ntpirate

Proof of concept for an NTP Autokey vulnerability

Requirements

• OpenSSL
• libpcap

Usage

This sample exploit assumes the following network topology:

• Your machine is a man-in-the-middle between an ntp client (alice) and server (bob)
• The packets from alice and bob arrive on the same interface $i, but are not forwarded to each other
• E.g. if you have interface $i0 for alice and $i1 for bob, create a bridge interface $i and use ebtables to drop ntp packets

ntpirate will listen on a given device for ntp packets using libpcap and forward/spoof them as needed.

Just start it with ./ntpirate $i [time_offset [rsa_key_file]]

If no key_file is given, one will be created on startup.