pentesting-ntp

Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ntp

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

# Safe discovery + vuln scripts (excludes dos/brute)
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>

# Explicit monlist amplification check
nmap -sU -p123 --script ntp-monlist <IP>

# Read server variables / peers / associations
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>

# Legacy Mode-7 control (often disabled >= 4.2.8p9)
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo  <IP>

# chrony remote monitoring (only when cmdallow is enabled)
chronyc -a -n tracking      -h <IP>
chronyc -a -n sources    -v -h <IP>
chronyc -a -n sourcestats   -h <IP>

# Mass scan for the monlist flag (zgrab2)
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f zmap_results.csv

nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof

Concept	Description
Mode-6 / Mode-7	Legacy control/query modes (`ntpq`/`ntpdc`); `monlist` is the abused Mode-7 query
monlist	Returns recent clients (up to 600) -> reflection/amplification vector
NTS / NTS-KE	Network Time Security; TLS 1.3 key-establishment on `4460/tcp` (RFC 8915)
Kiss-o'-Death (kod)	Rate-limit response; `restrict ... kod limited` mitigates abuse
Time-shift attack	Drop/delay packets to move a client's clock and defeat time-based controls
Stratum	Distance from an authoritative reference clock

Tool	Purpose
nmap ntp- NSE*	Discovery, monlist, version, vuln detection
ntpq	Query variables/peers/associations (Mode-6)
ntpdc	Legacy Mode-7 control incl. monlist
chronyc	Remote monitoring of chrony (tracking/sources)
zgrab2 ntp	Mass scanning with JSON output incl. monlist flag
openssl s_client	NTS-KE TLS inspection on 4460
BetterCap	NTP packet injection / time-shift MITM (lab)

## NTP Finding

**Service**: NTP (123/udp) / NTS-KE (4460/tcp)
**Severity**: <High|Medium|Low>
**Target**: <IP>:123  Daemon/Version: <ntpd 4.2.8pX | chrony 4.x | ntpd-rs>

### Evidence
- monlist enabled: ntpdc -c monlist returned <N> hosts (amplification ~200x)
- Query leakage: ntpq -c peers disclosed upstream/internal peers
- NTS-KE: self-signed cert / non-AEAD ciphers on 4460
- Version maps to CVE-2023-26551..55 / CVE-2023-33192

### Reproduction
nmap -sU -p123 --script ntp-monlist <IP>
ntpq -c peers <IP>

### Recommendation
1. Add `disable monitor` (ntpd 4.2.8p15+) to kill monlist
2. Restrict with `restrict default noquery nomodify`, enable `kod`/`limited`
3. Enable BCP 38 egress filtering to stop source spoofing
4. Patch to ntpd 4.2.8p16 / current chrony; validate NTS-KE certs and ciphers
5. Use >= 4 diverse time sources to resist single-source poisoning

name	pentesting-ntp
description	Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","ntp"]
version	1.0
author	xalgorix
license	Apache-2.0

name	pentesting-ntp
description	Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","ntp"]
version	1.0
author	xalgorix
license	Apache-2.0

pentesting-ntp

Install options

Review the source files

Pentesting NTP (port 123)

When to Use

Pentesting NTP (port 123)

When to Use

Quick Enumeration

Critical: Checks Most Often Missed

How to CONFIRM

Workflow

Step 1: Enumerate

Step 2: Query / control access

Step 3: Exploit / Extract

Step 4: Post-access / pivot

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Internet-facing monlist amplifier

Scenario 2: Topology disclosure

Scenario 3: NTS-KE DoS

Output Format

pentesting-ntp

Source facts

Install options

Review the source files

More from this repository

More from this repository

Pentesting NTP (port 123)

When to Use

Pentesting NTP (port 123)

When to Use

Quick Enumeration

Critical: Checks Most Often Missed

How to CONFIRM

Workflow

Step 1: Enumerate

Step 2: Query / control access

Step 3: Exploit / Extract

Step 4: Post-access / pivot

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Internet-facing monlist amplifier

Scenario 2: Topology disclosure

Scenario 3: NTS-KE DoS

Output Format