Skip to content

Commit 0289c89

Browse files
author
HackTricks News Bot
committed
Add content from: Research Update: Enhanced src/network-services-pentesting/pe...
1 parent 7b9163b commit 0289c89

1 file changed

Lines changed: 142 additions & 31 deletions

File tree

‎src/network-services-pentesting/pentesting-ntp.md‎

Lines changed: 142 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,66 +4,169 @@
44

55
## Basic Information
66

7-
The **Network Time Protocol (NTP)** ensures computers and network devices across variable-latency networks sync their clocks accurately. It's vital for maintaining precise timekeeping in IT operations, security, and logging. NTP's accuracy is essential, but it also poses security risks if not properly managed.
7+
The **Network Time Protocol (NTP)** ensures computers and network devices across variable-latency networks sync their clocks accurately. It's vital for maintaining precise timekeeping in IT operations, security, and logging. Because time is used in nearly every authentication, crypto-protocol and forensic process, **an attacker that can influence NTP can often bypass security controls or make attacks harder to investigate.**
88

9-
### Summary & Security Tips:
9+
### Summary & Security Tips
1010

1111
- **Purpose**: Syncs device clocks over networks.
12-
- **Importance**: Critical for security, logging, and operations.
12+
- **Importance**: Critical for security, logging, crypto-protocols and distributed systems.
1313
- **Security Measures**:
14-
- Use trusted NTP sources with authentication.
15-
- Limit NTP server network access.
16-
- Monitor synchronization for signs of tampering.
14+
- Use trusted NTP or NTS (Network Time Security) sources with authentication.
15+
- Restrict who can query/command the daemon (``restrict default noquery``, ``kod`` etc.).
16+
- Disable legacy Mode-6/7 control queries (``monlist``, ``ntpdc``) or rate-limit them.
17+
- Monitor synchronization drift/leap-second state for tampering.
18+
- Keep the daemon updated (see recent CVEs below).
1719

18-
**Default port:** 123/udp
20+
**Default ports**
21+
22+
```
23+
123/udp NTP (data + legacy control)
24+
4460/tcp NTS-KE (RFC 8915) – TLS key-establishment for NTP
25+
```
1926

2027
```
2128
PORT STATE SERVICE REASON
2229
123/udp open ntp udp-response
2330
```
2431

32+
---
2533
## Enumeration
2634

35+
### Classic ntpd / ntpq / ntpdc
36+
37+
```bash
38+
# Information & variables
39+
ntpq -c rv <IP>
40+
ntpq -c readvar <IP>
41+
ntpq -c peers <IP>
42+
ntpq -c associations <IP>
43+
44+
# Legacy mode-7 (often disabled >=4.2.8p9)
45+
ntpdc -c monlist <IP>
46+
ntpdc -c listpeers <IP>
47+
ntpdc -c sysinfo <IP>
48+
```
49+
50+
### chrony / chronyc (in most modern Linux distros)
51+
52+
Only a handful of monitoring commands are accepted from remote IPs when ``cmdallow`` is enabled:
53+
2754
```bash
28-
ntpq -c readlist <IP_ADDRESS>
29-
ntpq -c readvar <IP_ADDRESS>
30-
ntpq -c peers <IP_ADDRESS>
31-
ntpq -c associations <IP_ADDRESS>
32-
ntpdc -c monlist <IP_ADDRESS>
33-
ntpdc -c listpeers <IP_ADDRESS>
34-
ntpdc -c sysinfo <IP_ADDRESS>
55+
chronyc -a -n tracking -h <IP>
56+
chronyc -a -n sources -v -h <IP>
57+
chronyc -a -n sourcestats -h <IP>
3558
```
3659

60+
See the chronyc man page for the meaning of the **M/S** flags and other fields (stratum, reach, jitter, etc.).
61+
62+
### Nmap
63+
3764
```bash
65+
# Safe discovery & vuln detection
3866
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>
67+
68+
# Explicit monlist check
69+
nmap -sU -p123 --script ntp-monlist <IP>
70+
```
71+
72+
### Mass/Internet scanning
73+
74+
```bash
75+
# Check if MONLIST is enabled (zgrab2 module)
76+
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f "zmap_results.csv"
3977
```
4078

