Same for: 10.1.13 Packet Tracer - File and Data Integrity Checks
2.1.8 Packet Tracer - File and Data Integrity Checks (Answers)
Topology
Objectives
Part 1: Recover Files after a Cyber Attack
Part 2: Using Hashing to Verify File Integrity
Part 3: Using HMAC to Verify File Integrity
Background
In this Packet Tracer (PT) activity, you will verify the integrity of multiple files using hashes to ensure files have not been tampered with. If any files are suspected of being tampered with, they are to be sent to Sally’s PC so that she can further analyze the contents. The IP addressing, network configuration, and service configurations are already complete. You will use the client devices to verify and transfer any suspect files.
Resources
The CSE-LABVM installed in VirtualBox
Note: It is recommended that you use the CSE-LABVM to check file MD5 files hashes in this activity. The CSE-LABVM was installed during the Lab - Install a Virtual Machine on a Personal Computer.
Instructions
Part 1: Recover Files after a Cyber Attack
Client data must be secured and remain unchanged by unauthorized personnel. By hashing data before and after it is archived, you can tell if it has changed even by one character or even one bit because the hashes will not match. In this Part, you will attempt to recover files from a backup after a cyber attack.
Step 1: Access the BR Server from Mike’s PC (Laptop BR-1).
a. Click Branch Office and then click Laptop BR-1.
b. Click the Desktop tab and then click Web Browser.
c. Enter the URL http://branch.corp and click Go.
Note: Packet Tracer may take up to a minute to converge. You can click Fast Forward Time (Alt+D) to speed up the process.
d. Click the link to download the most current files.
Step 2: Copy the hash values from the last time the files were archived.
You need to restore the missing files from a backup server located in HQ. But first, you need the hashes for the stored files to ensure their integrity.
a. Enter the URL http://hq.corp and click Go.
b. Click the link to view the most recent files and their hashes.
c. Select and copy all the content.
d. Open the CSE-LABVM, and then click Menu > Text Editor Pluma.
e. Paste the contents of your clipboard into the blank document. You will use these hashes to validate if a file is corrupted.
This page contains hashes for the most recent files placed on the FTP server. FileName | NEclients.txt | Hash| 4dff78485308281b339bfda9236eda45 FileName | NWclients.txt | Hash| 2c77ff70d5f7a2a720d231617157faa4 FileName | Nclients.txt | Hash| 8040e56207aab9dd331566b79dca37dd FileName | SEclients.txt | Hash| 520eb6c72cc2574decb731bc6230e223 FileName | SWclients.txt | Hash| 69e751fe1175b39709629710e5ffa491 FileName | Sclients.txt | Hash| 06bea9b0fa7db92d7c21261b88323be6 FileName | income.txt | Hash| b138706cb55787d2a01934b224edad32203f87470ff6c7ffb9bd126786d1830d
Step 3: Download the backup files to Mike’s PC (Laptop BR-1).
a. Back in Packet Tracer, close the Web Browser one Mike's PC.
b. Click Command Prompt. Connect to the HQ FTP Server by entering ftp hq.corp at the prompt.
c. Enter the username of mike and a password of cisco123.
d. At the ftp> prompt, enter the command dir to view the current files stored on FTP server.
