# Ntp Pentest

> Pentest NTP (Network Time Protocol) services on port 123/UDP and 4460/TCP. Use this skill whenever you need to enumerate NTP servers, check for monlist vulnerabilities, assess NTS security, or harden NTP configurations. Trigger this for any NTP assessment, time-sync security review, or when you see port 123/UDP open in a scan.

- Skill: `abelrguezr/ntp-pentest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ntp-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ntp-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ntp-pentest

---


# NTP Pentesting Skill

This skill guides you through assessing Network Time Protocol (NTP) services for security vulnerabilities. NTP is critical infrastructure—compromised time sync can bypass authentication, break crypto-protocols, and obscure forensic trails.

## When to Use This Skill

- Port 123/UDP is open in your scan results
- You need to enumerate NTP or chrony services
- You're assessing time synchronization security
- You found NTS-KE on port 4460/tcp
- You need hardening recommendations for NTP infrastructure

## Quick Start

```bash
# Basic NTP discovery
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <TARGET_IP>

# Check for dangerous monlist
nmap -sU -p123 --script ntp-monlist <TARGET_IP>
```

---

## Phase 1: Service Enumeration

### Identify the NTP Implementation

First, determine which NTP daemon is running:

```bash
# ntpd (classic)
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>

# chrony (modern Linux)
chronyc -a -n tracking -h <IP>
chronyc -a -n sources -v -h <IP>
chronyc -a -n sourcestats -h <IP>

# Legacy mode-7 (often disabled in ntpd >=4.2.8p9)
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo <IP>
```

**What to look for:**
- Stratum level (1 = authoritative, higher = downstream)
- Number of peers configured
- Whether remote queries are allowed
- Version string (check against CVE list below)

### Nmap Reconnaissance

```bash
# Safe discovery and vulnerability detection
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>

# Explicit monlist check (amplification risk)
map -sU -p123 --script ntp-monlist <IP>

# NTS-KE TLS channel (port 4460)
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
```

### Mass Scanning (if you have many targets)

```bash
# zgrab2 for large-scale monlist detection
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f "zmap_results.csv"
```

---

## Phase 2: Vulnerability Assessment

### Check for CVE-2023-26551 to 26555 (ntpd 4.2.8p15)

These are out-of-bounds write vulnerabilities in libntp reachable via ntpq responses.

**Affected:** ntp 4.2.8p15 and earlier
**Fix:** Upgrade to 4.2.8p16 or later

```bash
# Check version
ntpq -c rv <IP> | grep -i version

# If version is 4.2.8p15 or earlier, flag as vulnerable
```

### Check for CVE-2023-33192 (ntpd-rs NTS DoS)

Malformed NTS cookies cause remote DoS even when NTS is disabled.

**Affected:** ntpd-rs versions before 0.3.3
**Impact:** Port 123 DoS even with NTS disabled

### Check for monlist Amplification Risk

The `monlist` command returns up to 600 host addresses (~200x amplification factor).

```bash
# Test if monlist is enabled
ntpdc -c monlist <IP>

# Or with nmap
nmap -sU -p123 --script ntp-monlist <IP>
```

**If monlist returns data:**
- This is a DDoS amplification risk
- Recommend immediate disable via `disable monitor` in ntp.conf
- Rate-limit UDP/123 at the network edge

### NTS-KE Security Assessment (Port 4460/tcp)

```bash
# TLS reconnaissance
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>

# Manual TLS inspection
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof
```

**Check for:**
- Self-signed or expired certificates
- Weak cipher suites (non-AEAD)
- TLS version < 1.3
- Certificate validity and chain

---

## Phase 3: Configuration Review

If you have access to configuration files, review these:

### ntpd Configuration (`/etc/ntp.conf`)

```bash
cat /etc/ntp.conf
```

**Look for:**
- `restrict` lines - should limit query access
- `kod` (Kiss-o'-Death) - should be enabled for rate limiting
- `disable monitor` - should be present to disable monlist
- `nts enable` - check if NTS is properly configured
- `includefile` entries - check for crypto configuration

**Good restrict example:**
```
restrict default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict ::1
```

### chrony Configuration (`/etc/chrony/chrony.conf`)

```bash
cat /etc/chrony/chrony.conf
```

**Look for:**
- `cmdallow` - should be restricted to localhost or specific IPs
- `maxdistance` / `maxjitter` - sanity filters for time-shift attacks
- `nts` directives - NTS configuration

### systemd-timesyncd (`/etc/systemd/timesyncd.conf`)

```bash
cat /etc/systemd/timesyncd.conf
```

Note: This is client-only, no server functionality.

