Skip to content

Commit a5e9abc

Browse files
jhart-r7jhart-r7
committed
Update R7-2014-12 NTP modules to use new DRDoS mixin
1 parent ddcaa11 commit a5e9abc

File tree

5 files changed

+97
-44
lines changed

5 files changed

+97
-44
lines changed

‎modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ class Metasploit3 < Msf::Auxiliary
1111
include Msf::Exploit::Remote::Udp
1212
include Msf::Auxiliary::UDPScanner
1313
include Msf::Auxiliary::NTP
14+
include Msf::Auxiliary::DRDoS
1415

1516
def initialize
1617
super(
17-
'Name' => 'NTP PEER_LIST DoS Scanner',
18+
'Name' => 'NTP Mode 7 PEER_LIST DoS Scanner',
1819
'Description' => %q{
1920
This module identifies NTP servers which permit "PEER_LIST" queries and
2021
return responses that are larger in size or greater in quantity than
@@ -31,29 +32,13 @@ def initialize
3132

3233
# Called for each IP in the batch
3334
def scan_host(ip)
34-
@probes.each do |probe|
35-
scanner_send(probe, ip, datastore['RPORT'])
36-
end
35+
scanner_send(@probe, ip, datastore['RPORT'])
3736
end
3837

3938
# Called before the scan block
4039
def scanner_prescan(batch)
41-
# build a probe for all possible variations of the PEER_LIST request, which
42-
# means using all combinations of NTP version, mode 7 implementations and
43-
# with and without payloads.
44-
@probes = []
45-
versions = datastore['VERSIONS'].split(/,/).map { |v| v.strip.to_i }
46-
implementations = datastore['IMPLEMENTATIONS'].split(/,/).map { |i| i.strip.to_i }
47-
payloads = ['', "\x00"*40]
48-
versions.each do |v|
49-
implementations.each do |i|
50-
payloads.each do |p|
51-
@probes << Rex::Proto::NTP.ntp_private(v, i, 0, p)
52-
end
53-
end
54-
end
5540
@results = {}
56-
vprint_status("Sending #{@probes.size} NTP PEER_LIST probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
41+
@probe = Rex::Proto::NTP.ntp_private(2, 3, 0)
5742
end
5843

5944
# Called for each response packet
@@ -65,14 +50,30 @@ def scanner_process(data, shost, sport)
6550
# Called after the scan block
6651
def scanner_postscan(batch)
6752
@results.keys.each do |k|
68-
packets = @results[k]
53+
response_map = { @probe => @results[k] }
6954
# TODO: check to see if any of the responses are actually NTP before reporting
7055
report_service(
7156
:host => k,
7257
:proto => 'udp',
7358
:port => rport,
7459
:name => 'ntp'
7560
)
61+
62+
peer = "#{k}:#{rport}"
63+
vulnerable, proof = prove_drdos(response_map)
64+
what = 'R7-2014-12 NTP Mode 7 PEER_LIST DRDoS'
65+
if vulnerable
66+
print_good("#{peer} - Vulnerable to #{what}: #{proof}")
67+
report_vuln({
68+
:host => k,
69+
:port => rport,
70+
:proto => 'udp',
71+
:name => what,
72+
:refs => self.references
73+
})
74+
else
75+
vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}")
76+
end
7677
end
7778
end
7879
end

‎modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ class Metasploit3 < Msf::Auxiliary
1111
include Msf::Exploit::Remote::Udp
1212
include Msf::Auxiliary::UDPScanner
1313
include Msf::Auxiliary::NTP
14+
include Msf::Auxiliary::DRDoS
1415

1516
def initialize
1617
super(
17-
'Name' => 'NTP PEER_LIST_SUM DoS Scanner',
18+
'Name' => 'NTP Mode 7 PEER_LIST_SUM DoS Scanner',
1819
'Description' => %q{
1920
This module identifies NTP servers which permit "PEER_LIST_SUM" queries and
2021
return responses that are larger in size or greater in quantity than
@@ -43,24 +44,36 @@ def scanner_process(data, shost, sport)
4344
# Called before the scan block
4445
def scanner_prescan(batch)
4546
@results = {}
46-
@version = 2
47-
@implementation = 3
48-
@request_code = 1
49-
@probe = Rex::Proto::NTP.ntp_private(@version, @implementation, @request_code)
50-
vprint_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
47+
@probe = Rex::Proto::NTP.ntp_private(2, 3, 1)
5148
end
5249

5350
# Called after the scan block
5451
def scanner_postscan(batch)
5552
@results.keys.each do |k|
56-
packets = @results[k]
53+
response_map = { @probe => @results[k] }
5754
# TODO: check to see if any of the responses are actually NTP before reporting
5855
report_service(
5956
:host => k,
6057
:proto => 'udp',
6158
:port => rport,
6259
:name => 'ntp'
6360
)
61+
62+
peer = "#{k}:#{rport}"
63+
vulnerable, proof = prove_drdos(response_map)
64+
what = 'R7-2014-12 NTP Mode 7 PEER_LIST_SUM DRDoS'
65+
if vulnerable
66+
print_good("#{peer} - Vulnerable to #{what}: #{proof}")
67+
report_vuln({
68+
:host => k,
69+
:port => rport,
70+
:proto => 'udp',
71+
:name => what,
72+
:refs => self.references
73+
})
74+
else
75+
vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}")
76+
end
6477
end
6578
end
6679
end