79+
---
4180
## Examine configuration files
4281

43-
- ntp.conf
82+
- ``/etc/ntp.conf`` (ntpd)
83+
- ``/etc/chrony/chrony.conf`` (chrony)
84+
- ``/etc/systemd/timesyncd.conf`` (timesyncd – client only)
85+
86+
Pay special attention to ``restrict`` lines, ``kod`` (Kiss-o'-Death) settings, ``disable monitor``/``includefile /etc/ntp/crypto`` and whether *NTS* is enabled (``nts enable``).
87+
88+
---
89+
## Recent Vulnerabilities (2023-2025)
90+
91+
| Year | CVE | Component | Impact |
92+
|------|-----|-----------|--------|
93+
| 2023 | **CVE-2023-26551→26555** | ntp 4.2.8p15 (libntp *mstolfp*, *praecis_parse*) | Multiple out-of-bounds writes reachable via **ntpq** responses. Patch in **4.2.8p16** 🡒 upgrade or back-port fixes. citeturn1search1turn1search2turn1search0|
94+
| 2023 | **CVE-2023-33192** | **ntpd-rs** (Rust implementation) | Malformed **NTS** cookie causes remote **DoS** prior to v0.3.3 – affects port 123 even when NTS **disabled**. citeturn4view0|
95+
| 2024 | distro updates | **chrony 4.4 / 4.5** – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022) citeturn2search2|
96+
| 2024 | Record DDoS | Cloudflare reports a **5.6 Tbps UDP reflection** attack (NTP among protocols used). Keep *monitor* & *monlist* disabled on Internet-facing hosts. citeturn5search0|
97+
98+
> **Exploit kits**: Proof-of-concept payloads for the 2023 ntpq OOB-write series are on GitHub (see Meinberg write-up) and can be weaponised for client-side phishing of sysadmins. citeturn1search4
4499
45-
## NTP Amplification Attack
100+
---
101+
## Advanced Attacks
46102

47-
[**How NTP DDoS Attack Works**](https://resources.infosecinstitute.com/network-time-protocol-ntp-threats-countermeasures/#gref)
103+
### 1. NTP Amplification / Reflection
48104

49-
The **NTP protocol**, using UDP, allows for operation without the need for handshake procedures, unlike TCP. This characteristic is exploited in **NTP DDoS amplification attacks**. Here, attackers create packets with a fake source IP, making it seem as if the attack requests come from the victim. These packets, initially small, prompt the NTP server to respond with much larger data volumes, amplifying the attack.
105+
The legacy Mode-7 ``monlist`` query returns up to **600 host addresses** and is still present on thousands of Internet hosts. Because the reply (428-468 bytes/entry) is *~ 200×* larger than the 8-byte request, an attacker can reach triple-digit amplification factors. Mitigations:
50106

51-
The _**MONLIST**_ command, despite its rare use, can report the last 600 clients connected to the NTP service. While the command itself is simple, its misuse in such attacks highlights critical security vulnerabilities.
107+
- Upgrade to ntp 4.2.8p15+ and **add** ``disable monitor``.
108+
- Rate-limit UDP/123 on the edge or enable *sessions-required* on DDoS appliances.
109+
- Enable *BCP 38* egress filtering to block source spoofing.
110+
111+
See Cloudflare’s learning-center article for a step-by-step breakdown. citeturn5search1
112+
113+
### 2. Time-Shift / Delay attacks (Khronos / Chronos research)
114+
115+
Even with authentication, an on-path attacker can silently **shift the client clock** by dropping/delaying packets. The IETF **Khronos (formerly Chronos) draft** proposes querying a diverse set of servers in the background and sanity-checking the result to detect a shift > 𝚡 ms. Modern chrony (4.4+) already implements a similar sanity filter (``maxdistance`` / ``maxjitter``). citeturn9search1
116+
117+
### 3. NTS abuse & 4460/tcp exposure
118+
119+
NTS moves the heavy crypto to a separate **TLS 1.3 channel on 4460/tcp** (``ntske/1``). Poor implementations (see CVE-2023-33192) crash when parsing cookies or allow weak ciphers. Pentesters should:
52120

