1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
local comm = require "comm"
local datetime = require "datetime"
local os = require "os"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
local lpeg = require "lpeg"
local U = require "lpeg-utility"
description = [[
Gets the time and configuration variables from an NTP server. We send two
requests: a time request and a "read variables" (opcode 2) control message.
Without verbosity, the script shows the time and the value of the
<code>version</code>, <code>processor</code>, <code>system</code>,
<code>refid</code>, and <code>stratum</code> variables. With verbosity, all
variables are shown.
See RFC 1035 and the Network Time Protocol Version 4 Reference and
Implementation Guide
(http://www.eecis.udel.edu/~mills/database/reports/ntp4/ntp4.pdf) for
documentation of the protocol.
]]
---
-- @usage
-- nmap -sU -p 123 --script ntp-info <target>
-- @output
-- PORT STATE SERVICE VERSION
-- 123/udp open ntp NTP v4.2.4p4@1.1520-o
-- | ntp-info:
-- | receive time stamp: Sat Dec 12 16:22:41 2009
-- | version: ntpd 4.2.4p4@1.1520-o Wed May 13 21:06:31 UTC 2009 (1)
-- | processor: x86_64
-- | system: Linux/2.6.24-24-server
-- | stratum: 2
-- |_ refid: 195.145.119.188
--
-- @xmloutput
-- <elem key="receive time stamp">2013-10-18T18:03:05</elem>
-- <elem key="version">ntpd 4.2.6p3@1.2290-o Tue Jun 5 20:12:11 UTC 2012 (1)</elem>
-- <elem key="processor">i686</elem>
-- <elem key="system">Linux/3.9.3-24</elem>
-- <elem key="leap">3</elem>
-- <elem key="stratum">16</elem>
-- <elem key="precision">-20</elem>
-- <elem key="rootdelay">0.000</elem>
-- <elem key="rootdisp">2502.720</elem>
-- <elem key="refid">INIT</elem>
-- <elem key="reftime">0x00000000.00000000</elem>
-- <elem key="clock">0xd60bf655.4cc0ba51</elem>
-- <elem key="peer">0</elem>
-- <elem key="tc">3</elem>
-- <elem key="mintc">3</elem>
-- <elem key="offset">0.000</elem>
-- <elem key="frequency">-46.015</elem>
-- <elem key="jitter">0.001</elem>
-- <elem key="wander">0.000</elem>
author = "Richard Sammet"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
portrule = shortport.port_or_service(123, "ntp", {"udp", "tcp"})
-- This script run against open|filtered ports, so don't wait too long if
-- there's no response.
local TIMEOUT = 5000
-- Only these fields from the response are displayed with default verbosity.
local DEFAULT_FIELDS = {"version", "processor", "system", "refid", "stratum"}
-- comma-space-separated key=value pairs with optional quotes
local kvmatch = U.localize( {
lpeg.V "space"^0 * lpeg.V "kv" * lpeg.P ","^-1,
kv = lpeg.V "key" * lpeg.P "="^-1 * lpeg.V "value",
key = lpeg.C( (lpeg.V "alnum" + lpeg.S "_-.")^1 ),
value = U.escaped_quote() + lpeg.C((lpeg.P(1) - ",")^0),
} )
action = function(host, port)
local status
local buftres, bufrlres
local output = stdnse.output_table()
-- This is a ntp v2 mode3 (client) date/time request.
local treq = string.char(0xd3, 0x00, 0x04, 0xfa, 0x00, 0x01, 0x00, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00)
-- This is a ntp v2 mode6 (control) rl (readlist/READVAR(2)) request. See
-- appendix B of RFC 1305.
local rlreq = string.char(0x16, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00)
status, buftres = comm.exchange(host, port, treq, {timeout=TIMEOUT})
if status then
local recvtime = os.time()
local sec, frac = string.unpack(">I4I4", buftres, 33)
-- The NTP epoch is 1900-01-01, so subtract 70 years to bring the date into
-- the range Lua expects. The number of seconds at 1970-01-01 is taken from
-- the NTP4 reference above.
local tstamp = sec - 2208988800 + frac / 0x10000000
datetime.record_skew(host, tstamp, recvtime)
output["receive time stamp"] = datetime.format_timestamp(tstamp)
end
status, bufrlres = comm.exchange(host, port, rlreq, {timeout=TIMEOUT})
if status then
-- This only looks at the first fragment of what can possibly be several
-- fragments in the response.
-- Skip the first 10 bytes of the header, then get the data which is
-- preceded by a 2-byte length.
local data = string.unpack(">s2", bufrlres, 11)
-- loop over capture pairs which represent (key, value)
local function accumulate_output (...)
local k, v = ...
if k == nil then return end
output[k] = v
return accumulate_output(select(3, ...))
end
-- do the match and accumulate the captures
local list = kvmatch^0 / accumulate_output
list:match(data)
end
if(#output > 0) then
stdnse.debug1("Test len: %d", #output)
nmap.set_port_state(host, port, "open")
if output['version'] then
-- Look for the version string from the official ntpd and format it
-- in a manner similar to the output of the standard Nmap version detection
local version_num = string.match(output['version'],"^ntpd ([^ ]+)")
if version_num then
port.version.version = "v" .. version_num
nmap.set_port_version(host, port, "hardmatched")
end
end
if output['system'] then
port.version.ostype = output['system']
nmap.set_port_version(host, port, "hardmatched")
end
if nmap.verbosity() < 1 then
local mt = getmetatable(output)
mt["__tostring"] = function(t)
local out = {}
for _,k in ipairs(DEFAULT_FIELDS) do
if output[k] ~= nil then
table.insert(out, ("%s: %s"):format(k, output[k]))
end
end
return "\n " .. table.concat(out, "\n ")
end
end
return output
else
return nil
end
end
|
