Network Time Protocol Daemon (ntpd) monlist Command Enabled DoS

#!/usr/bin/env bash
# noisgate: CVE-2013-5211 / Tenable 71783 monlist reflection check
# Usage: ./check_ntp_monlist.sh <target-ip-or-host>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target-ip-or-host>" >&2
  exit 2
fi

# Method 1: ntpdc monlist (works even with modern OpenNTPD/legacy ntpd)
if command -v ntpdc >/dev/null 2>&1; then
  RESP=$(timeout 5 ntpdc -n -c monlist "$TARGET" 2>&1)
  if echo "$RESP" | grep -qiE 'remote address|client|mode'; then
    echo "VULNERABLE: $TARGET responded to monlist with peer data"
    echo "$RESP" | head -5
    exit 1
  fi
  if echo "$RESP" | grep -qiE 'timed out|no server|Connection refused|not found'; then
    :
  else
    # ntpdc responded but returned no rows - could be empty monlist (still vulnerable) or refused
    if echo "$RESP" | grep -qiE 'authentication|access denied|no data'; then
      echo "PATCHED: $TARGET refused monlist (access denied / disabled)"
      exit 0
    fi
  fi
fi

# Method 2: nmap NSE fallback
if command -v nmap >/dev/null 2>&1; then
  NRESP=$(timeout 15 nmap -sU -pU:123 -Pn --script=ntp-monlist "$TARGET" 2>&1)
  if echo "$NRESP" | grep -qi 'Public Servers\|Other Associations\|ntp-monlist:'; then
    if echo "$NRESP" | grep -A2 'ntp-monlist' | grep -qE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'; then
      echo "VULNERABLE: $TARGET nmap ntp-monlist returned peer entries"
      exit 1
    fi
  fi
  if echo "$NRESP" | grep -qi '123/udp open'; then
    echo "PATCHED (or hardened): UDP/123 open but monlist did not return peer data"
    exit 0
  fi
fi

echo "UNKNOWN: could not conclusively probe $TARGET (host unreachable, UDP/123 filtered, or tools missing)"
exit 2