> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/ntp.md).

# NTP

**NTP** is used to synchronize the clocks of computers to a reference time source. Misconfigured NTP servers can leak internal network information or be used in amplification attacks (DDoS).

***

### Default NTP Port

| Port | Protocol | Description                 |
| ---- | -------- | --------------------------- |
| 123  | UDP      | NTP – Network Time Protocol |

***

### Initial NTP Port Scan

Use Nmap to detect NTP services:

```bash
nmap -sU -p 123 -sV <target-ip>
```

***

### Nmap NSE Scripts for NTP

```bash
nmap -sU -p 123 --script=ntp-info <target-ip>
```

| Script     | Description                                          |
| ---------- | ---------------------------------------------------- |
| `ntp-info` | Retrieves time server info: version, OS, peers, etc. |

***

### Banner Grabbing with `ntpq`

If the server allows remote queries, use `ntpq`:

```bash
ntpq -c rv <target-ip>
ntpq -c peers <target-ip>
ntpq -c assoc <target-ip>
```

| Command | Purpose                                    |
| ------- | ------------------------------------------ |
| `rv`    | Displays system variables and version info |
| `peers` | Shows NTP peers (can leak internal IPs)    |
| `assoc` | Shows association IDs for further analysis |

Example:

```bash
ntpq -p <target-ip>
```

***

### NTP Amplification DDoS Risk

Use `ntpdc` to check for monlist (monitor list) functionality, which is vulnerable to amplification:

```bash
ntpdc -n -c monlist <target-ip>
```

#### `ntpdate`

`ntpdate` is a command-line utility used to manually synchronize a system's time with an NTP server. It can also be used to test whether a remote NTP server is reachable and responding.

***

#### Syntax

```bash
ntpdate -q <target-ip>
```

***

#### Example Output

```bash
server 192.168.1.100, stratum 2, offset -0.002341, delay 0.02689
10 Apr 15:47:21 ntpdate[3271]: adjust time server 192.168.1.100 offset -0.002341 sec
```