DΛΣMӨП

// HackTricks · Network Services

123/udp - Pentesting NTP

123/udp - Pentesting NTP

Basic Information

The Network Time Protocol (NTP) ensures computers and network devices across variable-latency networks sync their clocks accurately. It’s vital for maintaining precise timekeeping in IT operations, security, and logging. Because time is used in nearly every authentication, crypto-protocol and forensic process, an attacker that can influence NTP can often bypass security controls or make attacks harder to investigate.

Summary & Security Tips

  • Purpose: Syncs device clocks over networks.
  • Importance: Critical for security, logging, crypto-protocols and distributed systems.
  • Security Measures:
    • Use trusted NTP or NTS (Network Time Security) sources with authentication.
    • Restrict who can query/command the daemon (restrict default noquery, kod etc.).
    • Restrict Mode-6 (ntpq) and legacy Mode-7 (ntpdc/monlist) control queries or rate-limit them.
    • Monitor synchronization drift/leap-second state for tampering.
    • Keep the daemon updated (see recent CVEs below).

Default ports

123/udp   NTP            (data + legacy control)
323/udp   chronyd command/monitoring protocol (when remotely bound)
4460/tcp  NTS-KE (RFC 8915) – TLS key-establishment for NTP
PORT    STATE SERVICE REASON
123/udp open  ntp     udp-response

Enumeration

Classic ntpd control protocols (Mode 6/7)

# Information & variables
ntpq -c rv <IP>
ntpq -c readvar <IP>
ntpq -c peers <IP>
ntpq -c associations <IP>

# Legacy mode-7 (often disabled >=4.2.8p9)
ntpdc -c monlist <IP>
ntpdc -c listpeers <IP>
ntpdc -c sysinfo  <IP>

chrony / chronyc (UDP/323)

chronyc does not send these commands to UDP/123: the default chronyd command port is 323/udp. Remote access additionally requires a non-loopback bindcmdaddress and a matching cmdallow; chrony 4.7+ can further restrict exposed reports with opencommands. The -a switch seen in old examples is now ignored. Scan and query this surface separately.[9][11]

nmap -sU -sV -p 323 <IP>
chronyc -n -h <IP> tracking
chronyc -n -h <IP> sources -v
chronyc -n -h <IP> sourcestats
chronyc -n -h <IP> activity

Only the configured monitoring commands are reachable over the network; commands which alter daemon state remain Unix-socket-only. Reports such as sources, tracking, ntpdata, clients, and serverstats can reveal upstream addresses, clock quality, client activity, and rate-limit state when an operator has exposed them.[9][11]

Nmap

# Safe discovery & vuln detection
nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 <IP>

# Explicit monlist check
nmap -sU -p123 --script ntp-monlist <IP>

Mass/Internet scanning

# Check if MONLIST is enabled (zgrab2 module)
zgrab2 ntp --monlist --timeout 3 --output-file monlist.json -f "zmap_results.csv"

Examine configuration files

  • /etc/ntp.conf (ntpd)
  • /etc/chrony/chrony.conf (chrony)
  • /etc/systemd/timesyncd.conf (timesyncd – client only)

Pay special attention to restrict lines, kod (Kiss-o’-Death) settings, disable monitor/includefile /etc/ntp/crypto and whether NTS is enabled (nts enable). For chrony, audit bindcmdaddress, cmdport, cmdallow/cmddeny, opencommands, and cmdratelimit; allow controls NTP clients and is independent from cmdallow.[11]

Selected Vulnerabilities and Operational Risks

YearCVEComponentImpact
2023CVE-2023-26551 through CVE-2023-26555ntp 4.2.8p15 and earlierSeveral low-severity parsing and bounds-checking flaws fixed in 4.2.8p16; upgrade or back-port the vendor fixes.[5]
2023CVE-2023-33192ntpd-rs (Rust implementation)Malformed NTS cookie causes remote DoS prior to v0.3.3 – affects port 123 even when NTS disabled.[6]
2024distro updateschrony 4.4 / 4.5 – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022)[7]
2025CVE-2025-58066ntpd-rs 1.2.0–1.6.1, server modeA response/request validation error can turn two exposed servers into a persistent packet loop; fixed in 1.6.2.[14]
2014NTP reflection at scaleCloudflare documented a 400 Gbps NTP amplification attack that abused exposed monlist responders. Keep monitoring queries inaccessible from untrusted networks.[3]

The 2023 ntp.org group contains two distinct attack surfaces. CVE-2023-26551 through CVE-2023-26554 are out-of-bounds writes in libntp/mstolfp.c; their records describe a malicious server attacking the client-side ntpq process, not ntpd. CVE-2023-26555 affects praecis_parse() in the Palisade reference-clock driver and requires a more specialized input path, such as a manipulated GPS receiver.[5][12][13]

Operator exposure: Because CVE-2023-26551 through CVE-2023-26554 are client-side ntpq parsing flaws, querying an untrusted or attacker-controlled NTP server is the dangerous direction. Avoid pointing an unpatched diagnostic client at arbitrary Internet hosts; use 4.2.8p16 or a vendor-backported fix.[5][12]

Advanced Attacks

1. NTP Amplification / Reflection

The legacy Mode-7 monlist query can return information about up to 600 recent clients. A small spoofed request can therefore trigger a much larger multi-packet response, producing amplification factors in the hundreds in vulnerable configurations.[3][4] Mitigations:

  • Upgrade to a supported release (at least 4.2.8p16 for the 2023 fixes) and add disable monitor where legacy monitoring is unnecessary.
  • Rate-limit UDP/123 on the edge or enable sessions-required on DDoS appliances.
  • Enable BCP 38 egress filtering to block source spoofing.

