This fixes the auxiliary/scanner/ntp/ntp_nak_to_the_future module which was broken in commit 5f88971 (landed in #8185). The issue was that when the BinData::Record instance is sent with the socket, the string representation of it was used instead of the packed binary. It should be calling #to_binar_s. This PR fixes the issue and documents how the module can be tested.

This was the only module that used the NTPSymmetric definition and it's been converted to instead use the new NTPHeader definition which adds more natural handing for NTPTimestamp and NTPShort fields. The NTPHeader definition was originally written for #19748 and these two PRs share common commits in their history for the new definition.

Other NTP modules could be broken and have not been tested. NTPSymmetric had the most overlap with the definition needed for timeroast, so that was the only one that was thoroughly reviewed.

Verification

• Use the Dockerfile included in the module docs to start a vulnerable instance of the application
  • Build it with: docker build -t ntpd:4.2.8p3 .
  • Run it with: docker run --rm -it --name ntp-server -p 123:123/udp ntpd:4.2.8p3
• Start msfconsole and use the module
• Set the RHOSTS value as necessary
• Run the module and see that the target is vulnerable

Demo

metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) > run
[+] 192.168.159.128:123 - NTP - VULNERABLE: Accepted a NTP symmetric active association
[*] Scanned 1 of 2 hosts (50% complete)
[*] Scanned 1 of 2 hosts (50% complete)
[*] Scanned 1 of 2 hosts (50% complete)
[*] Scanned 1 of 2 hosts (50% complete)
[*] Scanned 1 of 2 hosts (50% complete)
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
metasploit-framework (S:0 J:0) auxiliary(scanner/ntp/ntp_nak_to_the_future) >