Configure the Metasploit SSH client to support `aes256-cbc`

Question

I am trying to set up a vulnerable machine running freeSSHd 1.2.6. The Metasploit exploit module fails with the following error:

Server encryption_client preferences: aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se
Client encryption_client preferences: aes256-ctr,aes192-ctr,aes128-ctr

Looking at a similar question and following this link I can see that one of the protocols (aes256-cbc) offered by the server, should be supported by the Metasploit SSH client. However, it doesn't offer it. Is there any setting I can change in Metasploit to make it offer aes256-cbc to the vulnerable SSH server?

Answer 1

Find file that you mentioned:

$ find /usr/share/metasploit-framework -type f -name algorithms.rb    
/usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/transport/algorithms.rb

Edit it and add cipher that you need, in DEFAULT_ALGORITHMS/encryption section:

DEFAULT_ALGORITHMS = {
  host_key: %w[ecdsa-sha2-nistp521-cert-v01@openssh.com
               ecdsa-sha2-nistp384-cert-v01@openssh.com
               ecdsa-sha2-nistp256-cert-v01@openssh.com
               ecdsa-sha2-nistp521
               ecdsa-sha2-nistp384
               ecdsa-sha2-nistp256
               ssh-rsa-cert-v01@openssh.com
               ssh-rsa-cert-v00@openssh.com
               ssh-rsa],

  kex: %w[ecdh-sha2-nistp521
          ecdh-sha2-nistp384
          ecdh-sha2-nistp256
          diffie-hellman-group-exchange-sha256
          diffie-hellman-group14-sha1],



encryption: %w[aes256-ctr aes192-ctr aes128-ctr **aes256-cbc**],

Rerun msfconsole and now it should work.