IPSEC enumeration using Strongswan

Tue, 08 Mar 2022 00:00:00 +0000

VPN(IKE) enumeration Link to heading

isakmp service( port-500 related to ipsec VPN) only opened on server.There are some inbuilt scanners in Kali linux to enumerate IPSEC VPN

$ ike-scan -M 10.10.10.116 
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.10.116 Main Mode Handshake returned
 HDR=(CKY-R=8ec1706b5f6632a8)
 SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
 VID=1e2b516905991c7d7c96fcbfb587e46100000009 (Windows-8)
 VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T)
 VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n)
 VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation)
 VID=fb1de3cdf341b7ea16b7e5be0855f120 (MS-Negotiation Discovery Capable)
 VID=e3a5966a76379fe707228231e5ce8652 (IKE CGA version 1)

Ending ike-scan 1.9.4: 1 hosts scanned in 0.325 seconds (3.08 hosts/sec). 1 returned handshake; 0 returned notify

The tunnel uses IKE-V1 as per above results.To confirm its not running on IKE-V2

Hackthebox Conceal

Mon, 07 Mar 2022 00:00:00 +0000

Hackthebox Conceal Walkthrough Link to heading

Initial Enumeration Link to heading

Port Scan Link to heading

$ sudo nmap -sT -p- -min-rate 10000 -Pn -oN alltcp.txt 10.10.10.116
sudo nmap -sU -p- -min-rate 10000 -Pn -oN alludp.txt 10.10.10.116
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-27 19:46 EST
Nmap scan report for 10.10.10.116
Host is up.
All 65535 scanned ports on 10.10.10.116 are filtered

Nmap done: 1 IP address (1 host up) scanned in 130.18 seconds
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-27 19:48 EST
Nmap scan report for 10.10.10.116
Host is up (0.16s latency).
Not shown: 65534 open|filtered ports
PORT STATE SERVICE
500/udp open isakmp

Nmap done: 1 IP address (1 host up) scanned in 14.25 seconds