WIP: Fix the ntp_nak_to_the_future module

Needs pending changes that add the NTPHeader class

Author: zeroSteiner

modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb

@@ -47,18 +47,13 @@ def initialize(info = {})
   end
 
   def build_crypto_nak(time)
-    probe = Rex::Proto::NTP::NTPSymmetric.new
+    probe = NTPHeader.new
+    probe.version_number = 3
     probe.stratum = 1
     probe.poll = 10
     probe.mode = 1
     unless time
-      now = Time.now
-      # compute the timestamp.  NTP stores a timestamp as 64-bit unsigned
-      # integer, the high 32-bits representing the number of seconds since era
-      # epoch and the low 32-bits representing the fraction of a second.  The era
-      # epoch in this case is Jan 1 1900, so we must add the number of seconds
-      # between then and the ruby era epoch, Jan 1 1970, which is 2208988800
-      time = ((now.to_i + 2208988800 + datastore['OFFSET']) << 32) + now.nsec
+      time = Time.now
     end
 
     # TODO: use different values for each?
@@ -67,24 +62,24 @@ def build_crypto_nak(time)
     probe.receive_timestamp = time
     probe.transmit_timestamp = time
     # key-id 0
-    probe.payload = "\x00\x00\x00\x00"
+    probe.key_identifier = 0
     probe
   end
 
   def check
     connect_udp
 
     # pick a random 64-bit timestamp
-    canary_timestamp = rand((2**32)..((2**64) - 1))
+    canary_timestamp = Time.now.utc - (60 * 5)
     probe = build_crypto_nak(canary_timestamp)
-    udp_sock.put(probe)
+    udp_sock.put(probe.to_binary_s)
 
-    expected_length = probe.to_binary_s.length - probe.payload.length
+    expected_length = probe.offset_of(probe.key_identifier)
     response = udp_sock.timed_read(expected_length)
     disconnect_udp
     if response.length == expected_length
-      ntp_symmetric = Rex::Proto::NTP::NTPSymmetric.new.read(response)
-      if ntp_symmetric.mode == 2 && ntp_symmetric.origin_timestamp == canary_timestamp
+      ntp_symmetric = NTPHeader.read(response)
+      if ntp_symmetric.mode == 2 && ntp_symmetric.origin_timestamp == nil
         vprint_good("#{rhost}:#{rport} - NTP - VULNERABLE: Accepted a NTP symmetric active association")
         report_vuln(
           host: rhost,