rapid7/metasploit-framework — pull request #3443 by jhart-r7 (2014-06-11 20:52:30+00:00)
Title: Initial commit of an NTP fuzzer

I wrote this to help me understand NTP a little better as well as try to find protocol anomalies that might be vulnerabilities.

The only bug I know about in this module right now is that it tries to lookup the hostname *every* time a probe is sent which seems like a really bad idea to me. I don't know how to fix this offhand so any pointers would be appreciated. If DNS happens to go south mid-fuzz this can cause the fuzzing to cease.

Sample output:

```
[*] cisco2620.vuln:123 fuzzing version and mode combinations
[*] cisco2620.vuln:123 -- Received 48-byte version 1 mode 4 reply to 48-byte version 1 mode 3 packet
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 48-byte version 1 mode 7 packet: version mismatch
....
[*] cisco2620.vuln:123 -- Received 48-byte version 2 mode 2 reply to 48-byte version 2 mode 1 packet

[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 48-byte version 4 mode 7 packet: version mismatch
[*] cisco2620.vuln:123 -- Received 48-byte version 5 mode 4 reply to 48-byte version 5 mode 3 packet
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 48-byte version 5 mode 7 packet: version mismatch
[*] cisco2620.vuln:123 -- Received 48-byte version 6 mode 2 reply to 48-byte version 6 mode 1 packet
[*] cisco2620.vuln:123 -- Received 48-byte version 6 mode 4 reply to 48-byte version 6 mode 3 packet
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 48-byte version 6 mode 7 packet: version mismatch
[*] cisco2620.vuln:123 -- Received 48-byte version 7 mode 2 reply to 48-byte version 7 mode 1 packet
[*] cisco2620.vuln:123 -- Received 48-byte version 7 mode 4 reply to 48-byte version 7 mode 3 packet
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 48-byte version 7 mode 7 packet: version mismatch
[*] cisco2620.vuln:123 fuzzing short version and mode combinations
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to 4-byte short version 1 mode 7 packet: large response,version mismatch
...
[*] cisco2620.vuln:123 fuzzing short messages
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to Short 0-byte random packet: large response,version mismatch
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to Short 2-byte random packet: large response,version mismatch
[*] cisco2620.vuln:123 fuzzing random messages
[+] cisco2620.vuln:123 -- Received 8-byte version 3 mode 7 reply to random 48-byte packet: version mismatch
[*] cisco2620.vuln:123 fuzzing control messages (mode 6)
[*] cisco2620.vuln:123 -- Received 12-byte version 1 mode 6 reply to 12-byte version 1 mode 6 op 0 packet
[+] cisco2620.vuln:123 -- Received 16-byte version 1 mode 6 reply to 12-byte version 1 mode 6 op 1 packet: large response
[+] cisco2620.vuln:123 -- Received 228-byte version 1 mode 6 reply to 12-byte version 1 mode 6 op 2 packet: large response
[*] cisco2620.vuln:123 -- Received 12-byte version 1 mode 6 reply to 12-byte version 1 mode 6 op 3 packet