C:\>ftp hq.corp Trying to connect...hq.corp Connected to hq.corp 220- Welcome to PT Ftp server Username:mike 331- Username ok, need password Password:******** 230- Logged in (passive mode On) ftp>dir Listing /ftp directory from hq.corp: 0 : NEclients.txt 582 1 : NWclients.txt 583 2 : Nclients.txt 698 3 : SEclients.txt 597 4 : SWclients.txt 649 5 : Sclients.txt 780 ftp>
e. Download the six client files (NEclients.txt, NWclients.txt, Nclients.txt, SEclients.txt, SWclients.txt, and Sclients.txt) to Mike’s PC using the command get filename.txt. Example for the file is shown here:
ftp>dir Listing /ftp directory from hq.corp: 0 : NEclients.txt 582 1 : NWclients.txt 583 2 : Nclients.txt 698 3 : SEclients.txt 597 4 : SWclients.txt 649 5 : Sclients.txt 780 ftp> ftp> ftp>get NEclients.txt Reading file NEclients.txt from hq.corp: File transfer in progress... [Transfer complete - 582 bytes] 582 bytes copied in 0.054 secs (10777 bytes/sec) ftp> ftp>get NWclients.txt Reading file NWclients.txt from hq.corp: File transfer in progress... [Transfer complete - 583 bytes] 583 bytes copied in 0.028 secs (20821 bytes/sec) ftp> ftp>get Nclients.txt Reading file Nclients.txt from hq.corp: File transfer in progress... [Transfer complete - 698 bytes] 698 bytes copied in 0.032 secs (21812 bytes/sec) ftp> ftp>get SEclients.txt Reading file SEclients.txt from hq.corp: File transfer in progress... [Transfer complete - 597 bytes] 597 bytes copied in 0.081 secs (7370 bytes/sec) ftp> ftp>get SWclients.txt Reading file SWclients.txt from hq.corp: File transfer in progress... [Transfer complete - 649 bytes] 649 bytes copied in 0.019 secs (34157 bytes/sec) ftp> ftp>get Sclients.txt Reading file Sclients.txt from hq.corp: File transfer in progress... [Transfer complete - 780 bytes] 780 bytes copied in 0.044 secs (17727 bytes/sec) ftp>
f. After downloading all the files, exit the FTP command line by using the quit command.
g. Enter the command dir and verify that the client files are now located on Laptop BR-1.
Part 2: Using Hashing to Verify File Integrity
In this Part, use the CSE-LABVM to hash the contents of the files you downloaded. You will then compare the new hash to the old hash to see if the data has changed. Any files that have changed since they were archived will be sent to Sally so that she can investigate the changes at a later time.
Step 1: Check the hashes on the client files on Mike’s PC (Laptop BR-1).
a. Close the Command Prompt, and then click Text Editor.
b. Click File > Open, select first document NEclients.txt, and then click OK.
c. Copy the entire text document content.
Name|Zip Code|Email|Pin # Hannah Caldwell|7624|[email protected]|6111 Rhiannon B. Langley|46872|[email protected]|9781 Nigel Ward|3584|[email protected]|4896 Alvin Farley|69508|[email protected]|5358 Clark U. Pratt|23441|[email protected]|9273 Robin Randall|10108|[email protected]|4232 Stacey L. Kirby|Y4B 8Z5|[email protected]|4200 Joan Pearson|1867VB|[email protected]|5002 Herman Lambert|09774|[email protected]|1220 Quentin Blankenship|48315-746|[email protected]|3387
d. Open the CSE-LABVM.
e. Double click the Terminal icon to open a terminal window.
f. Use the echo -n 'file-contents' | md5sum command to create a hash to validate the data in the NEclients.txt file. Paste you clipboard content between the single quotes.
Hash Verification: NEclients.txt (Match)
cisco@labvm:~$ echo -n 'Name|Zip Code|Email|Pin # Hannah Caldwell|7624|[email protected]|6111 Rhiannon B. Langley|46872|[email protected]|9781 Nigel Ward|3584|[email protected]|4896 Alvin Farley|69508|[email protected]|5358 Clark U. Pratt|23441|[email protected]|9273 Robin Randall|10108|[email protected]|4232 Stacey L. Kirby|Y4B 8Z5|[email protected]|4200 Joan Pearson|1867VB|[email protected]|5002 Herman Lambert|09774|[email protected]|1220 Quentin Blankenship|48315-746|[email protected]|3387' | md5sum 4dff78485308281b339bfda9236eda45 - cisco@labvm:~$
g. Compare the hash value created here with the hash values you copied to the text document earlier.
Question:
Are the two hash values for NEclients.txt the same?
Yes
h. Hash the contents of the remaining five files until one of the values does not match the computed hash.
