312-50 Question 100
Single answer▪ Other Enumeration Techniques (IPsec, VoIP, RPC,During an authorized internal assessment, you discover that several Linux and Windows servers respond on UDP 500 and UDP 4500. The client wants to know whether these hosts are using weak IPsec configurations before moving to certificate-based authentication. You need a safe enumeration approach that identifies supported IKE transforms and detects whether a pre-shared key appears guessable, without attempting full exploitation or disrupting service. Which action is the MOST appropriate?
- A
Use ike-scan against the hosts to enumerate IKE/IPsec proposals and perform an offline pre-shared key cracking attempt only if an Aggressive Mode handshake is captured
- B
Use rpcclient to query the hosts for IKE policy details because RPC commonly exposes IPsec transform settings on both Linux and Windows systems
- C
Use svwar to enumerate SIP extensions because VoIP enumeration reveals whether IPsec tunnels are using weak Diffie-Hellman groups
- D
Run a UDP port scan and conclude that any host with UDP 500 open is using strong IPsec because modern systems disable weak transforms by default
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a protocol-aware IPsec enumeration method such as ike-scan. In a CEH-style assessment scenario, the goal is to safely identify supported IKE/IPsec parameters and assess whether a pre-shared key deployment is exposed to offline guessing risks. ike-scan is designed for this purpose and is commonly used to enumerate IKEv1 responders on UDP 500; UDP 4500 additionally indicates possible NAT Traversal support. A key practical point is that IKEv1 Aggressive Mode can expose enough information for offline PSK cracking, whereas simply seeing the port open does not provide assurance about the strength of the configuration. By contrast, rpcclient targets Microsoft RPC/SMB enumeration, and svwar targets SIP/VoIP extension enumeration, so neither is suitable for enumerating IPsec transform sets. This aligns with vendor and standards guidance that discourage IKEv1 Aggressive Mode and weak PSKs, and prefer stronger configurations such as certificates or modern IKEv2 deployments. Relevant references include the ike-scan tool documentation, RFC 2409 for IKEv1, RFC 3947/RFC 3948 for NAT Traversal, and current best-practice guidance from VPN vendors and standards bodies recommending stronger authentication and avoidance of weak legacy proposals.
- A. Correct.
Correct. ike-scan is a well-known tool for enumerating IKE/IPsec VPN endpoints. It can identify supported proposals such as encryption, hash, authentication, and Diffie-Hellman parameters by analyzing IKE responses. In environments using IKEv1 Aggressive Mode with pre-shared keys, the handshake can leak enough material to permit offline password guessing against the PSK hash without repeatedly interacting with the gateway. This makes it an appropriate enumeration-focused technique when performed under authorization and with care. The option is also realistic because it distinguishes enumeration from active exploitation and avoids unnecessary service disruption.
- B. Incorrect.
Incorrect. rpcclient is used for interacting with SMB/RPC services, particularly in Windows environments, to enumerate users, shares, domain information, and related data. It is not a general-purpose method for querying IKE/IPsec transform settings from Linux and Windows hosts. A candidate might choose this because RPC is an enumeration topic in CEH, but RPC enumeration is unrelated to extracting IPsec proposal details from UDP 500/4500 listeners.
- C. Incorrect.
Incorrect. svwar is associated with SIP/VoIP enumeration, typically used to probe SIP extensions on VoIP systems. SIP enumeration does not reveal the cryptographic configuration of IPsec tunnels. This distractor is plausible because VoIP and IPsec can coexist in enterprise networks, and SIP may sometimes be protected by IPsec, but enumerating extensions does not tell you which IKE transforms or Diffie-Hellman groups the IPsec service supports.
- D. Incorrect.
Incorrect. An open UDP 500 port indicates that IKE may be available, and UDP 4500 often suggests NAT-T support, but port state alone does not prove that the configuration is strong. Weak proposals, older IKEv1 settings, or Aggressive Mode may still be enabled. The misconception here is assuming secure defaults across all deployed systems; in practice, administrators may retain legacy-compatible settings that should be verified through protocol-aware enumeration.