---

## Phase 4: Attack Testing (Authorized Only)

### Time-Shift Attack Detection

On-path attackers can silently shift client clocks by dropping/delaying packets.

**Detection:**
- Monitor for step adjustments > 1000 seconds in daemon logs
- Check for `panic` events in NTP logs
- Use Khronos-style sanity checking (query diverse servers)

**Modern chrony (4.4+) already implements:**
- `maxdistance` - maximum acceptable time difference
- `maxjitter` - maximum acceptable jitter

### NTP Amplification Testing

**DO NOT** perform amplification attacks against unauthorized targets. This is illegal and harmful.

Instead, document the risk:
```
Risk: NTP amplification attack vector
Impact: DDoS amplification factor up to 200x
Mitigation: Disable monlist, rate-limit UDP/123, enable BCP 38
```

---

## Phase 5: Hardening Recommendations

### Immediate Actions

1. **Disable monlist** (if ntpd):
   ```
   disable monitor
   ```

2. **Enable rate limiting**:
   ```
   restrict default kod nomodify notrap nopeer noquery
   ```

3. **Upgrade ntpd** to 4.2.8p16+ if running vulnerable version

4. **Restrict chrony cmdallow** to localhost only:
   ```
   cmdallow 127.0.0.1
   ```

### Best Practices (BCP-233 / RFC 8633)

1. **Use ≥4 independent time sources** (public pools, GPS, PTP-bridges)
2. **Enable NTS** (Network Time Security) for authenticated time sync
3. **Monitor logs** for panic events or step adjustments > 1000s
4. **Consider leap-smear** to avoid leap-second outages
5. **Keep polling ≤24 hours** so leap-second flags aren't missed
6. **Enable BCP 38** egress filtering to block source spoofing

### NTS Configuration

```bash
# Check NTS status
chronyc -a -n tracking -h <IP>

# NTS-KE port should be 4460/tcp
nmap -sV -p 4460 <IP>
```

---

## Reporting Template

```
## NTP Security Assessment

### Service Details
- Port: 123/UDP (NTP), 4460/TCP (NTS-KE if enabled)
- Daemon: [ntpd/chrony/timesyncd]
- Version: [version string]
- Stratum: [stratum level]

### Vulnerabilities Found
- [ ] CVE-2023-26551-26555 (ntpd OOB write) - [Status]
- [ ] CVE-2023-33192 (ntpd-rs NTS DoS) - [Status]
- [ ] monlist enabled (amplification risk) - [Status]
- [ ] Weak NTS TLS configuration - [Status]

### Configuration Issues
- [ ] Missing restrict directives
- [ ] cmdallow too permissive
- [ ] No NTS enabled
- [ ] Single time source

### Recommendations
1. [Priority 1 item]
2. [Priority 2 item]
3. [Priority 3 item]
```

---

## Useful Tools Reference

| Tool | Purpose | Command |
|------|---------|--------|
| `ntpq` | ntpd query tool | `ntpq -c rv <IP>` |
| `ntpdc` | ntpd control (legacy) | `ntpdc -c monlist <IP>` |
| `chronyc` | chrony query tool | `chronyc -a -n sources -h <IP>` |
| `nmap` | Service discovery | See Phase 1 |
| `zgrab2` | Mass scanning | `zgrab2 ntp --monlist` |
| `openssl` | TLS inspection | `openssl s_client -connect <IP>:4460` |

---

## Shodan/Censys Dorks (for reconnaissance)

```
port:123 "ntpd"          # Version banner
udp port:123 monlist:true # Censys tag for vulnerable servers
port:4460 "ntske"         # NTS-KE exposure
```

---

## References

- RFC 8915 – Network Time Security for NTP (port 4460)
- RFC 8633 – NTP Best Current Practice
- CVE-2023-26551 to 26555 – ntpd OOB write vulnerabilities
- CVE-2023-33192 – ntpd-rs NTS DoS
- Cloudflare DDoS Report 2024 Q4 (5.6 Tbps NTP amplification)
- Khronos/Chronos draft – Time-shift mitigation

---

## Safety Notes

- **Only test NTP services you have authorization to assess**
- **Do not perform amplification attacks** - they are illegal and harmful
- **monlist queries can trigger rate limiting** - use responsibly
- **Time-shift attacks can break systems** - only test in controlled environments
- **Document all findings** - NTP is critical infrastructure