|
| 1 | +## Vulnerable Application |
| 2 | + |
| 3 | +## Verification Steps |
| 4 | + |
| 5 | +1. Use the supplied Dockerfile to start a vulnerable instance of the application |
| 6 | + 1. Build it with: `docker build -t ntpd:4.2.8p3 .` |
| 7 | + 1. Run it with: `docker run --rm -it --name ntp-server -p 123:123/udp ntpd:4.2.8p3` |
| 8 | +1. Start `msfconsole` and use the module |
| 9 | +1. Set the `RHOSTS` value as necessary |
| 10 | +1. Run the module and see that the target is vulnerable |
| 11 | + |
| 12 | +### Dockerfile |
| 13 | + |
| 14 | +``` |
| 15 | +ARG version=4.2.8p3 |
| 16 | +FROM ubuntu:16.04 |
| 17 | +ARG version |
| 18 | +
|
| 19 | +# Install dependencies |
| 20 | +RUN apt-get update && apt-get install -y \ |
| 21 | + wget \ |
| 22 | + build-essential \ |
| 23 | + libcap-dev \ |
| 24 | + libssl-dev && \ |
| 25 | + apt-get clean |
| 26 | +
|
| 27 | +# Download and build NTPD |
| 28 | +WORKDIR /tmp |
| 29 | +RUN wget https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-$version.tar.gz && \ |
| 30 | + tar -xzf ntp-$version.tar.gz && \ |
| 31 | + cd ntp-$version && \ |
| 32 | + ./configure --prefix=/usr/local --enable-linuxcaps && \ |
| 33 | + make && \ |
| 34 | + make install && \ |
| 35 | + cd .. && \ |
| 36 | + rm -rf ntp-$version* |
| 37 | +
|
| 38 | +# Add configuration file |
| 39 | +COPY ntp.conf /etc/ntp.conf |
| 40 | +
|
| 41 | +# Expose NTP port (123) |
| 42 | +EXPOSE 123/udp |
| 43 | +
|
| 44 | +# Run ntpd |
| 45 | +ENTRYPOINT ["/usr/local/bin/ntpd"] |
| 46 | +CMD ["-g", "-d", "-d"] |
| 47 | +``` |
| 48 | + |
| 49 | +## Options |
| 50 | + |
| 51 | +## Scenarios |
| 52 | + |
| 53 | +### Ubuntu 16.04 NTPd 4.2.8p3 |
| 54 | + |
| 55 | +``` |
| 56 | +metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > set RHOSTS 192.168.159.128, 192.168.159.10 |
| 57 | +RHOSTS => 192.168.159.128, 192.168.159.10 |
| 58 | +metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > run |
| 59 | +[+] 192.168.159.128:123 - NTP - VULNERABLE: Accepted a NTP symmetric active association |
| 60 | +[*] Scanned 1 of 2 hosts (50% complete) |
| 61 | +[*] Scanned 1 of 2 hosts (50% complete) |
| 62 | +[*] Scanned 1 of 2 hosts (50% complete) |
| 63 | +[*] Scanned 1 of 2 hosts (50% complete) |
| 64 | +[*] Scanned 1 of 2 hosts (50% complete) |
| 65 | +[*] Scanned 2 of 2 hosts (100% complete) |
| 66 | +[*] Auxiliary module execution completed |
| 67 | +metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > |
| 68 | +``` |
0 commit comments