pentesting-ntp

name	pentesting-ntp
description	Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","ntp"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting NTP (port 123)

When to Use

• Default port 123/udp (data + legacy Mode-6/7 control); 4460/tcp for NTS-KE (RFC 8915, TLS 1.3 key establishment).
• When nmap shows 123/udp open ntp udp-response.
• NTP syncs clocks for auth, crypto and logging — an attacker who influences NTP can bypass time-based controls or hinder forensics.
• Internet-facing NTP is a prime DDoS reflection/amplification source (the legacy monlist query).

Quick Enumeration

# Safe discovery + vuln scripts (excludes dos/brute)
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>

# Explicit monlist amplification check
nmap -sU -p123 --script ntp-monlist <IP>

# Read server variables / peers / associations
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>

# Legacy Mode-7 control (often disabled >= 4.2.8p9)
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo  <IP>

# chrony remote monitoring (only when cmdallow is enabled)
chronyc -a -n tracking      -h <IP>
chronyc -a -n sources    -v -h <IP>
chronyc -a -n sourcestats   -h <IP>

# Mass scan for the monlist flag (zgrab2)
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f zmap_results.csv

Critical: Checks Most Often Missed

• Mode-7 monlist amplification — returns up to 600 host addresses; the reply (428-468 bytes/entry) is ~200x the 8-byte request, giving triple-digit amplification. Still present on thousands of hosts.
• Remote ntpq/ntpdc query leakage — peers, associations and system variables disclose upstream servers and topology when noquery is not set.
• NTS-KE TLS weakness (4460/tcp) — self-signed/expired certs, non-AEAD cipher suites; CVE-2023-33192 (ntpd-rs) crashes on malformed NTS cookies even when NTS is disabled.
• Time-shift MITM — an on-path attacker can silently shift a client clock by dropping/delaying packets, even with authentication.
• Unpatched ntpd OOB-writes — CVE-2023-26551..26555 (libntp mstolfp/praecis_parse) reachable via ntpq responses; fixed in 4.2.8p16.

How to CONFIRM

• monlist enabled: ntpdc -c monlist <IP> returns a populated host list (not an empty/timeout), or nmap ntp-monlist reports entries; zgrab2 --monlist flags monlist:true.
• Query leakage: ntpq -c peers <IP> / -c rv <IP> returns data from a remote (non-local) source.
• Weak NTS-KE: openssl s_client on 4460 shows a self-signed/expired cert or weak (non-AEAD) ciphers.
• Amplification: measured response-size to request-size ratio >> 1 (monlist ~200x).

Workflow

Step 1: Enumerate

Confirm 123/udp is open and version it: nmap -sU -sV --script "ntp* and discovery" -p 123 <IP>. Note daemon (ntpd vs chrony vs ntpd-rs) and version for CVE mapping.

Step 2: Query / control access

Pull variables and peers with ntpq -c rv, -c peers, -c associations. Try legacy Mode-7 with ntpdc -c monlist/sysinfo. For chrony, test chronyc -a -n tracking -h <IP>.

Step 3: Exploit / Extract

• Confirm and document monlist amplification (DoS/reflection surface — do not weaponize against third parties).
• Probe NTS-KE TLS on 4460:

nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof

• Map version to known CVEs (ntpd OOB-write series, ntpd-rs NTS DoS).

Step 4: Post-access / pivot

Use disclosed upstream/peer servers and internal topology for further recon. In a lab/authorized MITM scenario, demonstrate clock-shift impact on time-based auth (Kerberos, TOTP, cert validity) — e.g. BetterCap set ntp.time.delta.

Key Concepts

Concept	Description
Mode-6 / Mode-7	Legacy control/query modes (ntpq/ntpdc); monlist is the abused Mode-7 query
monlist	Returns recent clients (up to 600) -> reflection/amplification vector
NTS / NTS-KE	Network Time Security; TLS 1.3 key-establishment on 4460/tcp (RFC 8915)
Kiss-o'-Death (kod)	Rate-limit response; restrict ... kod limited mitigates abuse
Time-shift attack	Drop/delay packets to move a client's clock and defeat time-based controls
Stratum	Distance from an authoritative reference clock

Tools & Systems

Tool	Purpose
nmap ntp- NSE*	Discovery, monlist, version, vuln detection
ntpq	Query variables/peers/associations (Mode-6)
ntpdc	Legacy Mode-7 control incl. monlist
chronyc	Remote monitoring of chrony (tracking/sources)
zgrab2 ntp	Mass scanning with JSON output incl. monlist flag
openssl s_client	NTS-KE TLS inspection on 4460
BetterCap	NTP packet injection / time-shift MITM (lab)

Common Scenarios

Scenario 1: Internet-facing monlist amplifier

An edge NTP server answers ntpdc -c monlist with 600 entries; it is usable as a high-ratio UDP reflection source and must have disable monitor set.

Scenario 2: Topology disclosure

ntpq -c peers <IP> from an external host returns upstream servers and internal peers, leaking infrastructure detail (no restrict ... noquery).

Scenario 3: NTS-KE DoS

A 4460/tcp listener runs an unpatched ntpd-rs (< 0.3.3); a malformed NTS cookie crashes the daemon (CVE-2023-33192).

Output Format

## NTP Finding

**Service**: NTP (123/udp) / NTS-KE (4460/tcp)
**Severity**: <High|Medium|Low>
**Target**: <IP>:123  Daemon/Version: <ntpd 4.2.8pX | chrony 4.x | ntpd-rs>

### Evidence
- monlist enabled: ntpdc -c monlist returned <N> hosts (amplification ~200x)
- Query leakage: ntpq -c peers disclosed upstream/internal peers
- NTS-KE: self-signed cert / non-AEAD ciphers on 4460
- Version maps to CVE-2023-26551..55 / CVE-2023-33192

### Reproduction
nmap -sU -p123 --script ntp-monlist <IP>
ntpq -c peers <IP>

### Recommendation
1. Add `disable monitor` (ntpd 4.2.8p15+) to kill monlist
2. Restrict with `restrict default noquery nomodify`, enable `kod`/`limited`
3. Enable BCP 38 egress filtering to stop source spoofing
4. Patch to ntpd 4.2.8p16 / current chrony; validate NTS-KE certs and ciphers
5. Use >= 4 diverse time sources to resist single-source poisoning