Hash Verification: NWclients.txt (Match)
cisco@labvm:~$ echo -n 'Name|Zip Code|Email|Pin # Stuart M. Barnes|3930|[email protected]|6893 Tanya X. Sharp|5990|[email protected]|9285 Cheyenne Garza|1493|[email protected]|2664 Dolan Yates|7991WA|[email protected]|3437 Hiroko Fleming|394867|[email protected]|1880 Brennan Whitney|10539|[email protected]|8600 Kylan Z. Armstrong|53563-945|[email protected]|8698 Peter G. Molina|26924|[email protected]|3340 Deborah Sanders|36376|[email protected]|9711 Brett Travis|23-060|[email protected]|2883 ' | md5sum 2c77ff70d5f7a2a720d231617157faa4 - cisco@labvm:~$
Hash Verification: Nclients.txt (Match)
cisco@labvm:~$ echo -n 'Name|Email|Company|Zip Code Grant K. Dyer|[email protected]|Est Foundation|I9Z 9AZ Tamekah O. Petty|[email protected]|Posuere Cubilia Limited|45-937 Adam H. Buck|[email protected]|Pede Blandit Congue Company|647129 Calvin V. Hays|[email protected]|Nunc Nulla Vulputate LLP|00078 Zane Casey|[email protected]|Iaculis Incorporated|72240 Rudyard W. Dalton|[email protected]|Auctor Nunc PC|626714 Lamar Q. Allen|[email protected]|Et Rutrum Corp.|44736 Michelle Sloan|[email protected]|Nisi PC|00312 Haley E. Bass|[email protected]|Lorem Associates|00079 Larissa G. Swanson|[email protected]|Ut Limited|0626QT ' | md5sum 8040e56207aab9dd331566b79dca37dd - cisco@labvm:~$
Hash Verification: SEclients.txt (Mismatch — Tampered)
cisco@labvm:~$ echo -n 'Name|Zip Code|Email|Pin # Germane Rutledge|60600|[email protected]|4782 Alyssa Chandler|4001ZA|[email protected]|3118 Erica Burt|76167|[email protected]|6627 Iona Norton|69003|[email protected]|2558 Joel Mcmahon|27979|[email protected]|9863 Ira Raymond|70129-554|[email protected]|9881 Ivory Acevedo|59-454|[email protected]|1843 Willa X. Bridges|399542|[email protected]|7776 Kimberly Garcia|37334|[email protected]|1239 Ethan Thornton|49438|[email protected]|8090 ' | md5sum f8a01d43eef5271e680dacaf1d1642d1 - cisco@labvm:~$
Hash Verification: SWclients.txt (Match)
cisco@labvm:~$ echo -n 'Name|Zip Code|Email|Pin # Vanna Q. Nash|AM66 4LM|[email protected]|3694 Randall Figueroa|04431|[email protected]|5474 Risa Taylor|35300|[email protected]|2848 Oren U. Adams|13-602|[email protected]|6899 Stone Rivera|5968WH|[email protected]|2497 Abbot Rosario|95683|[email protected]|6518 Oren Austin|21069|[email protected]|9089 Kirk W. Valentine|5187|[email protected]|3342 Lance Price|24835|[email protected]|1352 Brooke Y. Elliott|85926|[email protected]|3396 ' | md5sum 69e751fe1175b39709629710e5ffa491 - cisco@labvm:~$
Hash Verification: Sclients.txt (Match)
cisco@labvm:~$ echo -n 'Name|Email|Company|Zip Code Alexis I. Townsend|[email protected]|Tortor At Ltd|11478 Ulysses Turner|[email protected]|Dapibus Associates|8572YJ Hamish M. Roach|[email protected]|Nunc Sed Pede Incorporated|67184 Sylvester E. Burns|[email protected]|Phasellus Nulla Integer Associates|G7 7UB Quamar Carter|[email protected]|Nostra Per Inceptos PC|50216 Eagan Tucker|[email protected]|Neque Inc.|3142 Madison Thompson|[email protected]|Dis Parturient Montes Company|15969 Galvin P. Vance|[email protected]|Amet Consulting|60185 Linda H. Greer|[email protected]|Interdum Curabitur Corporation|T27 4WN Gwendolyn Fernandez|[email protected]|Sed Orci Ltd|835799' | md5sum 06bea9b0fa7db92d7c21261b88323be6 - cisco@labvm:~$
Question:
Which file has been tampered with and has an incorrect hash?