‎modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Auxiliary
1111
include Msf::Exploit::Remote::Udp
1212
include Msf::Auxiliary::UDPScanner
1313
include Msf::Auxiliary::NTP
14+
include Msf::Auxiliary::DRDoS
1415

1516
def initialize
1617
super(
@@ -47,23 +48,34 @@ def scanner_prescan(batch)
4748
@probe = Rex::Proto::NTP::NTPControl.new
4849
@probe.version = 2
4950
@probe.operation = 12
50-
vprint_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
5151
end
5252

5353
# Called after the scan block
5454
def scanner_postscan(batch)
5555
@results.keys.each do |k|
56-
packets = @results[k]
56+
response_map = { @probe => @results[k] }
57+
# TODO: check to see if any of the responses are actually NTP before reporting
5758
report_service(
5859
:host => k,
5960
:proto => 'udp',
6061
:port => rport,
6162
:name => 'ntp'
6263
)
6364

64-
total_size = packets.map(&:size).reduce(:+)
65-
if packets.size > 1 || total_size > @probe.size
66-
print_good("#{k}:#{rport} NTP req_nonce request permitted with amplified response (#{packets.size} packets, #{total_size} bytes)")
65+
peer = "#{k}:#{rport}"
66+
vulnerable, proof = prove_drdos(response_map)
67+
what = 'R7-2014-12 NTP Mode 6 REQ_NONCE DRDoS'
68+
if vulnerable
69+
print_good("#{peer} - Vulnerable to #{what}: #{proof}")
70+
report_vuln({
71+
:host => k,
72+
:port => rport,
73+
:proto => 'udp',
74+
:name => what,
75+
:refs => self.references
76+
})
77+
else
78+
vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}")
6779
end
6880
end
6981
end

‎modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ class Metasploit3 < Msf::Auxiliary
1111
include Msf::Exploit::Remote::Udp
1212
include Msf::Auxiliary::UDPScanner
1313
include Msf::Auxiliary::NTP
14+
include Msf::Auxiliary::DRDoS
1415

1516
def initialize
1617
super(
17-
'Name' => 'NTP GET_RESTRICT DoS Scanner',
18+
'Name' => 'NTP Mode 7 GET_RESTRICT DRDoS Scanner',
1819
'Description' => %q{
1920
This module identifies NTP servers which permit "reslist" queries and
2021
obtains the list of restrictions placed on various network interfaces,
@@ -45,23 +46,36 @@ def scanner_process(data, shost, sport)
4546
# Called before the scan block
4647
def scanner_prescan(batch)
4748
@results = {}
48-
@version = 2
49-
@implementation = 3
50-
@request_code = 16
51-
@probe = Rex::Proto::NTP.ntp_private(@version, @implementation, @request_code)
52-
vprint_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
49+
@probe = Rex::Proto::NTP.ntp_private(2, 3, 16)
5350
end
5451

5552
# Called after the scan block
5653
def scanner_postscan(batch)
5754
@results.keys.each do |k|
58-
packets = @results[k]
55+
response_map = { @probe => @results[k] }
56+
# TODO: check to see if any of the responses are actually NTP before reporting
5957
report_service(
6058
:host => k,
6159
:proto => 'udp',
6260
:port => rport,
6361
:name => 'ntp'
6462
)
63+
64+
peer = "#{k}:#{rport}"
65+
vulnerable, proof = prove_drdos(response_map)
66+
what = 'R7-2014-12 NTP Mode 7 GET_RESTRICT DRDoS'
67+
if vulnerable
68+
print_good("#{peer} - Vulnerable to #{what}: #{proof}")
69+
report_vuln({
70+
:host => k,
71+
:port => rport,
72+
:proto => 'udp',
73+
:name => what,
74+
:refs => self.references
75+
})
76+
else
77+
vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}")
78+
end
6579
end
6680
end
6781
end

‎modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Auxiliary
1111
include Msf::Exploit::Remote::Udp
1212
include Msf::Auxiliary::UDPScanner
1313
include Msf::Auxiliary::NTP
14+
include Msf::Auxiliary::DRDoS
1415

1516
def initialize
1617
super(
@@ -46,22 +47,34 @@ def scanner_prescan(batch)
4647
@probe = Rex::Proto::NTP::NTPControl.new
4748
@probe.version = 2
4849
@probe.operation = 31
49-
vprint_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
5050
end
5151

5252
# Called after the scan block
5353
def scanner_postscan(batch)
5454
@results.keys.each do |k|
55-
packets = @results[k]
55+
response_map = { @probe => @results[k] }
56+
# TODO: check to see if any of the responses are actually NTP before reporting
5657
report_service(
5758
:host => k,
5859
:proto => 'udp',
5960
:port => rport,
6061
:name => 'ntp'
6162
)
62-
total_size = packets.map(&:size).reduce(:+)
63-
if packets.size > 1 || total_size > @probe.size
64-
print_good("#{k}:#{rport} NTP unsettrap request permitted with amplified response (#{packets.size} packets, #{total_size} bytes)")
63+
64+
peer = "#{k}:#{rport}"
65+
vulnerable, proof = prove_drdos(response_map)
66+
what = 'R7-2014-12 NTP Mode 6 UNSETTRAP DRDoS'
67+
if vulnerable
68+
print_good("#{peer} - Vulnerable to #{what}: #{proof}")
69+
report_vuln({
70+
:host => k,
71+
:port => rport,
72+
:proto => 'udp',
73+
:name => what,
74+
:refs => self.references
75+
})
76+
else
77+
vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}")
6578
end
6679
end
6780
end

0 commit comments

Comments
 (0)