 0xEB
   offset 0x1E28A2: change 0x0A to 0x00
   original SHA256=01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
   patched SHA256=76BE8B528D0075F7AAE98D6FA57A6D3C83AE480A8469E668D7B0AF968995AC71
   
   CML 2.8.0-6:
   offset 0x1917AF: change 0x74 to 0xEB
   offset 0x1917EC: change 0x0A to 0x00
   original SHA256=ECF550FA5379D4F733BE9E6C6903207663FBEDD377B5A44DC6D49B4DD9A02ED1
   patched SHA256=6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
   
   for other versions use IDA (or the disassembler of your choice) to modify the function SAPluginCryptoValidateSignature:
   after test rax,rax change jz to jmp
   follow the jmp and change mov eax, 0Ah to mov eax, 0
   hint: 'menu edit, patch program, assemble' and finally 'apply patches to input file'
   
6. copy libsmartunified.so back to your cml server to /home/sysadmin
   run 'sudo cp /home/sysadmin/libsmartunified.so /var/local/virl2/.local/lib/smart/libsmartunified.so'
   
7. reboot

8. go to https://<cml-server-ip>:443 and login as admin

9. license file
   save the data between the dashed lines as license.txt
------------------------------
<specificPLR><authorizationCode><flag>A</flag><version>C</version><piid>11111111-11111-11111-11111-111111111</piid><timestamp>1111111111111</timestamp><entitlements><entitlement><tag>regid.2019-10.com.cisco.CML_ENT_BASE,1.0_15d3393c-846c-4e00-a54e-1ea90f2b2160</tag><count>1</count><startDate>2022-Feb-23 UTC</startDate><endDate>2055-Dec-31 UTC</endDate><licenseType>TERM</licenseType><displayName>1</displayName><tagDescription>2</tagDescription><subscriptionID></subscriptionID></entitlement><entitlement><tag>regid.2019-10.com.cisco.CML_NODE_COUNT,1.0_2607650b-6ca8-46d5-81e5-e6688b7383c4</tag><count>300</count><startDate>2022-Feb-23 UTC</startDate><endDate>2055-Dec-31 UTC</endDate><licenseType>TERM</licenseType><displayName>5</displayName><tagDescription>7</tagDescription><subscriptionID></subscriptionID></entitlement></entitlements></authorizationCode><signature>1111111111111111111111111111111111111111111111111111111</signature><udi>S:*****,U:*****-****-****-****-*******</udi></specificPLR>
------------------------------

   go to tools, diagnostics, licensing, expand 'Smart Licensing Tech Support info' and scroll down to the bottom of the page
   grab the values 'S:xxxxxxxxxxx,U:yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy', replace 'S:*****,U:*****-****-****-****-*******' in the last line of license.txt with that and save the file
   
10. go to tools, licensing
   set the product configuration to Enterprise
   click on Register
   click in 'Start Here' at the line 'If your Smart Account is authorized for License Reservations and you wish to reserve licenses, Start Here'
   click yes, my smart account is license reservation enabled
   click generate reservation request code
   ignore the code and click cancel
   click on enter reservation authorization code
   click on authorization code file and use the license file from step 9
   
11. disable telemetry in 2.8
   now you can go to Tools, System Administration, Telemetry and disable it       

 

 

 

Can you provide the file patched for the 2.8 please

[khaldoun]

cc

[AncientOne]

On 2/15/2025 at 4:11 PM, TonyQ said:

All versions of CML up to at least 2.8 can be cracked by simply changing two bytes.
This guide assumes that you have knowledge of Linux and can use a hex editor.

 

Hidden Content

• Give reaction or reply to this topic to see the hidden content.

 

The same approach can be use for ISE 3.4 and many other Cisco appliance. Have fun.

[przemoag]

Thank you

[Grumpy]

thank you.

[alisunj]

Thank you

 

[pimservaas]

Thank you!

