[Cipher]

Introduction

Hello, today we will be discussing an increasingly common ddos amplification vector called NTP (Network Time Protocol). NTP is far more superior over DNS and Chargen, the response size is MUCH larger then both of them and the response is split into multiple packets making it even more deadly (high pp/s).

Here's a comparison:

• DNS - ~30 times amplification factor
  
• Chargen - ~15 times amplification factor
  
• NTP - 200+ amplification factor (split into multiple packets 440 bytes each)
  

How NTP Amplification Works
NTP Amplification works by sending a monlist command (payload is at the bottom of the post). A monlist command requests the server to return the last 600 ip addresses it has connected with. The request is only 234 bytes long and the response is huge, split into multiple packets. When performing an NTP attack, the output is based of popularity of the servers not quantity. Some NTP servers will not have the max 600 addresses in the monlist command, so you want to filter these out for the most efficient attack. You can do this by using masscan to scan for NTP servers and writing a checker that sends the monlist payload (posted below) and checks what the size is of the response it returns back (remember the response is split into multiple packets each with a max size of 440!)

Payloads

Here is the monlist command payload:

Code:

23, 0, 3, 42, 0, 0, 0, 0

Other
If you have any questions i'll be glad to help you, if I get enough feedback I will release my checker written in Java.

[Neko]

Great post! Very informative I already knew how powerful NTP was tho o3o~

[Alan Turing]

Nice tutorial, awaiting for your checker written in Java.

[Dismas]

Last amplification method I'd heard about was DNS. Thanks for the information.

[w00t]

A good dns server can reflect at more than 30 times.

Cool nontheless, there are lots of fun ways to DrDoS

[misnar]

Let's see how long it takes until SNMP is whored out too.

[Cipher]

Let's see how long it takes until SNMP is whored out too.

I'm guessing it will happen very very very soon after someone releases a script and scanner/bruter for the public.

[w00t]

I shall keep my SNMP code all to myself.

I'm surprised there hasn't been any real market demand for DrDoS exploits, since there has been all this press about massive attacks using them.

[Cipher]

A good dns server can reflect at more than 30 times.

Cool nontheless, there are lots of fun ways to DrDoS

DNS is nothing in comparison.

[Adorapuff]

A sample attack script is https://github.com/vpnguy/ntpdos/blob/master/ntpdos.py
and to find servers you can use the nmap module ntp-monlist http://nmap.org/nsedoc/scripts/ntp-monlist.html.
Great tutorial, I don't DDos, but I might post some IPs later.