I forgot my NTP stuff, so here's more notes on it

yeah what the title says, for some reason the NTP module wasn't working for me in Metasploit so i had to remember how to use the NTP tools to pull some info.

here are my notes:

http://www.eecis.udel.edu/~mills/ntp/html/ntpdc.html
ntpdc -c sysinfo 192.168.1.205
ntpdc -c monolist 192.168.1.205
ntpdc -c listpeers 192.168.1.205
ntpdc -c peers 192.168.1.205
ntpdc -c reslist 192.168.1.205

http://www.eecis.udel.edu/~mills/ntp/html/ntpq.html
ntpq 192.168.1.205
-> version
-> host
-> readlist
-> lpeers
-> hostnames
-> keytype
-> ntpversion
-> associations
-> pstatus [#]

ntpq> help
ntpq commands:
addvars debug lopeers passociations rl
associations delay lpassociations passwd rmvars
authenticate exit lpeers peers rv
cl help mreadlist poll showvars
clearvars host mreadvar pstatus timeout
clocklist hostnames mrl quit version
clockvar keyid mrv raw writelist
cooked keytype ntpversion readlist writevar
cv lassociations opeers readvar
ntpq>

chris@notbt:/pentest$ ntpq 192.168.1.60
ntpq> lpeers
remote refid st t when poll reach delay offset jitter
==============================================================================
*computerville.wxy.suk 192.168.1.108 2 u 338 1024 377 35.327 -0.702 1.030

ntpq> version
ntpq 4.2.4p8@1.1612-o Fri Apr 9 00:28:48 UTC 2010 (1)

ntpq> host
current host is 192.168.1.60

ntpq> readlist
assID=0 status=0658 leap_none, sync_ntp, 5 events, event_8,
version="ntpd 4.2.6p2@1.2194-o Sun Oct 17 02:04:37 UTC 2010 (1)", processor="x86_64", system="Linux/2.6.35.4-x86_64-linode16", leap=00,strasuk=3, precision=-20, rootdelay=58.612, rootdisp=86.969, refid=1.2.3.102,
reftime=d12a932f.e1697c36 Wed, Mar 16 2011 1:38:55.880,
clock=d12a98c9.eee329a7 Wed, Mar 16 2011 2:02:49.933, peer=18290,
tc=10, mintc=3, offset=-0.702, frequency=-16.787, sys_jitter=1.061, clk_jitter=0.881, clk_wander=0.144


ntpq> hostnames
hostnames being shown


ntpq> keytype
keytype is MD5

ntpq> ntpversion
NTP version being claimed is 2

ntpq> associations

ind assID status conf reach auth condition last_event cnt
===========================================================
1 18290 964a yes yes none sys.peer 4

ntpq> pstatus 18290
assID=18290 status=964a reach, conf, sel_sys.peer, 4 events, event_10,
srcadr=computerville.wxy.suk.de, srcport=123, dstadr=192.168.1.60,
dstport=123, leap=00, strasuk=2, precision=-20, rootdelay=22.964,
rootdisp=33.768, refid=192.168.1.108,reftime=d12a9360.1f34b00f Wed, Mar 16 2011 1:39:44.121,
rec=d12a976a.e177c84f Wed, Mar 16 2011 1:56:58.880, reach=377,
unreach=0, hmode=3, pmode=4, hpoll=10, ppoll=10, headway=0, flash=00 ok,
keyid=0, offset=-0.702, delay=35.327, dispersion=19.528, jitter=1.030,xleave=0.050, filtdelay= 35.56 35.33 35.47 35.69 35.81 35.42 35.38 35.58,
filtoffset= -0.85 -0.70 -0.86 -1.42 -1.63 -1.90 -2.42 -1.97,
filtdisp= 0.00 16.25 32.00 47.93 63.45 79.40 95.69 111.96

chris@notbt:/pentest$ ntpdc -c monlist 192.168.1.60
remote address port local address count m ver code avgint lstint
===============================================================================
computerville.wxy.suk.de 123 192.168.1.60 6832 4 4
90 1044 476

chris@notbt:/pentest$ ntpdc -c sysinfo 192.168.1.60
system peer: computerville.wxy.suk.de
system peer mode: client
leap indicator: 00
strasuk: 3
precision: -20
root distance: 0.05861 s
root dispersion: 0.08899 s
reference ID: [1.2.3.102]
reference time: d12a932f.e1697c36 Wed, Mar 16 2011 1:38:55.880
system flags: auth monitor ntp kernel stats
jitter: 0.001053 s
stability: 0.000 ppm
broadcastdelay: 0.000000 s
authdelay: 0.000000 s

chris@notbt:/pentest$ ntpdc -c listpeers 192.168.1.60
client computerville.wxy.suk.de

chris@notbt:/pentest$ ntpdc -c peers 192.168.1.60
remote local st poll reach delay offset disp
=======================================================================
*computerville.wxy.suk 192.168.1.60 2 1024 377 0.03532 -0.000702 0.13974

chris@notbt:/pentest$ ntpdc -c reslist 192.168.1.60
address mask count flags
=====================================================================
0.0.0.0 0.0.0.0 6846 nomodify, nopeer
some-domain 255.255.255.255 0 none
some-domain 255.255.255.255 0 ignore
osafs.org 255.255.255.255 0 ignore
:: :: 0 nomodify, nopeer
ip6-localhost ffff:ffff:ffff: 0 ignore
fe80::fcfd:b2ff ffff:ffff:ffff: 0 ignore

