# IKEv1 Aggressive Mode Enabled

- **URL:** https://hackindex.io/services/ike/vulnerability-discovery/ike-aggressive-mode-enabled
- **Path:** IKE > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ike/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

IKEv1 has two negotiation modes: Main Mode and Aggressive Mode. In Main Mode the identity of the initiating peer is encrypted before the PSK hash is exchanged. In Aggressive Mode the peer identity and the PSK hash are sent in the first two messages (before any encryption is established), exposing the hash to any passive observer or active initiator on the network.

If a gateway accepts Aggressive Mode connections, an unauthenticated attacker can initiate a handshake, receive the PSK hash in cleartext, and take it offline for cracking. No valid credentials are needed to capture the hash. This is one of the most consistently useful findings against legacy IPsec VPN deployments.

## Confirm Aggressive Mode is Accepted

Send an Aggressive Mode probe with ike-scan using the `--aggressive` flag:

```bash
sudo ike-scan --aggressive --id=$DOMAIN $TARGET_IP
# 10.10.10.5	Aggressive Mode Handshake returned
# 	HDR=(CKY-R=...)
# 	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
# 	KeyExchange(128 bytes)
# 	Nonce(20 bytes)
# 	ID(Type=ID_IPV4_ADDR, Value=10.10.10.5)
# 	Hash(20 bytes)
# 	VID=...
```

If the gateway accepts Aggressive Mode, it responds with a handshake that includes the hash.

`Aggressive Mode Handshake returned` with a `Hash` payload confirms the vulnerability. The hash value is embedded in that response.

If the gateway returns a `Notify` message instead, it rejected Aggressive Mode: check whether it accepts Main Mode only.

Try common peer identity formats if the domain does not elicit a response:

```bash
sudo ike-scan --aggressive --id=vpn $TARGET_IP
sudo ike-scan --aggressive --id=$TARGET_IP $TARGET_IP
sudo ike-scan --aggressive --id=0.0.0.0 $TARGET_IP
```

Some gateways require a specific peer ID that matches an expected group or username. Try common values:

```bash
for id in vpn ipsec cisco remote group1 groupvpn; do
  result=$(sudo ike-scan --aggressive --id=$id $TARGET_IP 2>/dev/null)
  if echo "$result" | grep -q "Aggressive Mode Handshake returned"; then
    echo "ACCEPTED with ID: $id"
  fi
done
```

## Confirm the Hash is Capturable

A `Hash` payload in the response confirms the PSK hash was transmitted. This is the value you crack in [IKEv1 Aggressive Mode PSK Capture and Cracking](https://hackindex.io/services/ike/exploitation/ike-aggressive-mode-psk-capture).

Document the finding as:

- IKEv1 Aggressive Mode accepted without authentication
- PSK hash exposed in unauthenticated handshake response
- Hash value available for offline cracking
- Transform set used (encryption/hash algorithm)
- Peer identity accepted

## Why This Is a Vulnerability

In Main Mode, identity protection prevents an unauthenticated initiator from receiving the hash. Aggressive Mode removes that protection by design to reduce the number of round trips. On most modern deployments Aggressive Mode serves no operational purpose and should be disabled, but it frequently appears on legacy Cisco VPN concentrators, older ASA configurations, and appliances with default settings.

The hash captured here is an IKEv1 PSK hash (hashcat mode 5300 when MD5 was negotiated, mode 5400 when SHA1 was negotiated (independent of Main vs Aggressive Mode)). Cracking is covered in the exploitation phase.