Tuesday, September 24, 2019

Exploring NTP servers

The ntpupdate command is used for updating your system time from a remote NTP server

root@asus:~/unix% ntpdate -d 48.21.33.124
24 Sep 11:12:41 ntpdate[18621]: ntpdate 4.2.8p4@1.3265-o Fri Jul  6 20:10:56 UTC 2018 (1)
Looking for host 48.21.33.124 and service ntp
48.21.33.124 reversed to ntp.acme.com
host found : ntp.acme.com
transmit(48.21.33.124)
receive(48.21.33.124)
transmit(48.21.33.124)
receive(48.21.33.124)
transmit(48.21.33.124)
receive(48.21.33.124)
transmit(48.21.33.124)
receive(48.21.33.124)
server 48.21.33.124, port 123
stratum 2, precision -22, leap 00, trust 000
refid [48.21.33.124], delay 0.02568, dispersion 0.00002
transmitted 4, in filter 4
reference time:    e134cbc9.cb958ac6  Tue, Sep 24 2019 11:07:21.795
originate timestamp: e134cd0f.ac4c0844  Tue, Sep 24 2019 11:12:47.673
transmit timestamp:  e134cd0f.ac3db00b  Tue, Sep 24 2019 11:12:47.672
filter delay:  0.02583  0.02579  0.02568  0.02579 
         0.00000  0.00000  0.00000  0.00000 
filter offset: 0.000014 -0.00001 0.000008 -0.00003
         0.000000 0.000000 0.000000 0.000000
delay 0.02568, dispersion 0.00002
offset 0.000008

24 Sep 11:12:47 ntpdate[18621]: adjust time server 48.21.33.124 offset 0.000008 sec
root@asus:~/unix% 

Using ntptrace like traceroute

The ntptrace utility works like traceroute, reporting the links in the chain to the local NTP server.

root@asus:~/unix% ntptrace
ntp.acme.com: stratum 2, offset 0.004367, synch distance 0.045800
69.89.207.99: timed out, nothing received
***Request timed out
root@asus:~/unix% 

Using ntpq to query the remote NTP server

The ntpq utility is for diagnostic and information gathering on a specific NTP server. It has an interface similar to that of ftp and smb. Commands can be run from the command line with the '-c' option instead of working in the ntpq console.

root@asus:~/unix% ntpq
ntpq> help
ntpq commands:
:config          exit             mreadvar         reslist          
addvars          help             mrl              rl               
apeers           host             mrulist          rmvars           
associations     hostnames        mrv              rv               
authenticate     ifstats          ntpversion       saveconfig       
authinfo         iostats          opeers           showvars         
cl               kerninfo         passociations    sysinfo          
clearvars        keyid            passwd           sysstats         
clocklist        keytype          peers            timeout          
clockvar         lassociations    poll             timerstats       
config-from-file lopeers          pstats           version          
cooked           lpassociations   quit             writelist        
cv               lpeers           raw              writevar         
debug            monstats         readlist         
delay            mreadlist        readvar          
ntpq> exit
root@asus:~/unix%

We can list the peers of the NTP with the 'peers' option

root@asus:~/unix% ntpq -c peers 48.21.33.124
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 0.us.pool.ntp.o .POOL.          16 p    -   64    0    0.000    0.000   0.000
 1.us.pool.ntp.o .POOL.          16 p    -   64    0    0.000    0.000   0.000
 2.us.pool.ntp.o .POOL.          16 p    -   64    0    0.000    0.000   0.000
 3.us.pool.ntp.o .POOL.          16 p    -   64    0    0.000    0.000   0.000
 ntp.ubuntu.com  .POOL.          16 p    -   64    0    0.000    0.000   0.000
+t1.time.gq1.yah 208.71.46.33     2 u   17   64  377   45.844   -0.416   2.455
-time.airgapped. 252.74.143.178   2 u   12   64  357   35.072    2.880  11.748
-hydra.spiderspa 142.66.101.13    2 u   12   64  377   47.258    6.998   2.777
*ntp1.wiktel.com .PPS.            1 u   19   64  377   59.587    0.386   2.643
+x.ns.gin.ntt.ne 249.224.99.213   2 u    6   64  377   30.873   -0.577   1.624
root@asus:~/unix% 

We can list the system info with the 'sysinfo' command

root@asus:~/unix% ntpq -c sysinfo 48.21.33.124
associd=0 status=0615 leap_none, sync_ntp, 1 event, clock_sync,
system peer:        ntp1.wiktel.com:123
system peer mode:   client
leap indicator:     00
stratum:            2
log2 precision:     -22
root delay:         59.587
root dispersion:    5.909
reference ID:       69.89.207.99
reference time:     e134cd50.53825fcb  Tue, Sep 24 2019 11:13:52.326
system jitter:      1.173226
clock jitter:       2.882
clock wander:       0.633
broadcast delay:    0.000
symm. auth. delay:  0.000
root@asus:~/unix% 

Theres a whole host of options in the ntpq console at your disposal to find out some interesting information from NTP servers.

No comments:

Post a Comment

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...