+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Networking (https://sinister.ly/Forum-Networking)
+--- Thread: NTP DDoS Amplification Vector (/Thread-NTP-DDoS-Amplification-Vector)
Pages:
1
2
NTP DDoS Amplification Vector - Cipher - 03-12-2014
Introduction
Hello, today we will be discussing an increasingly common ddos amplification vector called NTP (Network Time Protocol). NTP is far more superior over DNS and Chargen, the response size is MUCH larger then both of them and the response is split into multiple packets making it even more deadly (high pp/s).
Here's a comparison:
- DNS - ~30 times amplification factor
- Chargen - ~15 times amplification factor
- NTP - 200+ amplification factor (split into multiple packets 440 bytes each)
How NTP Amplification Works
NTP Amplification works by sending a monlist command (payload is at the bottom of the post). A monlist command requests the server to return the last 600 ip addresses it has connected with. The request is only 234 bytes long and the response is huge, split into multiple packets. When performing an NTP attack, the output is based of popularity of the servers not quantity. Some NTP servers will not have the max 600 addresses in the monlist command, so you want to filter these out for the most efficient attack. You can do this by using masscan to scan for NTP servers and writing a checker that sends the monlist payload (posted below) and checks what the size is of the response it returns back (remember the response is split into multiple packets each with a max size of 440!)
Payloads
Here is the monlist command payload:
Code:
23, 0, 3, 42, 0, 0, 0, 0Other
If you have any questions i'll be glad to help you, if I get enough feedback I will release my checker written in Java.
RE: NTP DDoS Amplification Vector - Neko - 03-12-2014
Great post! Very informative I already knew how powerful NTP was tho o3o~
RE: NTP DDoS Amplification Vector - Alan Turing - 03-12-2014
Nice tutorial, awaiting for your checker written in Java.
RE: NTP DDoS Amplification Vector - Oni - 03-12-2014
Last amplification method I'd heard about was DNS. Thanks for the information.
RE: NTP DDoS Amplification Vector - w00t - 03-12-2014
A good dns server can reflect at more than 30 times.
Cool nontheless, there are lots of fun ways to DrDoS
RE: NTP DDoS Amplification Vector - misnar - 03-12-2014
Let's see how long it takes until SNMP is whored out too.
RE: NTP DDoS Amplification Vector - Cipher - 03-12-2014
(03-12-2014, 05:34 AM)misnar Wrote: Let's see how long it takes until SNMP is whored out too.
I'm guessing it will happen very very very soon after someone releases a script and scanner/bruter for the public.
RE: NTP DDoS Amplification Vector - w00t - 03-12-2014
I shall keep my SNMP code all to myself.
I'm surprised there hasn't been any real market demand for DrDoS exploits, since there has been all this press about massive attacks using them.
RE: NTP DDoS Amplification Vector - Cipher - 03-12-2014
(03-12-2014, 05:29 AM)w00t Wrote: A good dns server can reflect at more than 30 times.
Cool nontheless, there are lots of fun ways to DrDoS
DNS is nothing in comparison.
RE: NTP DDoS Amplification Vector - Adorapuff - 03-12-2014
A sample attack script is https://github.com/vpnguy/ntpdos/blob/master/ntpdos.py
and to find servers you can use the nmap module ntp-monlist http://nmap.org/nsedoc/scripts/ntp-monlist.html.
Great tutorial, I don't DDos, but I might post some IPs later.