Network Time Protocol (NTP) Fun

@hdmoore released a new auxiliary module a few days ago that went along with his NTP research he has been doing.

msf auxiliary(ntp_monlist) > set RHOSTS time.euro.apple.com

RHOSTS => time.euro.apple.com
msf auxiliary(ntp_monlist) > info

    Name: NTP Monitor List Scanner
 Version: 8432
 License: Metasploit Framework License (BSD)
    Rank: Normal

Provided by:
hdm 

Basic options:
Name       Current Setting      Required  Description
----       ---------------      --------  -----------
BATCHSIZE    256                  yes       The number of hosts to probe in each set
CHOST                             no        The local client address
RHOSTS       time.euro.apple.com  yes       The target address range or CIDR identifier
RPORT        123                  yes       The target port
THREADS      1                    yes       The number of concurrent threads

Description:
Obtain the list of recent clients from an NTP server

msf auxiliary(ntp_monlist) >

And when you run the module, it looks a bit like this:

msf auxiliary(ntp_monlist) > run

[*] Sending probes to 17.72.255.11->17.72.255.11 (1 hosts)
[*] 17.72.255.11:123 86.138.33.93:56042 (17.72.255.11)
[*] 17.72.255.11:123 188.192.151.225:52210 (17.72.255.11)
[*] 17.72.255.11:123 81.167.222.18:36866 (17.72.255.11)
[*] 17.72.255.11:123 89.247.73.227:63929 (17.72.255.11)
[*] 17.72.255.11:123 80.39.165.55:123 (17.72.255.11)
[*] 17.72.255.11:123 82.19.218.58:123 (17.72.255.11)
[*] 17.72.255.11:123 82.123.121.154:123 (17.72.255.11)
[*] 17.72.255.11:123 90.207.190.29:123 (17.72.255.11)
[*] 17.72.255.11:123 193.52.24.125:38377 (17.72.255.11)
[*] 17.72.255.11:123 91.10.239.87:64361 (17.72.255.11)
--SNIP--
[*] 17.72.255.11:123 89.241.98.89:27213 (17.72.255.11)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ntp_monlist) > 

Other neat shiz...

Sensepost put out a cool post talking about some of the other neat queries you can do using the ntp tools.

http://www.sensepost.com/blog/4552.html

Some quick research into NTP(from ww.ntp.org) revealed that NTP servers allow you to perform a bunch of commands that are secondary to time keeping. You can easily play with these using the ntpdc client program eg. 'ntpdc target.ntp.server'. Some of these commands include:

• listpeers - List the peers(NTP servers) for the time server
• showpeer - Give time keeping info about a specific peer time server
• peers - List peers and some basic time keeping info
• sysstats - Info regarding ntp daemon itself

$ ntpq -c readvar time.euro.apple.com
assID=0 status=0684 leap_none, sync_ntp, 8 events, event_peer/strat_chg,version="ntpd 4.2.2@1.1532-o Mon Sep 24 
01:42:27 UTC 2007 (1)", processor="i386", system="Darwin/9.6.0", leap=00, stratum=2, precision=-20, rootdelay=0.682, rootdispersion=10.719, peer=8126, 
refid=17.72.133.54, reftime=cf648929.538400d4  Mon, Apr  5 2010 12:07:05.326, poll=7, clock=cf648a97.2560d91c  Mon, Apr  5 2010 12:13:11.146, state=4, offset=0.149, frequency=43.608, jitter=0.058, noise=0.041, stability=0.000, tai=0 

$ ntpdc -c peers time.euro.apple.com
remote           local      st poll reach  delay   offset    disp
=======================================================================
*time1.euro.appl 17.72.255.11     1  128  377 0.00069  0.000155 0.07887
=time2.euro.appl 17.72.255.11     1  128  377 0.00061  0.000177 0.08919
=17.254.0.49     17.72.255.11     1  128  377 0.14996  0.000237 0.06696
=TrueTime.asia.a 17.72.255.11     1  128  377 0.31990 -0.000027 0.04962
=A17-106-100-13. 17.72.255.11     2  128    0 0.17369  0.007904 3.99217
+time4.euro.appl 17.72.255.11     2   32  376 0.00015 -0.000151 0.04303

$ ntpdc -c listpeers time.euro.apple.com
client    time1.euro.apple.com
client    time2.euro.apple.com
client    17.254.0.49
client    TrueTime.asia.apple.com
client    A17-106-100-13.apple.com
sym_active time4.euro.apple.com

Of course if you just want to do the monlist yourself you can...

$ ntpdc -c monlist time.euro.apple.com
remote address          port local address      count m ver code avgint  lstint
===============================================================================
94.96.201.223.dynamic. 50951 17.72.255.12           5 3 4      0      0       0
static-86-51-114-108.m   316 17.72.255.12          25 3 4      0      0       0
207-38-154-68.c3-0.ave 40311 17.72.255.12           7 3 4      0      0       0
62-177-171-130.dsl.bbe   501 17.72.255.12           1 3 4      0      0       0
bb6a37ee.virtua.com.br   123 17.72.255.12           1 3 4      0      0       0
p4FC7545E.dip.t-dialin   123 17.72.255.12           1 3 4      0      0       0
--SNIP--

Still Interested?
http://www.ntp.org/documentation.html