Initial commit of an NTP fuzzer
Jon Hart
parent
e953fcbd97
commit
7ce9114a1e
|
|
@ -0,0 +1,245 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'bit-struct'
|
||||
require 'securerandom'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
#include Msf::Auxiliary::Scanner
|
||||
include Msf::Exploit::Remote::Udp
|
||||
|
||||
NTP_VERSIONS = (0..7).to_a
|
||||
NTP_MODES = (0..7).to_a
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'NTP Protocol Fuzzer',
|
||||
'Description' => %q(
|
||||
A simplistic fuzzer for the Network Time Protocol that sends the
|
||||
following probes to understand NTP and look for anomalous NTP behavior:
|
||||
|
||||
* All possible combinations of NTP versions and modes, even if not
|
||||
allowed or specified in the RFCs
|
||||
* Short versions of the above
|
||||
* Short, invalid datagrams
|
||||
* Full-size, random datagrams
|
||||
* All possible NTP control messages
|
||||
|
||||
This findings of this fuzzer are not necessarily indicative of bugs,
|
||||
let alone vulnerabilities, rather they point out interesting things
|
||||
that might deserve more attention. Furthermore, this module is not
|
||||
particularly intelligent and there are many more areas of NTP that
|
||||
could be explored, including:
|
||||
|
||||
* Warn if the response is 100% identical to the request
|
||||
* Warn if the "mode" (if applicable) doesn't align with what we expect,
|
||||
* Filter out the 12-byte mode 6 unsupported opcode errors.
|
||||
* Fuzz the control message payload offset/size/etc. There be bugs
|
||||
),
|
||||
'Author' => 'Jon Hart <jon_hart[at]rapid7.com>',
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(123),
|
||||
OptString.new('VERSIONS', [true, 'Versions to fuzz', NTP_VERSIONS.join(',')]),
|
||||
OptString.new('MODES', [true, 'Versions to fuzz', NTP_MODES.join(',')]),
|
||||
OptInt.new('SLEEP', [true, 'Sleep for this many ms between requests', 0]),
|
||||
OptInt.new('WAIT', [true, 'Wait this many ms for responses', 500])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
# A very generic NTP message
|
||||
#
|
||||
# Uses the common/similar parts from versions 1-4 and considers everything
|
||||
# after to be just one big field. For the particulars on the different versions,
|
||||
# see:
|
||||
# http://tools.ietf.org/html/rfc958#appendix-B
|
||||
# http://tools.ietf.org/html/rfc1059#appendix-B
|
||||
# pages 45/48 of http://tools.ietf.org/pdf/rfc1119.pdf
|
||||
# http://tools.ietf.org/html/rfc1305#appendix-D
|
||||
# http://tools.ietf.org/html/rfc5905#page-19
|
||||
class NTPGeneric < BitStruct
|
||||
# 0 1 2 3
|
||||
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
# |LI | VN | mode| Stratum | Poll | Precision |
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
unsigned :li, 2, default: 0
|
||||
unsigned :version, 3, default: 0
|
||||
unsigned :mode, 3, default: 0
|
||||
unsigned :stratum, 8, default: 0
|
||||
unsigned :poll, 8, default: 0
|
||||
unsigned :precision, 8, default: 0
|
||||
char :payload, 352
|
||||
end
|
||||
|
||||
# An NTP control message. Control packets are only specified for NTP
|
||||
# versions 2-4, but this is a fuzzer so why not try them all...
|
||||
class NTPControl < BitStruct
|
||||
# 0 1 2 3
|
||||
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
# |00 | VN | 6 |R E M| op | Sequence |
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
# | status | association id |
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
# | offset | count |
|
||||
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
unsigned :reserved, 2, default: 0
|
||||
unsigned :version, 3, default: 0
|
||||
unsigned :mode, 3, default: 6
|
||||
unsigned :response, 1, default: 0
|
||||
unsigned :error, 1, default: 0
|
||||
unsigned :more, 1, default: 0
|
||||
unsigned :operation, 5, default: 0
|
||||
unsigned :sequence, 16, default: 0
|
||||
unsigned :status, 16, default: 0
|
||||
unsigned :association_id, 16, default: 0
|
||||
# TODO: there *must* be bugs in the handling of these next two fields!
|
||||
unsigned :payload_offset, 16, default: 0
|
||||
unsigned :payload_size, 16, default: 0
|
||||
rest :payload
|
||||
end
|
||||
|
||||
def build_ntp_control(version, operation, payload = nil)
|
||||
n = NTPControl.new
|
||||
n.version = version
|
||||
n.operation = operation
|
||||
if payload
|
||||
n.payload_offset = 0
|
||||
n.payload_size = payload.size
|
||||
n.payload = payload
|
||||
end
|
||||
n.to_s
|
||||
end
|
||||
|
||||
def build_ntp_generic(version, mode)
|
||||
n = NTPGeneric.new
|
||||
n.version = version
|
||||
n.mode = mode
|
||||
n.to_s
|
||||
end
|
||||
|
||||
def sleep_time
|
||||
datastore['SLEEP'] / 1000.0
|
||||
end
|
||||
|
||||
def run
|
||||
# parse and sanity check versions
|
||||
@versions = datastore['VERSIONS'].split(/[^\d]/).select { |v| !v.empty? }.map { |v| v.to_i }
|
||||
unsupported_versions = @versions - NTP_VERSIONS
|
||||
fail "Unsupported NTP versions: #{unsupported_versions}" unless unsupported_versions.empty?