53121
```bash
54-
ntpdc -n -c monlist <IP>
122+
# TLS reconnaissance
123+
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
124+
125+
# Grab banner & ALPN
126+
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof
127+
```
128+
129+
Look for self-signed or expired certificates and weak cipher-suites (non-AEAD). Reference: RFC 8915 §4. citeturn11search0
130+
131+
---
132+
## Hardening / Best-Current-Practice (BCP-233 / RFC 8633)
133+
134+
*Operators SHOULD:*
135+
136+
1. Use **≥ 4** independent, diverse time sources (public pools, GPS, PTP-bridges) to avoid single-source poisoning.
137+
2. Enable ``kod`` and ``limited``/``nomodify`` restrictions so abusive clients receive **Kiss-o'-Death** rate-limit packets instead of full responses.
138+
3. Monitor daemon logs for **panic** events or step adjustments > 1000 s. (Signatures of attack per RFC 8633 §5.3.)
139+
4. Consider **leap-smear** to avoid leap-second outages, but ensure *all* downstream clients use the same smear window.
140+
5. Keep polling ≤24 h so leap-second flags are not missed.
141+
142+
See RFC 8633 for a comprehensive checklist. citeturn8search0turn8search1
143+
144+
---
145+
## Shodan / Censys Dorks
146+
147+
```
148+
port:123 "ntpd" # Version banner
149+
udp port:123 monlist:true # Censys tag for vulnerable servers
150+
port:4460 "ntske" # NTS-KE
55151
```
56152

57-
## Shodan
153+
---
154+
## Useful Tools
58155

59-
- `ntp`
156+
| Tool | Purpose | Example |
157+
|------|---------|---------|
158+
| ``ntpwn`` | Script-kiddie wrapper to spray monlist & peers queries | ``python ntpwn.py --monlist targets.txt`` |
159+
| **zgrab2 ntp** | Mass scanning / JSON output including monlist flag | See command above |
160+
| ``chronyd`` with ``allow`` | Run rogue NTP server in pentest lab | ``chronyd -q 'server 127.127.1.0 iburst'`` |
161+
| ``BetterCap`` | Inject NTP packets for time-shift MITM on Wi-Fi | ``set arp.spoof.targets <victim>; set ntp.time.delta 30s; arp.spoof on`` |
60162

163+
---
61164
## HackTricks Automatic Commands
62165

63166
```
64-
Protocol_Name: NTP #Protocol Abbreviation if there is one.
65-
Port_Number: 123 #Comma separated if there is more than one.
66-
Protocol_Description: Network Time Protocol #Protocol Abbreviation Spelled out
167+
Protocol_Name: NTP
168+
Port_Number: 123
169+
Protocol_Description: Network Time Protocol
67170
68171
Entry_1:
69172
Name: Notes
@@ -79,9 +182,17 @@ Entry_2:
79182
Command: nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 {IP}
80183
```
81184

82-
​
83-
84-
{{#include ../banners/hacktricks-training.md}}
85-
86-
87-
185+
---
186+
## References
187+
188+
- RFC 8915 – *Network Time Security for the Network Time Protocol* (port 4460) citeturn11search0
189+
- RFC 8633 – *Network Time Protocol BCP* citeturn8search0
190+
- Cloudflare DDoS report 2024 Q4 (5.6 Tbps) citeturn5search0
191+
- Cloudflare *NTP Amplification Attack* article citeturn5search1
192+
- NTP 4.2.8p15 CVE series 2023-04 citeturn1search4
193+
- NVD entries **CVE-2023-26551–55**, **CVE-2023-33192** citeturn1search1turn1search2turn1search0turn4view0
194+
- SUSE chrony security update 2024 (chrony 4.5) citeturn2search2
195+
- Khronos/Chronos draft (time-shift mitigation) citeturn9search1
196+
- chronyc manual/examples for remote monitoring citeturn3search0turn10search1
197+
- zgrab2 ntp module docs citeturn7search0
198+
{{#include /banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)