Jan 22, 2014 11:20 AM
(This post was last modified: Feb 12, 2014 07:32 AM by DaRkReD.)
For informational uses only DaRkReD is not liable for any actions taken with the provided tools
EDIT: It appears someone is using an attack vector like this to DDOS cloudflare. I can not stress enough I have no involvement or participation in any such actions. This script is provided as is and its up to the end user to make mature and legal decisions about its usage.
![[Image: VsN01Fx.png]](https://i.imgur.com/VsN01Fx.png)
How does it work?
NTP has a feature called monlist which lists recent clients. Asking for the monlist takes about 90 bytes, the monlist is about 1640 bytes and since NTP is UDP an attacker can spoof the IP origin and those 1640 bytes will go to a target. As a result an attacker has an 18x amplification attack so for every 1 byte an attacker sends 18 bytes sent to the target.
The scary part? Shodan is currently detecting around 762,644 NTP servers in the DMZ.
How do I do it?
Manipulate the UDP header yourself or use the python script: https://github.com/vpnguy/ntpdos
Requires root and scapy library (sudo apt-get install python-scapy)
Run the script like this:
EX:
(Attempts to NTP flood 1.2.3.4 using a list of servers at list.txt by creating 10 threads
Install it by:
You need to have your server list formatted as:
DO NOT ADD ANY PORT NUMBERS TO THE END
(One server per line)
You will also need some NTP servers that allow remote monlists
How do I find servers that support remote monlist?
nmap has modules to search for them but thats up to you
Will this run on windows?
Since XP SP2 windows has disallowed invalid UDP headers. Just boot up a Backtrack/Kali VM if you want it to work 100%
Mitigation?
https://www.us-cert.gov/ncas/alerts/TA14-013A
Happy Hacking
--DaRkReD
EDIT: It appears someone is using an attack vector like this to DDOS cloudflare. I can not stress enough I have no involvement or participation in any such actions. This script is provided as is and its up to the end user to make mature and legal decisions about its usage.
How does it work?
NTP has a feature called monlist which lists recent clients. Asking for the monlist takes about 90 bytes, the monlist is about 1640 bytes and since NTP is UDP an attacker can spoof the IP origin and those 1640 bytes will go to a target. As a result an attacker has an 18x amplification attack so for every 1 byte an attacker sends 18 bytes sent to the target.
The scary part? Shodan is currently detecting around 762,644 NTP servers in the DMZ.
How do I do it?
Manipulate the UDP header yourself or use the python script: https://github.com/vpnguy/ntpdos
Requires root and scapy library (sudo apt-get install python-scapy)
Run the script like this:
Code
ntpdos.py <target ip> <NTP server list> <number of threads>Code
ntpdos.py "1.2.3.4" "list.txt" "10"Install it by:
Code
git clone http://github.com/vpnguy/ntpdos.git
cd ntpdos
chmod +x ntpdos.py
./ntpdos.py -hYou need to have your server list formatted as:
Code
1.1.1.1
2.2.2.2
3.3.3.3(One server per line)
You will also need some NTP servers that allow remote monlists
How do I find servers that support remote monlist?
nmap has modules to search for them but thats up to you
Will this run on windows?
Since XP SP2 windows has disallowed invalid UDP headers. Just boot up a Backtrack/Kali VM if you want it to work 100%
Mitigation?
https://www.us-cert.gov/ncas/alerts/TA14-013A
Happy Hacking
--DaRkReD
