Skip to main content

TP 4 – Practical Implementation: SSH Protocol

Correction Elements

Correction elements for this TP are available in the exercise repository: 👉 module-16 – Corrections

Bonus Module: Understanding VirtualBox and VMware Network Cards

For a detailed explanation of network card types (NAT, Internal Network, Host-Only, Bridged) and their VMware equivalent, consult: 👉 Module 15 - Bonus: VirtualBox vs VMware Network Cards

Objective​

This TP aims to better understand the use of Netcat and SSH in a network environment, highlighting their differences in terms of security and features.

Guidelines​

  • Answer the questions while providing relevant screenshots with comments for each requested configuration step and obtained results.
  • Keep your virtual machines even after submitting this work.

Required Environment​

Hypervisor​

  • VirtualBox (or VMware Workstation / VMware Player)

Virtual Machines to Create​

MachineOperating SystemRAMDiskCPUNetwork
SSH-SRVUbuntu Server 24.04 LTS (or 22.04 LTS)1 GB minimum20 GB1 vCPUInternal network (intnet)
SSH-CLIUbuntu Server 24.04 LTS (or 22.04 LTS)1 GB minimum20 GB1 vCPUInternal network (intnet)
Network Configuration in VirtualBox

Both machines must be connected on the same internal network (Internal Network mode in VirtualBox, named for example intnet). Neither machine needs Internet access for this TP.

Required Software on the VMs​

  • openssh-server and openssh-client
  • netcat-openbsd (or ncat)
  • tcpdump
  • Wireshark (on the host machine or on a VM with a graphical interface to analyze .pcap captures)

Network Topology​

Setting Up the Environment​

Question 1 – Creating the Virtual Machines​

Create two virtual machines: SSH-SRV and SSH-CLI and configure them according to the topology above.

MachineRoleIP AddressMask
SSH-SRVNetcat / SSH Server10.11.12.1/24
SSH-CLINetcat / SSH Client10.11.12.2/24

Question 2 – Installing the SSH Service​

Install the SSH service (openssh-server) on the Linux server SSH-SRV.

sudo apt install -y openssh-server    # Ubuntu/Debian
# or
sudo dnf install -y openssh-server    # AlmaLinux/RHEL

Question 3 – Description of Netcat​

Briefly describe the Netcat tool.

Question 4 – Installing Netcat​

Install the Netcat tool on the Linux servers SSH-SRV and the Linux client SSH-CLI.

# AlmaLinux / RHEL
sudo dnf install -y nmap-ncat

# Ubuntu / Debian
sudo apt install -y netcat

First Part – Transfer with Netcat (Unencrypted)​

Question 5 – Network Traffic Capture​

Using the tcpdump command, capture the network traffic on the 10.11.12.1 interface using the command:

tcpdump -i <interface> -w capture1.pcap

Where <interface> is the communication interface between SSH-SRV and SSH-CLI.

Question 6 – Opening Netcat Communication​

Create a directory called rep on SSH-SRV then open a communication via Netcat and execute the command:

mkdir -p rep
cd rep
nc -l -p 64321 > tonfichier.txt

Question 7 – Sending the File from the Client​

The above command will allow the SSH-SRV server to wait for the client to open a connection to the server listening on port 64321. The file to be sent by the client to the server will be named monfichier.txt and will be copied under the name tonfichier.txt on the server once the transfer is completed.

You must first create the file monfichier.txt on SSH-CLI with some content (for example: "This is secret content").

The command to execute on the client machine SSH-CLI is:

nc 10.11.12.1 64321 < monfichier.txt

Question 8 – Stopping the Capture​

Stop the packet capture (Ctrl+C on the tcpdump terminal).

Question 9 – File Verification​

On SSH-SRV, verify that the content of the file tonfichier.txt is identical to that of monfichier.txt from the client.

cat tonfichier.txt

Question 10 – Analysis with Wireshark​

Open the file capture1.pcap using Wireshark (you can install it beforehand on SSH-SRV, otherwise you can transfer the capture from the VM to your PC).

# Installation of Wireshark (if necessary)
sudo apt install -y wireshark    # Ubuntu/Debian

Question 11 – Identification of the 3-way Handshake​

By analyzing the captured traffic, identify the segments ensuring the connection between the client and the server:

For this, use the Wireshark filter:

tcp.flags.syn == 1 || tcp.flags.ack == 1

Provide the numbers of the corresponding packets.

Question 12 – TCP Port of the Netcat Client​

What TCP port is used by the Netcat client?

Question 13 – Packet Number of the Transfer​

Identify the packet number allowing the transfer of the file monfichier.txt from the client.

Question 14 – Capture of Transferred Content​

Take a screenshot (on Wireshark) of the content of the transferred file.

Question 15 – Deduction​

What can be deduced?

Remember

With Netcat, data transits in clear on the network. Anyone capturing the traffic can read the content of the transferred file. This is where SSH comes into play to encrypt communications.

Second Part – Transfer via SSH Tunnel (Encrypted)​

Question 1 – Password Authentication​

Configure SSH client authentication by password.

Question 2 – Verification of Server Authenticity​

Verify the authenticity of the SSH server SSH-SRV. For this, you need to calculate the hash of the server's public key and compare it with the one proposed before deciding to connect to it.

# On SSH-SRV: display the public key fingerprint
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Question 3 – Key Authentication​

Configure SSH client authentication by key.

# On SSH-CLI: generate the key pair
ssh-keygen -t ed25519

# Copy the public key to the server
ssh-copy-id root@10.11.12.1

Question 4 – Network Traffic Capture (SSH Tunnel)​

Using the tcpdump command, capture the network traffic on the 10.11.12.1 interface using the command:

tcpdump -i <interface> -w capture2.pcap

Question 5 – Opening Netcat Communication on the Server​

In the rep directory on SSH-SRV, open a communication via Netcat and execute the command:

cd rep
nc -l -p 64321 > tonfichier2.txt

Question 6 – SSH Tunnel Configuration​

Configure the SSH tunnel for the server previously created by Netcat and the client. We will assume that the client chooses to connect on the local port 10111/TCP.

Execute (on the client) the following command:

ssh -L 10111:10.11.12.1:64321 root@10.11.12.1

Tunnel Explanation:

Question 7 – Sending the File via the Tunnel​

On a different terminal of the client, execute the command:

nc localhost 10111 < monfichier.txt

Question 8 – Stopping the Capture​

Stop the tcpdump capture of packets.

Question 9 – File Verification​

On SSH-SRV, verify that the content of the file tonfichier2.txt is identical to that of monfichier.txt from the client.

Question 10 – Analysis with Wireshark​

Open the file capture2.pcap using Wireshark.

Question 11 – Random Port of the Tunnel​

What is the random TCP port number used by the SSH client for Netcat tunneling?

Question 12 – Wireshark Filter with No Result​

Why does the following Wireshark filter return no result:

tcp.port == 64321 || tcp.port == 10111
Hint

Think about what the SSH tunnel does to ports and traffic. Are ports 64321 and 10111 visible on the network between the two machines?

Question 13 – Identification of Encrypted Transfer​

Can you identify the packet number used for the transfer of the file monfichier.txt? If so, can you capture the content of the transferred file?

Comparison: Netcat vs SSH Tunnel​

CriterionNetcat alone (Part 1)Netcat + SSH Tunnel (Part 2)
EncryptionNoneYes (SSH)
Port visible on the network6432122 (SSH only)
Content visible in WiresharkYes (in clear)No (encrypted)
AuthenticationNoneBy password or key
SecurityLowHigh

TP created on: February 2025