See Cloudflare’s learning-center article for a step-by-step breakdown.[4]

2. Time-Shift / Delay attacks (Khronos / Chronos research)

Even with authentication, an on-path attacker can attempt to shift the client clock by dropping or delaying packets. RFC 9523’s Khronos mechanism queries a large, diverse server pool and periodically applies a robust selection algorithm to resist time-shifting attacks.[8] Chrony’s maxdistance, maxjitter, and minsources controls are useful source-selection safeguards, but they are configuration controls rather than an implementation of Khronos.[11]

3. NTS abuse & 4460/tcp exposure

NTS moves the heavy crypto to a separate TLS 1.3 channel on 4460/tcp (ntske/1). Poor implementations (see CVE-2023-33192) crash when parsing cookies or allow weak ciphers. Pentesters should:

# TLS reconnaissance
nmap -sV -p 4460 --script ssl-enum-ciphers,ssl-cert <IP>

# Grab banner & ALPN
openssl s_client -connect <IP>:4460 -alpn ntske/1 -tls1_3 -ign_eof

Look for certificate-validation failures, unexpected trust anchors, missing ntske/1 ALPN negotiation, and implementation-specific parsing failures. RFC 8915 requires TLS 1.3 or later for NTS-KE and separately negotiates an AEAD algorithm for protected NTP packets.[1]

4. Response-loop / message-storm DoS

Do not assume that every packet received on UDP/123 is a client request. In ntpd-rs 1.2.0 through 1.6.1, a server replied even to server response packets. An attacker able to spoof the address of exposed server B in one such packet to server A could make A and B continuously reply to each other. This is a distinct primitive from amplification: the initial spoofed packet creates a self-sustaining two-node loop.[14]

Treat active validation as disruptive. In an authorized lab, first inventory versions/configuration and watch for alternating UDP/123 traffic which continues without client requests:

sudo tcpdump -ni any 'udp port 123 and (host <SERVER_A> or host <SERVER_B>)'

The vulnerable range applies only when ntpd-rs is acting as a server and accepts non-NTS traffic. Upgrade to 1.6.2+; when patching is delayed, restrict clients and discard non-request NTP modes at the edge.[14]

5. Malicious pool servers and zone monopolization

Authentication protects packet origin and integrity, but it cannot make a deliberately malicious time server truthful. A 2026 measurement study found that only 19.7% of active NTP Pool servers were fully independent after grouping aliases, accounts, and network connectivity. Its capacity-informed model and ethical validation showed that 90% of country zones could have at least half of their pool traffic captured with ten or fewer maximum-capacity server registrations.[15]

Useful attacker primitives include cheap IPv6 aliases, declaring high netspeed, learning pool monitors while in monitor-only mode, returning correct time selectively to those monitors, and later skewing ordinary clients. Residual queries can also continue long after a server is removed because some clients retain its address. During an assessment, therefore, resolve pool names repeatedly from multiple vantage points and group answers by operator/account where known, ASN, prefix, physical alias, and IP family—four addresses are not four independent trust domains.[15]

For critical clients, prefer pinned, independently administered NTS servers rather than relying on multiple names from one pool or provider. Diversity must include administrative and network-path diversity, not only address count.[1][15]

Hardening / Best-Current-Practice (BCP-233 / RFC 8633)

Operators SHOULD:

  1. Use ≥ 4 independent, diverse time sources (public pools, GPS, PTP-bridges) to avoid single-source poisoning; several IPs behind one operator, ASN, or pool account are correlated sources.[15]
  2. Enable kod and limited/nomodify restrictions so abusive clients receive Kiss-o’-Death rate-limit packets instead of full responses.
  3. Monitor daemon logs for panic events or step adjustments > 1000 s. (Signatures of attack per RFC 8633 §5.3.)
  4. Consider leap-smear to avoid leap-second outages, but ensure all downstream clients use the same smear window.
  5. Keep polling ≤24 h so leap-second flags are not missed.
  6. Keep chronyd command access on loopback where possible. Otherwise firewall UDP/323, narrowly scope cmdallow, expose only required opencommands, and retain cmdratelimit.[11]

See RFC 8633 for a comprehensive checklist.[2]

Shodan / Censys Dorks

port:123 "ntpd"          # Version banner
udp port:123 monlist:true # Censys tag for vulnerable servers
port:4460 "ntske"         # NTS-KE

Useful Tools

ToolPurposeExample
zgrab2 ntpMass scanning / JSON output including monlist flag[10]See command above
chronyd with local + allowRun a controlled NTP server in a pentest labSee configuration below
Packet-crafting frameworksBuild or replay NTP packets in an authorized lab after establishing an on-path positionValidate the packet fields and timing effect with a capture

chronyd -q sets the local clock once and exits; it does not create a test server. A minimal isolated-lab server can instead be started with:[11]

cat >/tmp/chrony-lab.conf <<'EOF'
local stratum 8
allow 192.0.2.0/24
bindaddress 192.0.2.10
EOF
sudo chronyd -d -f /tmp/chrony-lab.conf

HackTricks Automatic Commands

Protocol_Name: NTP
Port_Number: 123
Protocol_Description: Network Time Protocol

Entry_1:
  Name: Notes
  Description: Notes for NTP
  Note: |
    The Network Time Protocol (NTP) ensures computers and network devices across variable-latency networks sync their clocks accurately. It's vital for maintaining precise timekeeping in IT operations, security, and logging. NTP's accuracy is essential, but it also poses security risks if not properly managed.

    https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-ntp.html

Entry_2:
  Name: Nmap
  Description: Enumerate NTP
  Command: nmap -sU -sV --script "ntp* and (discovery or vuln) and not (dos or brute)" -p 123 {IP}

References