SEclients.txt
Step 2: Escalate the cyber attack to Mike's supervisor, Sally.
a. Return to Packet Tracer and close the Text Editor.
b. Click Email, and then Compose. Write an email and send it to [email protected] to tell her that the file server has been hacked.
Step 3: Download the suspected file to Sally’s PC.
a. Navigate to the HQ site, and then click HQ-Laptop-1.
b. Click Desktop tab > Command Prompt, and then enter ftp hq.corp to connect to the HQ FTP Server.
c. Enter the username of sally and a password of cisco321.
Cisco Packet Tracer PC Command Line 1.0 C:\>ftp hq.corp Trying to connect...hq.corp Connected to hq.corp 220- Welcome to PT Ftp server Username:sally 331- Username ok, need password Password:******** 230- Logged in (passive mode On) ftp>
d. At the ftp> prompt, enter the dir command to view the current files stored on the remote HQ FTP Server.
e. Download the file that was found to have been tampered with in Part 2 - Step 1.
ftp>dir Listing /ftp directory from hq.corp: 0 : NEclients.txt 582 1 : NWclients.txt 583 2 : Nclients.txt 698 3 : SEclients.txt 597 4 : SWclients.txt 649 5 : Sclients.txt 780 ftp> ftp>get SEclients.txt Reading file SEclients.txt from hq.corp: File transfer in progress... [Transfer complete - 597 bytes] 597 bytes copied in 0.053 secs (11264 bytes/sec) ftp>
f. At the ftp> prompt, enter the command quit.
g. At the C:\> prompt, enter the command dir and verify the tampered client file is now on HQ-Laptop-1 for analysis by Sally in the future.
ftp>quit
221- Service closing control connection.
C:\>
C:\>dir
Volume in drive C has no label.
Volume Serial Number is 5E12-4AF3
Directory of C:\
1/1/1970 7:0 PM 597 SEclients.txt
597 bytes 1 File(s)
C:\>Part 3: Using HMAC to Verify File Integrity
Bob is the CFO for a small business and keeps track of all the finances. In this Part, you will compute and verify a hash-based message authentication code (HMAC) of a critical file to ensure that it is the same data since the last time the file was used. HMAC requires a secret key before file integrity can be validated.
a. Click Bob's laptop, which is HQ-Laptop-2.
b. Click the Desktop tab > Command Prompt, and then enter the dir command and verify the critical file named income.txt is on the laptop. Close the command prompt window when done.
Cisco Packet Tracer PC Command Line 1.0
C:\>dir
Volume in drive C has no label.
Volume Serial Number is 5E12-4AF3
Directory of C:\
1/1/1970 7:0 PM 203 income.txt
203 bytes 1 File(s)
C:\>c. Click Text Editor, and then File > Open.
d. Select the document income.txt and click OK.
e. Select and copy all the document contents.
f. In the CSE-LABVM, click the Menu button, and then click Text Editor Pluma. Click Edit and click Paste.
g. Click File and click Save. Save the file with the name income.txt. Close the file.
h. In a terminal window in the CSE-LABVM VM, use the following command to create an HMAC for the file income.txt. The secret key is cisco123.
cisco@labvm:~$ openssl dgst -sha256 -hmac cisco123 income.txt
Questions:
What is the computed HMAC for the contents of the file?
b138706cb55787d2a01934b224edad32203f87470ff6c7ffb9bd126786d1830d
How is using HMAC more secure than general hashing?
To produce a specific hash, you need both the original message and a secret key.
Does the HMAC hash for the income.txt file match the original hash you copied to the text file on the CSE-LABVM?
Yes
