metasploit-framework/modules/auxiliary/scanner/ntp/ntp_readvar.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary


  include Msf::Exploit::Remote::Udp
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner


  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'NTP Clock Variables Disclosure',
      'Description'    => %q{
          This module reads the system internal NTP variables. These variables contain
        potentially sensitive information, such as the NTP software version, operating
        system version, peers, and more.
      },
      'Author'         => [ 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL','http://www.rapid7.com/vulndb/lookup/ntp-clock-variables-disclosure' ],
        ]
      )
    )
    register_options(
    [
      Opt::RPORT(123)
    ], self.class)
  end

  def run_host(ip)

    connect_udp

    readvar = "\x16\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00" #readvar command
    print_status("Connecting target #{rhost}:#{rport}...")

    print_status("Sending command")
    udp_sock.put(readvar)
    reply = udp_sock.recvfrom(65535, 0.1)
    if not reply or reply[0].empty?
      print_error("#{rhost}:#{rport} - Couldn't read NTP variables")
      return
    end
    p_reply = reply[0].split(",")
    arr_count = 0
    while ( arr_count < p_reply.size)
      if arr_count == 0
        print_good("#{rhost}:#{rport} - #{p_reply[arr_count].slice(12,p_reply[arr_count].size)}") #12 is the adjustment of packet garbage
        arr_count =  arr_count + 1
      else
        print_good("#{rhost}:#{rport} - #{p_reply[arr_count].strip}")
        arr_count =  arr_count + 1
      end
    end
    disconnect_udp

  end

end