# Sandman | NTP Based Backdoor For Red Team Engagements In Hardened Networks

**URL:** <https://onehack.st/t/sandman-ntp-based-backdoor-for-red-team-engagements-in-hardened-networks/227729>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, freebies, networking\
**Created:** [October 31, 2022, 8:08pm UTC](https://onehack.st/t/sandman-ntp-based-backdoor-for-red-team-engagements-in-hardened-networks/227729 "2022-10-31T20:08:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [October 31, 2022, 8:08pm UTC](https://onehack.st/t/sandman-ntp-based-backdoor-for-red-team-engagements-in-hardened-networks/227729/1 "2022-10-31T20:08:10Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/0/b/0b6b8936e337925223b6bb53f9745e5ed97725b8.jpeg)

[![Image](https://camo.githubusercontent.com/77fb0fe92af30fe29049394fa804295fd61acf9d29dcf50d60c07501032878bc/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f432532332d3233393132303f7374796c653d666f722d7468652d6261646765266c6f676f3d632d7368617270266c6f676f436f6c6f723d7768697465253232)](https://camo.githubusercontent.com/77fb0fe92af30fe29049394fa804295fd61acf9d29dcf50d60c07501032878bc/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f432532332d3233393132303f7374796c653d666f722d7468652d6261646765266c6f676f3d632d7368617270266c6f676f436f6c6f723d7768697465253232) [![image](https://camo.githubusercontent.com/94be0a2e5be142925615e5821d97137a930d08fc154962ce43860f1957e6661e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f507974686f6e2d3337373641423f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/94be0a2e5be142925615e5821d97137a930d08fc154962ce43860f1957e6661e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f507974686f6e2d3337373641423f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d7768697465) [![image](https://camo.githubusercontent.com/41281b9a32f13ac5b9d41ed9bae12c0de662f948f9bf59fd19df354fe49af146/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f57696e646f77732d3030373844363f7374796c653d666f722d7468652d6261646765266c6f676f3d77696e646f7773266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/41281b9a32f13ac5b9d41ed9bae12c0de662f948f9bf59fd19df354fe49af146/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f57696e646f77732d3030373844363f7374796c653d666f722d7468652d6261646765266c6f676f3d77696e646f7773266c6f676f436f6c6f723d7768697465)

Sandman is a backdoor that is meant to work on hardened networks during red team engagements.

Sandman works as a stager and leverages NTP (a protocol to sync time & date) to get and run an arbitrary **shellcode** from a pre-defined server.

Since NTP is a protocol that is overlooked by many defenders resulting in wide network accessibility.

## Usage

[![Sandman](https://github.com/Idov31/Sandman/raw/master/images/sandman.png)](https://github.com/Idov31/Sandman/blob/master/images/sandman.png)

### SandmanServer (Usage)

Run on windows / \*nix machine:

python3 sandman\_server.py “Network Adapter” “Payload Url” “optional: ip to spoof”

- Network Adapter: The adapter that you want the server to listen on (for example Ethernet for Windows, eth0 for \*nix).
- Payload Url: The URL to your shellcode, it could be your agent (for example, CobaltStrike or meterpreter) or another stager.
- IP to Spoof: If you want to spoof a legitimate IP address (for example, [time.microsoft.com](http://time.microsoft.com)’s IP address).

### SandmanBackdoor (Usage)

To start, you can compile the SandmanBackdoor as [mentioned below](https://github.com/Idov31/Sandman#setup), because it is a single lightweight C# executable you can execute it via ExecuteAssembly, run it as an NTP provider or just execute/inject it.

### SandmanBackdoorTimeProvider (Usage)

To use it, you will need to follow simple steps:

- Add the following registry value:

reg add “HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient” /v DllName /t REG\_SZ /d “C:\Path\To\TheDll.dll”

- Restart the w32time service:

sc stop w32time sc start w32time

**NOTE: Make sure you are compiling with the x64 option and not any CPU option!**

## Capabilities

- Getting and executing an arbitrary payload from an attacker’s controlled server.
- Can work on hardened networks since NTP is usually allowed in FW.
- Impersonating a legitimate NTP server via IP spoofing.

## Setup

### SandmanServer (Setup)

- Python 3.9
- The requirements are specified in the [requirements](https://github.com/Idov31/Sandman/blob/master/SandmanServer/requirements.txt) file.

### SandmanBackdoor (Setup)

To compile the backdoor I used Visual Studio 2022, but as mentioned in the [usage section](https://github.com/Idov31/Sandman#usage) it can be compiled with both VS2022 and CSC. You can compile it either using the USE\_SHELLCODE and use Orca’s shellcode or without USE\_SHELLCODE to use WebClient.

### SandmanBackdoorTimeProvider (Setup)

To compile the backdoor I used Visual Studio 2022, you will also need to install [DllExport](https://github.com/3F/DllExport) (via Nuget or any other way) to compile it. You can compile it either using the USE\_SHELLCODE and use Orca’s shellcode or without USE\_SHELLCODE to use WebClient.

## IOCs

- A shellcode is injected into RuntimeBroker.
- Suspicious NTP communication starts with a known magic header.
- YARA rule.

## Contributes

- [Orca](https://github.com/ORCx41/) for the shellcode.
- Special thanks to [Tim McGuffin](https://twitter.com/NotMedic) for the [time provider idea](https://twitter.com/NotMedic/status/1561354598744473601).

Thanks to those who already contributed and I’ll happily accept contributions, make a pull request and I will review it!

## GitHub:

> **[GitHub - Idov31/Sandman: Sandman is a NTP based backdoor for hardened...](https://github.com/Idov31/Sandman)**
>
> Sandman is a NTP based backdoor for hardened networks.