{"id":2710,"date":"2021-02-04T20:54:49","date_gmt":"2021-02-04T19:54:49","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2710"},"modified":"2021-02-04T21:54:55","modified_gmt":"2021-02-04T20:54:55","slug":"ike-internet-key-exchange","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2710","title":{"rendered":"<span class=\"caps\">IKE<\/span> Internet Key Exchange"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><span class=\"caps\">IKE<\/span> is used on <span class=\"caps\">VPN<\/span> servers on <span class=\"caps\">UDP<\/span> 500. Test a serv\u00ader&nbsp;with<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ike-scan -M $target<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Exam\u00adple output:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)\n\nEnding ike-scan 1.9.4: 1 hosts scanned in 0.039 seconds (25.32 hosts\/sec).  1 returned handshake; 0 returned notify<\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li><em><span class=\"caps\">PSK<\/span><\/em> means that a pre\u00adshared key is&nbsp;used.<\/li><li>1 returned hand\u00adshake, 0, returned noti\u00adfy means that the <span class=\"caps\">VPN<\/span> serv\u00ader is open for rene\u00adgo\u00adti\u00ada\u00adtion and some trans\u00adfor\u00adma\u00adtions start\u00ading with <strong><span class=\"caps\">VID<\/span><\/strong> should have been returned as&nbsp;well.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Brute force an <span class=\"caps\">ID<\/span>. Use the fol\u00adlow\u00ading bash line <a href=\"https:\/\/book.hacktricks.xyz\/pentesting\/ipsec-ike-vpn-pentesting\">with the file from Hacktricks:<\/a><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">while read line; do (echo \"Found ID: $line\" &amp;&amp; ike-scan -M -A -n $line 10.10.10.116) | grep -B14 \"1 returned handshake\" | grep \"Found ID:\"; done &lt; \/tmp\/list<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If this does\u00adn\u2019t work: Use <a href=\"https:\/\/github.com\/isaudits\/scripts\/blob\/master\/iker.py\">iker.py<\/a>: (\/tmp\/ip =&gt; File with tar\u00adget&nbsp;<span class=\"caps\">IP<\/span>.)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">python iker.py -i \/tmp\/ip -o \/tmp\/iker_output -v<\/pre>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"caps\">IKE<\/span> is used on <span class=\"caps\">VPN<\/span> servers on <span class=\"caps\">UDP<\/span> 500. Test a serv\u00ader&nbsp;with ike-scan \u2011M $tar\u00adget Exam\u00adple out\u00adput: <span class=\"caps\">SA<\/span>=(Enc=<span class=\"caps\">3DES<\/span> Hash=<span class=\"caps\">SHA1<\/span> Group=2:modp1024 Auth=<span class=\"caps\">PSK<\/span> LifeType=Seconds LifeDuration(4)=0x00007080) End\u00ading ike-scan 1.9.4: 1 hosts scanned in 0.039 sec\u00adonds (25.32 hosts\/sec). 1 returned hand\u00adshake; 0 returned noti\u00adfy <span class=\"caps\">PSK<\/span> means that a pre\u00adshared key is&nbsp;used. 1 returned hand\u00adshake, 0, returned noti\u00adfy means&nbsp;that&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[323],"tags":[324],"class_list":["post-2710","post","type-post","status-publish","format-standard","hentry","category-protocol","tag-ike"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2710"}],"version-history":[{"count":6,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2710\/revisions"}],"predecessor-version":[{"id":2718,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2710\/revisions\/2718"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}