| name | pentesting-ntp |
| description | Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements. |
| domain | cybersecurity |
| subdomain | network-services-pentesting |
| tags | ["penetration-testing","network-services","ntp"] |
| version | 1.0 |
| author | xalgorix |
| license | Apache-2.0 |
Pentesting NTP (port 123)
When to Use
- Default port
123/udp (data + legacy Mode-6/7 control); 4460/tcp for NTS-KE (RFC 8915, TLS 1.3 key establishment).
- When
nmap shows 123/udp open ntp udp-response.
- NTP syncs clocks for auth, crypto and logging — an attacker who influences NTP can bypass time-based controls or hinder forensics.
- Internet-facing NTP is a prime DDoS reflection/amplification source (the legacy
monlist query).
Quick Enumeration
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>
nmap -sU -p123 --script ntp-monlist <IP>
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo <IP>
chronyc -a -n tracking -h <IP>
chronyc -a -n sources -v -h <IP>
chronyc -a -n sourcestats -h <IP>
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f zmap_results.csv
Critical: Checks Most Often Missed
- Mode-7
monlist amplification — returns up to 600 host addresses; the reply (428-468 bytes/entry) is ~200x the 8-byte request, giving triple-digit amplification. Still present on thousands of hosts.
- Remote
ntpq/ntpdc query leakage — peers, associations and system variables disclose upstream servers and topology when noquery is not set.
- NTS-KE TLS weakness (4460/tcp) — self-signed/expired certs, non-AEAD cipher suites; CVE-2023-33192 (ntpd-rs) crashes on malformed NTS cookies even when NTS is disabled.
- Time-shift MITM — an on-path attacker can silently shift a client clock by dropping/delaying packets, even with authentication.
- Unpatched ntpd OOB-writes — CVE-2023-26551..26555 (libntp
mstolfp/praecis_parse) reachable via ntpq responses; fixed in 4.2.8p16.
How to CONFIRM
- monlist enabled:
ntpdc -c monlist <IP> returns a populated host list (not an empty/timeout), or nmap ntp-monlist reports entries; zgrab2 --monlist flags monlist:true.
- Query leakage:
ntpq -c peers <IP> / -c rv <IP> returns data from a remote (non-local) source.
- Weak NTS-KE:
openssl s_client on 4460 shows a self-signed/expired cert or weak (non-AEAD) ciphers.
- Amplification: measured response-size to request-size ratio >> 1 (monlist ~200x).
Workflow
Step 1: Enumerate
Confirm 123/udp is open and version it: nmap -sU -sV --script "ntp* and discovery" -p 123 <IP>. Note daemon (ntpd vs chrony vs ntpd-rs) and version for CVE mapping.
Step 2: Query / control access
Pull variables and peers with ntpq -c rv, -c peers, -c associations. Try legacy Mode-7 with ntpdc -c monlist/sysinfo. For chrony, test chronyc -a -n tracking -h <IP>.
Step 3: Exploit / Extract
- Confirm and document
monlist amplification (DoS/reflection surface — do not weaponize against third parties).
- Probe NTS-KE TLS on 4460:
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof
- Map version to known CVEs (ntpd OOB-write series, ntpd-rs NTS DoS).
Step 4: Post-access / pivot
Use disclosed upstream/peer servers and internal topology for further recon. In a lab/authorized MITM scenario, demonstrate clock-shift impact on time-based auth (Kerberos, TOTP, cert validity) — e.g. BetterCap set ntp.time.delta.
Key Concepts
| Concept | Description |
|---|
| Mode-6 / Mode-7 | Legacy control/query modes (ntpq/ntpdc); monlist is the abused Mode-7 query |
| monlist | Returns recent clients (up to 600) -> reflection/amplification vector |
| NTS / NTS-KE | Network Time Security; TLS 1.3 key-establishment on 4460/tcp (RFC 8915) |
| Kiss-o'-Death (kod) | Rate-limit response; restrict ... kod limited mitigates abuse |
| Time-shift attack | Drop/delay packets to move a client's clock and defeat time-based controls |
| Stratum | Distance from an authoritative reference clock |
Tools & Systems
| Tool | Purpose |
|---|
| nmap ntp- NSE* | Discovery, monlist, version, vuln detection |
| ntpq | Query variables/peers/associations (Mode-6) |
| ntpdc | Legacy Mode-7 control incl. monlist |
| chronyc | Remote monitoring of chrony (tracking/sources) |
| zgrab2 ntp | Mass scanning with JSON output incl. monlist flag |
| openssl s_client | NTS-KE TLS inspection on 4460 |
| BetterCap | NTP packet injection / time-shift MITM (lab) |
Common Scenarios
Scenario 1: Internet-facing monlist amplifier
An edge NTP server answers ntpdc -c monlist with 600 entries; it is usable as a high-ratio UDP reflection source and must have disable monitor set.
Scenario 2: Topology disclosure
ntpq -c peers <IP> from an external host returns upstream servers and internal peers, leaking infrastructure detail (no restrict ... noquery).
Scenario 3: NTS-KE DoS
A 4460/tcp listener runs an unpatched ntpd-rs (< 0.3.3); a malformed NTS cookie crashes the daemon (CVE-2023-33192).
Output Format
## NTP Finding
**Service**: NTP (123/udp) / NTS-KE (4460/tcp)
**Severity**: <High|Medium|Low>
**Target**: <IP>:123 Daemon/Version: <ntpd 4.2.8pX | chrony 4.x | ntpd-rs>
### Evidence
- monlist enabled: ntpdc -c monlist returned <N> hosts (amplification ~200x)
- Query leakage: ntpq -c peers disclosed upstream/internal peers
- NTS-KE: self-signed cert / non-AEAD ciphers on 4460
- Version maps to CVE-2023-26551..55 / CVE-2023-33192
### Reproduction
nmap -sU -p123 --script ntp-monlist <IP>
ntpq -c peers <IP>
### Recommendation
1. Add `disable monitor` (ntpd 4.2.8p15+) to kill monlist
2. Restrict with `restrict default noquery nomodify`, enable `kod`/`limited`
3. Enable BCP 38 egress filtering to stop source spoofing
4. Patch to ntpd 4.2.8p16 / current chrony; validate NTS-KE certs and ciphers
5. Use >= 4 diverse time sources to resist single-source poisoning
