Skip to content
HackIndex logo

HackIndex

NTP Server Enumeration

2 min read Jan 4, 2026

NTP on UDP 123 often exposes version, peers, and stats on misconfigured servers. Responses leak internal IPs, upstream time sources, or enable reflection attacks. Positive info guides pivoting or time-based exploits.

Nmap NTP Probes

Comprehensive discovery and vuln checks:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 123 -sV --script "ntp* and (discovery or vuln)" $TARGET_IP

Version output identifies ntpd build; match against CVEs. Discovery scripts dump peers, system info, and variables.

Safe script subset avoids DoS:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 123 --script "ntp* and not (dos or brute)" $TARGET_IP

Manual Peer and Association Listing

List remote peers:

┌──(kali㉿kali)-[~]
└─$ ntpq -p $TARGET_IP

Columns show reachability, delay, offset, jitter. Internal IPs in remote column indicate private network leakage.

Detailed associations:

┌──(kali㉿kali)-[~]
└─$ ntpq -c peers $TARGET_IP

Same data; use when -p format cluttered.

Runtime and Clock Variables

Dump server variables:

┌──(kali㉿kali)-[~]
└─$ ntpq -c rv $TARGET_IP

Reveals version string explicitly, system uptime, clock offset, leap indicator. Version field fingerprints daemon precisely.

Configuration variables:

┌──(kali㉿kali)-[~]
└─$ ntpq -c readlist $TARGET_IP

Exposes restrict settings or mode 6 permissions on permissive servers.

Clock variables:

┌──(kali㉿kali)-[~]
└─$ ntpq -c cv $TARGET_IP

Low-level details for advanced analysis.

Clock Offset and Synchronization Check

Query without sync:

┌──(kali㉿kali)-[~]
└─$ ntpdate -q $TARGET_IP

Reports server offset, stratum, root delay. High stratum or large offset flags poor config or potential manipulation vector.

Force sync test:

┌──(kali㉿kali)-[~]
└─$ sudo ntpdate $TARGET_IP

Success confirms control query acceptance; affects local time for testing Kerberos skew.

Legacy Monlist Query

Old amplification vector; still responds on vulnerable ntpd:

┌──(kali㉿kali)-[~]
└─$ ntpdc -n -c monlist $TARGET_IP

Dumps recent clients; massive output on busy servers confirms reflection potential.

Basic Service Probe

Raw UDP poke:

┌──(kali㉿kali)-[~]
└─$ echo "" | nc -u -w1 $TARGET_IP 123

Any response confirms listening NTP daemon. Timeout suggests filtered or closed.