 

[gladius257]

thanks

 

[Frespery]

Have a try

[phenyolk]

yes

[bisso]

thnx

[Tosaga]

I don't know if I'm doing something wrong but when i edit it I have this hash fe2b46de381846331250931ea9d78fc4b1e943ff922da8f5010b9d95808e7af0 and it doesn't work
Others have the same problem ?

[netkillui]

On 4/30/2025 at 8:07 AM, Tosaga said:

I don't know if I'm doing something wrong but when i edit it I have this hash fe2b46de381846331250931ea9d78fc4b1e943ff922da8f5010b9d95808e7af0 and it doesn't work
Others have the same problem ?

same for me

[mininer]

On 4/30/2025 at 8:07 PM, Tosaga said:

I don't know if I'm doing something wrong but when i edit it I have this hash fe2b46de381846331250931ea9d78fc4b1e943ff922da8f5010b9d95808e7af0 and it doesn't work
Others have the same problem ?

same for me too

[lolo]

thx

 

[mooteel]

omg.... it works...

Thx!!!!

Edited May 21, 2025 by mooteel

[alexcama]

Great! Where Do I find cml2.18 to download? 

[pimservaas]

thank you1

[fishtacos]

Has anyone been able to do this on 2.8.1-14?

I've tried the debugging method  since the hex method only woks specific to the file version, but it's complex enough  that I'm not able to follow it. I may try it agian some day, but does anyone have one where it worked for them?

I'm attaching the 2.8.1-14 libsmartunified.so UNPATCHED here in the hopes someone is capable of doing so according to the instructions listed above.

 

This is the hidden content, please

• Sign In
• or
• Sign Up

[lion2021]

---

[khodamn]

Noice.

[mess]

For 2.8.1 use the same instructions as mentioned in the first post.

only change is below: 

Spoiler

...

   CML 2.8.1-x:
   offset 0x1917A0: change 0x74 to 0xEB
   offset 0x1917E0: change 0x0A to 0x00

...

Important!
In case you are coming from CML upgrade, previous Licensing will conflict with your current licensing effort. To solve this, you must go to the CML controller node and reset the Licensing. This will revoke previous licensing and it will permit you to (re-)license CML:

CML node > System > CML2 > then expand below and hit Licensing Reset

 

Then follow the rest of the original guide (i.e. upload the modified libsmartunified.so to the "/var/local/virl2/.local/lib/smart/" directory etc.)

And then it should work just fine.

 

Edited June 12, 2025 by mess

[mess]

17 hours ago, fishtacos said:

Has anyone been able to do this on 2.8.1-14?

I've tried the debugging method  since the hex method only woks specific to the file version, but it's complex enough  that I'm not able to follow it. I may try it agian some day, but does anyone have one where it worked for them?

I'm attaching the 2.8.1-14 libsmartunified.so UNPATCHED here in the hopes someone is capable of doing so according to the instructions listed above.

 

This is the hidden content, please

• Sign In
• or
• Sign Up

look in my above post friend

You can use this online 

This is the hidden content, please

• Sign In
• or
• Sign Up

 to load your original libsmartunified.so file, then change the hex values following the original guide.

Edited June 12, 2025 by mess

[fishtacos]

21 hours ago, mess said:

look in my above post friend

You can use this online 

This is the hidden content, please

• Sign In
• or
• Sign Up

 to load your original libsmartunified.so file, then change the hex values following the original guide.

Fuckin A! You rock!

I'm setting it up right now, with hopefully a clustered setup ithis time around   I'm assuming the licensing for the cluster compute nodes is derived from the controller VM, but we'll cross that bridge when we get to it.  Even without a cluster, 2.8.1 provides a much desired fix for the Cisco breakout tool that crashes upon disconnecting a putty session.

EDIT:
Cool, cool, have a test SD WAN topology from Cisco's lab deployment github running spread out over 3 clustered ESXi nodes with memory tiering enabled. I'm waiting for it to crash and burn because the memory tiering is in tech preview stage, but for the time being things are running smoothly enough.

You sir, are awesome. 

Edited June 13, 2025 by fishtacos