Skip to content

Commit f48e4a0

Browse files
committed
Add documentation to the module with testing steps
1 parent 537585f commit f48e4a0

File tree

1 file changed

+68
-0
lines changed

1 file changed

+68
-0
lines changed
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
## Vulnerable Application
2+
3+
## Verification Steps
4+
5+
1. Use the supplied Dockerfile to start a vulnerable instance of the application
6+
1. Build it with: `docker build -t ntpd:4.2.8p3 .`
7+
1. Run it with: `docker run --rm -it --name ntp-server -p 123:123/udp ntpd:4.2.8p3`
8+
1. Start `msfconsole` and use the module
9+
1. Set the `RHOSTS` value as necessary
10+
1. Run the module and see that the target is vulnerable
11+
12+
### Dockerfile
13+
14+
```
15+
ARG version=4.2.8p3
16+
FROM ubuntu:16.04
17+
ARG version
18+
19+
# Install dependencies
20+
RUN apt-get update && apt-get install -y \
21+
wget \
22+
build-essential \
23+
libcap-dev \
24+
libssl-dev && \
25+
apt-get clean
26+
27+
# Download and build NTPD
28+
WORKDIR /tmp
29+
RUN wget https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-$version.tar.gz && \
30+
tar -xzf ntp-$version.tar.gz && \
31+
cd ntp-$version && \
32+
./configure --prefix=/usr/local --enable-linuxcaps && \
33+
make && \
34+
make install && \
35+
cd .. && \
36+
rm -rf ntp-$version*
37+
38+
# Add configuration file
39+
COPY ntp.conf /etc/ntp.conf
40+
41+
# Expose NTP port (123)
42+
EXPOSE 123/udp
43+
44+
# Run ntpd
45+
ENTRYPOINT ["/usr/local/bin/ntpd"]
46+
CMD ["-g", "-d", "-d"]
47+
```
48+
49+
## Options
50+
51+
## Scenarios
52+
53+
### Ubuntu 16.04 NTPd 4.2.8p3
54+
55+
```
56+
metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > set RHOSTS 192.168.159.128, 192.168.159.10
57+
RHOSTS => 192.168.159.128, 192.168.159.10
58+
metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > run
59+
[+] 192.168.159.128:123 - NTP - VULNERABLE: Accepted a NTP symmetric active association
60+
[*] Scanned 1 of 2 hosts (50% complete)
61+
[*] Scanned 1 of 2 hosts (50% complete)
62+
[*] Scanned 1 of 2 hosts (50% complete)
63+
[*] Scanned 1 of 2 hosts (50% complete)
64+
[*] Scanned 1 of 2 hosts (50% complete)
65+
[*] Scanned 2 of 2 hosts (100% complete)
66+
[*] Auxiliary module execution completed
67+
metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) >
68+
```

0 commit comments

Comments
 (0)