rapid7/metasploit-framework — pull request #3946 by jhart-r7 (2014-10-03 20:59:08+00:00)
Title: Update NTP readvar module to detect DRDoS, UDPScanner to be faster

NTP readvar came across my radar for a bit today, so I took a quick look at the msf coverage. It is missing some of the UDP/NTP/etc improvements made elsewhere so I took the time to update it. It is not faster, reports vulns and cleaner.

Since I basically rewrote the entire thing, should I update the authors? Or is Authors the original authors only?

To validate this, scan a host known to respond to readvar requests.

Before, you'd see that it prints to the console but stores nothing:

```
msf auxiliary(ntp_readvar) > run

[*] Connecting target 10.4.30.25:123...
[*] Sending command
[+] 10.4.30.25:123 - system="cisco"
[+] 10.4.30.25:123 - leap=3
[+] 10.4.30.25:123 - stratum=16
[+] 10.4.30.25:123 - rootdelay=0.00
[+] 10.4.30.25:123 - rootdispersion=0.00
[+] 10.4.30.25:123 - peer=0
[+] 10.4.30.25:123 - refid=0.0.0.0
[+] 10.4.30.25:123 - reftime=0x00000000.00000000
[+] 10.4.30.25:123 - poll=4
[+] 10.4.30.25:123 - clock=0xAF5E1628.4D029033
[+] 10.4.30.25:123 - phase=0.000
[+] 10.4.30.25:123 - freq=0.00
[+] 10.4.30.25:123 - error=0.00
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ntp_readvar) > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----

msf auxiliary(ntp_readvar) > notes
msf auxiliary(ntp_readvar) > vulns

```
After, you see:

```
msf auxiliary(ntp_readvar) > run

[+] a.b.c.d:123 - Vulnerable to NTP Mode 6 READVAR DRDoS: No packet amplification and a 17x, 200-byte bandwidth amplification
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ntp_readvar) > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----
a.b.c.d 123 udp ntp open "system=\"cisco\", leap=3, stratum=16, rootdelay=0.00, rootdispersion=0.00,\r\npeer=0, refid=0.0.0.0, reftime=0x00000000.00000000, poll=4,\r\nclock=0xAF5E121E.7EE6D2DB, phase=0.000, freq=0.00, error=0.00\r\n"

msf auxiliary(ntp_readvar) > notes
msf auxiliary(ntp_readvar) > vulns
[*] Time: 2014-10-03 20:16:29 UTC Vuln: host=a.b.c.d name=NTP Mode 6 READVAR DRDoS refs=URL-http://www.rapid7.com/vulndb/lookup/ntp-clock-variables-disclosure
```