mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-15 09:27:32 +00:00
129 lines
5.8 KiB
Markdown
129 lines
5.8 KiB
Markdown
# 123/udp - Pentesting NTP
|
||
|
||
<details>
|
||
|
||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
Other ways to support HackTricks:
|
||
|
||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
Join [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) server to communicate with experienced hackers and bug bounty hunters!
|
||
|
||
**Hacking Insights**\
|
||
Engage with content that delves into the thrill and challenges of hacking
|
||
|
||
**Real-Time Hack News**\
|
||
Keep up-to-date with fast-paced hacking world through real-time news and insights
|
||
|
||
**Latest Announcements**\
|
||
Stay informed with the newest bug bounties launching and crucial platform updates
|
||
|
||
**Join us on** [**Discord**](https://discord.com/invite/N3FrSbmwdy) and start collaborating with top hackers today!
|
||
|
||
## Basic Information
|
||
|
||
The Network Time Protocol (**NTP**) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks.
|
||
|
||
**Default port:** 123/udp
|
||
|
||
```
|
||
PORT STATE SERVICE REASON
|
||
123/udp open ntp udp-response
|
||
```
|
||
|
||
## Enumeration
|
||
|
||
```bash
|
||
ntpq -c readlist <IP_ADDRESS>
|
||
ntpq -c readvar <IP_ADDRESS>
|
||
ntpq -c peers <IP_ADDRESS>
|
||
ntpq -c associations <IP_ADDRESS>
|
||
ntpdc -c monlist <IP_ADDRESS>
|
||
ntpdc -c listpeers <IP_ADDRESS>
|
||
ntpdc -c sysinfo <IP_ADDRESS>
|
||
```
|
||
|
||
```bash
|
||
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>
|
||
```
|
||
|
||
## Examine configuration files
|
||
|
||
* ntp.conf
|
||
|
||
## NTP Amplification Attack
|
||
|
||
[**How NTP DDoS Attack Works**](https://resources.infosecinstitute.com/network-time-protocol-ntp-threats-countermeasures/#gref)
|
||
|
||
NTP protocol by design uses UDP to operate, which does not require any handshake like TCP, thus no record of the request. So, NTP DDoS amplification attack begins when an attacker crafts packets with a spoofed source IP to make the packets appear to be coming from the intended target and sends them to NTP server. Attacker initially crafts the packet of few bytes, but NTP responds with a large amount of data thus adding to amplification of this attack.
|
||
|
||
_MONLIST command_: It is a NTP protocol command which has very little use, but it is this command which is the main culprit for this attack. However, the use of MONLIST command is to give details of the last 600 clients that have connected to the NTP time service. Below is the command syntax:
|
||
|
||
```bash
|
||
ntpdc -n -c monlist <IP>
|
||
```
|
||
|
||
## Shodan
|
||
|
||
* `ntp`
|
||
|
||
## HackTricks Automatic Commands
|
||
|
||
```
|
||
Protocol_Name: NTP #Protocol Abbreviation if there is one.
|
||
Port_Number: 123 #Comma separated if there is more than one.
|
||
Protocol_Description: Network Time Protocol #Protocol Abbreviation Spelled out
|
||
|
||
Entry_1:
|
||
Name: Notes
|
||
Description: Notes for NTP
|
||
Note: |
|
||
The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks.
|
||
|
||
https://book.hacktricks.xyz/pentesting/pentesting-ntp
|
||
|
||
Entry_2:
|
||
Name: Nmap
|
||
Description: Enumerate NTP
|
||
Command: nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 {IP}
|
||
```
|
||
|
||
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
Join [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) server to communicate with experienced hackers and bug bounty hunters!
|
||
|
||
**Hacking Insights**\
|
||
Engage with content that delves into the thrill and challenges of hacking
|
||
|
||
**Real-Time Hack News**\
|
||
Keep up-to-date with fast-paced hacking world through real-time news and insights
|
||
|
||
**Latest Announcements**\
|
||
Stay informed with the newest bug bounties launching and crucial platform updates
|
||
|
||
**Join us on** [**Discord**](https://discord.com/invite/N3FrSbmwdy) and start collaborating with top hackers today!
|
||
|
||
<details>
|
||
|
||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
Other ways to support HackTricks:
|
||
|
||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|