|
||||
# parse and sanity check modes
|
||||
@modes = datastore['MODES'].split(/[^\d]/).select { |m| !m.empty? }.map { |v| v.to_i }
|
||||
unsupported_modes = @modes - NTP_MODES
|
||||
fail "Unsupported NTP modes: #{unsupported_modes}" unless unsupported_modes.empty?
|
||||
|
||||
connect_udp
|
||||
fuzz_version_mode(rhost)
|
||||
fuzz_version_mode(rhost, true)
|
||||
fuzz_short(rhost)
|
||||
fuzz_random(rhost)
|
||||
fuzz_control(rhost) if @modes.include?(6)
|
||||
disconnect_udp
|
||||
end
|
||||
|
||||
# Sends a series of NTP control messages
|
||||
def fuzz_control(host)
|
||||
print_status("#{host}:#{rport} fuzzing control messages (mode 6)")
|
||||
@versions.map { |v| v.to_i }.each do |version|
|
||||
0.upto(31) do |op|
|
||||
request = build_ntp_control(version, op)
|
||||
what = "#{request.size}-byte version #{version} mode 6 op #{op} packet"
|
||||
vprint_status("#{host}:#{rport} probing with #{request.size}-byte #{what}")
|
||||
probe(host, datastore['RPORT'].to_i, request).each do |reply|
|
||||
handle_response(host, request, reply, what)
|
||||
end
|
||||
Rex.sleep(sleep_time)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Sends a series of small, short datagrams, looking for a reply
|
||||
def fuzz_short(host)
|
||||
print_status("#{host}:#{rport} fuzzing short messages")
|
||||
0.upto(4) do |size|
|
||||
request = SecureRandom.random_bytes(size)
|
||||
what = "Short #{request.size}-byte random packet"
|
||||
vprint_status("#{host}:#{rport} probing with #{what}")
|
||||
probe(host, datastore['RPORT'].to_i, request).each do |reply|
|
||||
handle_response(host, request, reply, what)
|
||||
end
|
||||
Rex.sleep(sleep_time)
|
||||
end
|
||||
end
|
||||
|
||||
# Sends a series of random, full-sized datagrams, looking for a reply
|
||||
def fuzz_random(host)
|
||||
print_status("#{host}:#{rport} fuzzing random messages")
|
||||
0.upto(5) do
|
||||
request = SecureRandom.random_bytes(48)
|
||||
what = "random #{request.size}-byte packet"
|
||||
vprint_status("#{host}:#{rport} probing with #{what}")
|
||||
probe(host, datastore['RPORT'].to_i, request).each do |reply|
|
||||
handle_response(host, request, reply, what)
|
||||
end
|
||||
Rex.sleep(sleep_time)
|
||||
end
|
||||
end
|
||||
|
||||
# Sends a series of different version + mode combinations
|
||||
def fuzz_version_mode(host, short=false)
|
||||
print_status("#{host}:#{rport} fuzzing #{short ? 'short ' : nil}version and mode combinations")
|
||||
@versions.map { |v| v.to_i }.each do |version|
|
||||
@modes.map { |m| m.to_i }.each do |mode|
|
||||
request = build_ntp_generic(version, mode)
|
||||
request = request[0, 4] if short
|
||||
what = "#{request.size}-byte #{short ? 'short ' : nil}version #{version} mode #{mode} packet"
|
||||
vprint_status("#{host}:#{rport} probing with #{what}")
|
||||
probe(host, datastore['RPORT'].to_i, request).each do |reply|
|
||||
handle_response(host, request, reply, what)
|
||||
end
|
||||
Rex.sleep(sleep_time)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Sends +packet+ to +host+ on UDP port +port+, returning all replies
|
||||
def probe(host, port, packet)
|
||||
replies = []
|
||||
udp_sock.sendto(packet, host, port, 0)
|
||||
while (r = udp_sock.recvfrom(65535, datastore['WAIT'] / 1000.0) and r[1])
|
||||
replies << r
|
||||
end
|
||||
replies
|
||||
end
|
||||
|
||||
# Parses the given packet and provides a description about the NTP message inside
|
||||
def describe(packet)
|
||||
ntp = NTPGeneric.new(packet)
|
||||
"#{packet.size}-byte version #{ntp.version} mode #{ntp.mode} reply"
|
||||
end
|
||||
|
||||
def handle_response(host, request, response, what)
|
||||
return unless response[1]
|
||||
data = response[0]
|
||||
problems = []
|
||||
problems << 'large response' if request.size < data.size
|
||||
ntp_req = NTPGeneric.new(request)
|
||||
ntp_resp = NTPGeneric.new(data)
|
||||
problems << 'version mismatch' if ntp_req.version != ntp_resp.version
|
||||
|
||||
if problems.empty?
|
||||
print_status("#{host}:#{rport} -- Received #{describe(data)} to #{what}")
|
||||
else
|
||||
print_good("#{host}:#{rport} -- Received #{describe(data)} to #{what}: #{problems.join(',')}")
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue