1

I am trying to set up a vulnerable machine running freeSSHd 1.2.6. The Metasploit exploit module fails with the following error:

Server encryption_client preferences: aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,[email protected]
Client encryption_client preferences: aes256-ctr,aes192-ctr,aes128-ctr

Looking at a similar question and following this link I can see that one of the protocols (aes256-cbc) offered by the server, should be supported by the Metasploit SSH client. However, it doesn't offer it. Is there any setting I can change in Metasploit to make it offer aes256-cbc to the vulnerable SSH server?

1 Answer 1

1

Find file that you mentioned:

$ find /usr/share/metasploit-framework -type f -name algorithms.rb    
/usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/transport/algorithms.rb

Edit it and add cipher that you need, in DEFAULT_ALGORITHMS/encryption section:

DEFAULT_ALGORITHMS = {
  host_key: %w[[email protected]
               [email protected]
               [email protected]
               ecdsa-sha2-nistp521
               ecdsa-sha2-nistp384
               ecdsa-sha2-nistp256
               [email protected]
               [email protected]
               ssh-rsa],

  kex: %w[ecdh-sha2-nistp521
          ecdh-sha2-nistp384
          ecdh-sha2-nistp256
          diffie-hellman-group-exchange-sha256
          diffie-hellman-group14-sha1],



encryption: %w[aes256-ctr aes192-ctr aes128-ctr **aes256-cbc**],

Rerun msfconsole and now it should work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .