gabrielmoreira Pentesting NTP (port 123)
When to Use
- Default port
123/udp(data + legacy Mode-6/7 control);4460/tcpfor NTS-KE (RFC 8915, TLS 1.3 key establishment). - When
nmapshows123/udp open ntp udp-response. - NTP syncs clocks for auth, crypto and logging — an attacker who influences NTP can bypass time-based controls or hinder forensics.
- Internet-facing NTP is a prime DDoS reflection/amplification source (the legacy
monlistquery).
Quick Enumeration
# Safe discovery + vuln scripts (excludes dos/brute)
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>
# Explicit monlist amplification check
nmap -sU -p123 --script ntp-monlist <IP>
# Read server variables / peers / associations
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>
# Legacy Mode-7 control (often disabled >= 4.2.8p9)
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo <IP>
# chrony remote monitoring (only when cmdallow is enabled)
chronyc -a -n tracking -h <IP>
chronyc -a -n sources -v -h <IP>
chronyc -a -n sourcestats -h <IP>
# Mass scan for the monlist flag (zgrab2)
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f zmap_results.csv
Critical: Checks Most Often Missed
- Mode-7
monlistamplification — returns up to 600 host addresses; the reply (428-468 bytes/entry) is ~200x the 8-byte request, giving triple-digit amplification. Still present on thousands of hosts. - Remote
ntpq/ntpdcquery leakage — peers, associations and system variables disclose upstream servers and topology whennoqueryis not set. - NTS-KE TLS weakness (4460/tcp) — self-signed/expired certs, non-AEAD cipher suites; CVE-2023-33192 (ntpd-rs) crashes on malformed NTS cookies even when NTS is disabled.
- Time-shift MITM — an on-path attacker can silently shift a client clock by dropping/delaying packets, even with authentication.
- Unpatched ntpd OOB-writes — CVE-2023-26551..26555 (libntp
mstolfp/praecis_parse) reachable viantpqresponses; fixed in 4.2.8p16.
How to CONFIRM
- monlist enabled:
ntpdc -c monlist <IP>returns a populated host list (not an empty/timeout), ornmap ntp-monlistreports entries;zgrab2 --monlistflagsmonlist:true. - Query leakage:
ntpq -c peers <IP>/-c rv <IP>returns data from a remote (non-local) source. - Weak NTS-KE:
openssl s_clienton 4460 shows a self-signed/expired cert or weak (non-AEAD) ciphers. - Amplification: measured response-size to request-size ratio >> 1 (monlist ~200x).
Workflow
Step 1: Enumerate
Confirm 123/udp is open and version it: nmap -sU -sV --script "ntp* and discovery" -p 123 <IP>. Note daemon (ntpd vs chrony vs ntpd-rs) and version for CVE mapping.
Step 2: Query / control access
Pull variables and peers with ntpq -c rv, -c peers, -c associations. Try legacy Mode-7 with ntpdc -c monlist/sysinfo. For chrony, test chronyc -a -n tracking -h <IP>.
Step 3: Exploit / Extract
- Confirm and document
monlistamplification (DoS/reflection surface — do not weaponize against third parties). - Probe NTS-KE TLS on 4460:
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof
- Map version to known CVEs (ntpd OOB-write series, ntpd-rs NTS DoS).
Step 4: Post-access / pivot
Use disclosed upstream/peer servers and internal topology for further recon. In a lab/authorized MITM scenario, demonstrate clock-shift impact on time-based auth (Kerberos, TOTP, cert validity) — e.g. BetterCap set ntp.time.delta.
Key Concepts
| Concept | Description |
|---|---|
| Mode-6 / Mode-7 | Legacy control/query modes (ntpq/ntpdc); monlist is the abused Mode-7 query |
| monlist | Returns recent clients (up to 600) -> reflection/amplification vector |
| NTS / NTS-KE | Network Time Security; TLS 1.3 key-establishment on 4460/tcp (RFC 8915) |
| Kiss-o'-Death (kod) | Rate-limit response; restrict ... kod limited mitigates abuse |
| Time-shift attack | Drop/delay packets to move a client's clock and defeat time-based controls |
| Stratum | Distance from an authoritative reference clock |
Tools & Systems
| Tool | Purpose |
|---|---|
| nmap ntp- NSE* | Discovery, monlist, version, vuln detection |
| ntpq | Query variables/peers/associations (Mode-6) |
| ntpdc | Legacy Mode-7 control incl. monlist |
| chronyc | Remote monitoring of chrony (tracking/sources) |
| zgrab2 ntp | Mass scanning with JSON output incl. monlist flag |
| openssl s_client | NTS-KE TLS inspection on 4460 |
| BetterCap | NTP packet injection / time-shift MITM (lab) |
Common Scenarios
Scenario 1: Internet-facing monlist amplifier
An edge NTP server answers ntpdc -c monlist with 600 entries; it is usable as a high-ratio UDP reflection source and must have disable monitor set.
Scenario 2: Topology disclosure
ntpq -c peers <IP> from an external host returns upstream servers and internal peers, leaking infrastructure detail (no restrict ... noquery).
Scenario 3: NTS-KE DoS
A 4460/tcp listener runs an unpatched ntpd-rs (< 0.3.3); a malformed NTS cookie crashes the daemon (CVE-2023-33192).
Output Format
## NTP Finding
**Service**: NTP (123/udp) / NTS-KE (4460/tcp)
**Severity**: <High|Medium|Low>
**Target**: <IP>:123 Daemon/Version: <ntpd 4.2.8pX | chrony 4.x | ntpd-rs>
### Evidence
- monlist enabled: ntpdc -c monlist returned <N> hosts (amplification ~200x)
- Query leakage: ntpq -c peers disclosed upstream/internal peers
- NTS-KE: self-signed cert / non-AEAD ciphers on 4460
- Version maps to CVE-2023-26551..55 / CVE-2023-33192
### Reproduction
nmap -sU -p123 --script ntp-monlist <IP>
ntpq -c peers <IP>
### Recommendation
1. Add `disable monitor` (ntpd 4.2.8p15+) to kill monlist
2. Restrict with `restrict default noquery nomodify`, enable `kod`/`limited`
3. Enable BCP 38 egress filtering to stop source spoofing
4. Patch to ntpd 4.2.8p16 / current chrony; validate NTS-KE certs and ciphers
5. Use >= 4 diverse time sources to resist single-source poisoning