Pentesting VPN's ike-scan

Saturday, July 11, 2020

Pentesting VPN's ike-scan

Often during a pentest we may encounter VPN endpoints. However, finding vulnerabilities in those endpoints and exploiting them is not a well known method. VPN endpoints use Internet Key Exchange (IKE) protocol to set up a security association between multiple clients to establish a VPN tunnel.

IKE has two phases, phase 1 is responsible for setting up and establishing secure authenticated communication channel, and phase 2 encrypts and transports data.

Our focus of interest here would be phase 1; it uses two methods of exchanging keys:

Main mode
Aggressive mode

We will hunt for aggressive mode enabled VPN endpoints using PSK authentication.

Getting ready

For this recipe we will use the tools ike-scan and ikeprobe. First we install ike-scan by cloning the git repository:

git clone https://github.com/royhills/ike-scan.git

Or you can use the following URL to download it from https://github.com/royhills/ike-scan.

How to do it...

To configure ike-scan follow the given steps:

Browse to the directory where ike-scan is installed.
Install autoconf by running the following command:

        apt-get install autoconf

Run autoreconf --install to generate a .configure file.
Run ./configure.
Run make to build the project.
Run make check to verify the building stage.
Run make install to install ike-scan.
To scan a host for an aggressive mode handshake, use the following commands:

        ike-scan x.x.x.x -M -A

The following screenshot shows the output for the preceding command:

Sometimes we will see the response after providing a valid group name like (vpn):

        ike-scan x.x.x.x -M -A id=vpn

The following screenshot shows the example of the preceding command:

Note

We can even brute force the groupnames using the following script:https://github.com/SpiderLabs/groupenum.https://github.com/SpiderLabs/groupenum The command:./dt_group_enum.sh x.x.x.x groupnames.dic

Cracking the PSK

To learn how to crack the PSK follow the given steps:

Adding a -P flag in the ike-scan command it will show a response with the captured hash.
To save the hash we provide a filename along with the -P flag.
Next we can use the psk-crack with the following command:

        psk-crack -b 5 /path/to/pskkey

Where -b is brute force mode and length is 5.
To use a dictionary based attack we use the following command:

        psk-crack -d /path/to/dictionary /path/to/pskkey

The following screenshot shows the output for the preceding command:

How it works...

In aggressive mode the authentication hash is transmitted as a response to the packet of the VPN client that tries to establish a connection Tunnel (IPSEC). This hash is not encrypted and hence it allows us to capture the hash and perform a brute force attack against it to recover our PSK.

This is not possible in main mode as it uses an encrypted hash along with a six way handshake, whereas aggressive mode uses only three way.

Subscribe to Posts | Subscribe to Comments

Rasi Tech

Buat Kenangan