pentesting-ntp

Run ntpdc -c monlist against the target IP; a populated host list confirms exposure. Alternatively use nmap -sU -p123 --script ntp-monlist or zgrab2 ntp --monlist for mass scanning with JSON output.

Use nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 against the target. This identifies the daemon version and runs safe discovery and vulnerability scripts without triggering DoS or brute-force checks.

ntpq uses Mode-6 queries to read server variables, peers, and associations, while ntpdc uses legacy Mode-7 control commands including the abused monlist query. Mode-7 is often disabled in ntpd 4.2.8p9 and later.

Yes. NTS-KE listeners may present self-signed or expired certificates and non-AEAD cipher suites. CVE-2023-33192 affects ntpd-rs versions before 0.3.3, where malformed NTS cookies crash the daemon even when NTS is disabled.

ntpd versions 4.2.8p9 and later typically disable Mode-7 control commands by default, and the disable monitor directive explicitly kills monlist responses. An empty result or timeout indicates the amplification vector is mitigated.

Remote testing cannot directly demonstrate time-shift MITM attacks, which require on-path packet manipulation in a lab setting with tools like BetterCap. Amplification findings should be documented but never weaponized against third parties.