Home

Awesome

This project is no longer maintained

IKEForce
Dan Turner dturner@trustwave.com
http://www.spiderlabs.com

INTRODUCTION

IKEForce is a command line IPSEC VPN brute forcing tool for Linux that allows group name/ID enumeration and XAUTH brute forcing capabilities.
Guides can be found here:

INSTALL

Requires the pyip, pycrypto and pyopenssl modules installed, but other than that it's only standard libs. pyip is the most likely lib that you won't have, install it with 'pip install pyip'

USAGE

./ikeforce.py [target] [mode] -w /path-to/wordlist.txt [optional] -t 5 1 1 2

Example (find all AM transforms):
./ikeforce.py 192.168.1.110 -a -s 1

Example (enum mode):
./ikeforce.py 192.168.1.110 -e -w groupnames.txt -s 1

Example (brute mode):
./ikeforce.py 192.168.1.110 -b -i groupid -u dan -k psk123 -w passwords.txt -s 1

Options:

-h, --help
					show this help message and exit 
-w WORDLIST, --wordlist=WORDLIST
					Path to wordlist file                
-t TRANS, --trans=TRANS
					[OPTIONAL] Transform set: encryption type, hash type, authentication type, dh group (5 1 1 2)	
-e, --enum
					Set Enumeration Mode
-a, --all
					Set Transform Set Enumeration Mode
-b, --brute
					Set XAUTH Brute Force Mode
-k PSK, --psk=PSK
					Pre Shared Key to be used with Brute Force Mode
-i ID, --id=ID
					ID or group name. To be used with Brute Force Mode
-u USERNAME, --username=USERNAME
					XAUTH username to be used with Brute Force Mode
-U USERLIST, --userlist=USERLIST
                    [OPTIONAL] XAUTH username list to be used with Brute Force Mode
-p PASSWORD, --password=PASSWORD
                    XAUTH password to be used with Connect Mode
--sport=SPORT
					Source port to use, default is 500
-d, --debug
					Set debug on
-c, --connect
					Set Connect Mode (test a connection)
-y IDTYPE, --idtype=IDTYPE
						[OPTIONAL] ID Type for Identification payload. Default
                    is 2 (FQDN)
-s SPEED, --speed=SPEED
                    [OPTIONAL] Speed of guessing attempts. A numerical
                    value between 1 - 5 where 1 is faster and 5 is slow.
                    Default is 3
-l KEYLEN, --keylen=KEYLEN
                    [OPTIONAL] Key Length, for use with AES encryption
                    types
-v VENDOR, --vendor=VENDOR
                    [OPTIONAL] Vendor Type (cisco or watchguard currently
                    accepted)
--version=VERSION     [OPTIONAL] IKE verison (default verison 1)

Transform Set Helper (Non-exhautive):

Enc Type (1)Hash Type (2)Auth Type (3)DH Group (4)
1 = DES1 = HMAC-MD51 = PSK1 = 768-bit MODP group
2 = IDEA2 = HMAC-SHA2 = DSS-Sig2 = 1024-bit MODP group
3 = Blowfish3 = TIGER3 = RSA-Sig3 = EC2N group on GP[2^155]
4 = RC5-R16-B644 = SHA2-2564 = RSA-Enc4 = EC2N group on GP[2^185]
5 = 3DES5 = SHA2-3845 = Revised RSA-Sig5 = 1536-bit MODP group
6 = CAST6 = SHA2-51264221 = Hybrid Mode
7 = AES65001 = XAUTHInitPreShared

Have a look at the ike-scan User Guide for more values.

Version 0.1