ICMP Timestamp Request Remote Date Disclosure

#!/usr/bin/env python3
"""
icmp_ts_check.py - Verify whether a host replies to ICMP Timestamp Requests (type 13)
Exit codes:
  0 = PATCHED / no timestamp reply observed
  1 = VULNERABLE / timestamp reply observed
  2 = UNKNOWN / execution error or insufficient privileges
"""

import os
import socket
import struct
import sys
import time
import select
import random
from datetime import datetime, timezone

ICMP_TIMESTAMP_REQUEST = 13
ICMP_TIMESTAMP_REPLY = 14
TIMEOUT = 3.0


def checksum(data: bytes) -> int:
    if len(data) % 2:
        data += b"\x00"
    s = 0
    for i in range(0, len(data), 2):
        s += (data[i] << 8) + data[i + 1]
    s = (s >> 16) + (s & 0xFFFF)
    s += s >> 16
    return (~s) & 0xFFFF


def ms_since_midnight_utc() -> int:
    now = datetime.now(timezone.utc)
    return ((now.hour * 3600 + now.minute * 60 + now.second) * 1000) + (now.microsecond // 1000)


def build_request(ident: int, seq: int) -> bytes:
    originate = ms_since_midnight_utc()
    # type, code, checksum, identifier, sequence, originate, receive, transmit
    header = struct.pack("!BBHHHIII", ICMP_TIMESTAMP_REQUEST, 0, 0, ident, seq, originate, 0, 0)
    csum = checksum(header)
    return struct.pack("!BBHHHIII", ICMP_TIMESTAMP_REQUEST, 0, csum, ident, seq, originate, 0, 0)


def recv_reply(sock: socket.socket, ident: int, seq: int, timeout: float):
    end = time.time() + timeout
    while time.time() < end:
        remaining = end - time.time()
        r, _, _ = select.select([sock], [], [], remaining)
        if not r:
            break
        packet, addr = sock.recvfrom(65535)
        if len(packet) < 20:
            continue
        ihl = (packet[0] & 0x0F) * 4
        icmp = packet[ihl:]
        if len(icmp) < 20:
            continue
        icmp_type, icmp_code, _, r_ident, r_seq, orig, recv_ts, xmit_ts = struct.unpack("!BBHHHIII", icmp[:20])
        if icmp_type == ICMP_TIMESTAMP_REPLY and icmp_code == 0 and r_ident == ident and r_seq == seq:
            return {
                "src": addr[0],
                "originate": orig,
                "receive": recv_ts,
                "transmit": xmit_ts,
            }
    return None


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: sudo python3 icmp_ts_check.py <ip-or-hostname>")
        sys.exit(2)

    target = sys.argv[1]

    try:
        dst_ip = socket.gethostbyname(target)
    except Exception as e:
        print(f"UNKNOWN - cannot resolve target: {e}")
        sys.exit(2)

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
        sock.settimeout(TIMEOUT)
    except PermissionError:
        print("UNKNOWN - raw socket requires root/Administrator")
        sys.exit(2)
    except Exception as e:
        print(f"UNKNOWN - socket error: {e}")
        sys.exit(2)

    ident = random.randint(0, 0xFFFF)
    seq = 1
    packet = build_request(ident, seq)

    try:
        sock.sendto(packet, (dst_ip, 0))
        reply = recv_reply(sock, ident, seq, TIMEOUT)
    except Exception as e:
        print(f"UNKNOWN - probe failed: {e}")
        sys.exit(2)
    finally:
        sock.close()

    if reply:
        print(f"VULNERABLE - received ICMP timestamp reply from {reply['src']} (recv_ts={reply['receive']}, xmit_ts={reply['transmit']})")
        sys.exit(1)
    else:
        print("PATCHED - no ICMP timestamp reply observed")
        sys.exit(0)


if __name__ == "__main__":
    main()