chronoleak 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4909841067ed65fe72ed30312f04d82b0e232299aa8c2e74f84116b3a462179e
+  data.tar.gz: f341b5fc125a0d0c3c64a253af6ba208e89d81ce6322d6dd60a67d864b49f8d3
+SHA512:
+  metadata.gz: b1abc9cbedbf2820a7e50db904fb6591cfe0a4cbe2c66532549bf4b9a5e083a220ce0b11f8886298eea5cdc020a2c3342938bc0e2f0d48677252b7cd3476c45b
+  data.tar.gz: a0dbc3164f45ac7ea9340d51c06d00b81ce2f99a8e6c7741d42a208e2421d034bb2a130cd5d040a10131ada4abed8d11f94bc022b86e0fc6e16e35cd1c594e4c

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Alexandre ZANNI (@noraj)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/bin/chronoleak

@@ -0,0 +1,36 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Project internal
+require 'chronoleak'
+
+if __FILE__ == $PROGRAM_NAME
+  log = ChronoLeak::TermLog.new
+  if ARGV.size == 1 && !['-h', '--help'].include?(ARGV.first)
+    ip_addr = ARGV.first
+    hping = "sudo hping3 #{ip_addr} --icmp --icmp-ts -c 1"
+    out = ''
+    Open3.popen3(hping) do |_stdin, stdout, stderr, _thread|
+      out = stdout.read
+      err = stderr.read
+      if /hping3: command not found/.match?(err)
+        log.fatal "hping not installed - 'hping3' command must be accessible in PATH"
+        log.fatal 'See the package for your distro on https://repology.org/project/hping/versions.'
+        raise(StandardError, "Command failed: #{hping}")
+      elsif /100% packet loss/.match?(err)
+        log.fatal 'ICMP timestamp requests (13) or ICMP timestamp replies (14) filtered.'
+        raise(StandardError, 'hping command executed successfully but received no response.')
+      end
+    end
+    timestamp_ms = out.match(/Transmit=(?<timestamp>\d+)/)[:timestamp].to_i
+    puts ChronoLeak.display_times(timestamp_ms)
+  else
+    puts "#{__FILE__} <IP_address_or_domain>"
+    puts
+    puts "Version: #{ChronoLeak::VERSION} - ICMP Timestamp Remote Time Leaker"
+    puts
+    puts 'Nessus - ICMP Timestamp Request Remote Date Disclosure - https://www.tenable.com/plugins/nessus/10114'
+    puts 'CVE-1999-0524 - https://www.tenable.com/cve/CVE-1999-0524'
+  end
+  log.close
+end

data/lib/chronoleak/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module ChronoLeak
+  VERSION = '0.0.1'
+end

data/lib/chronoleak.rb

@@ -0,0 +1,99 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Standard library
+require 'logger'
+require 'open3'
+require 'time'
+# Project internal
+require 'chronoleak/version'
+
+# Display ICMP timestamp in human form
+module ChronoLeak
+  # @param timestamp_ms [Integer]
+  # @return [Time]
+  def self.timestamp_to_time(timestamp_ms)
+    seconds_since_midnight = timestamp_ms / 1000
+    Time.at(seconds_since_midnight)
+  end
+
+  # @param timestamp_ms [Integer]
+  # @return [String]
+  def self.timestamp_to_time_bis(timestamp_ms)
+    timestamp_h = timestamp_ms / 3_600_000.0
+    hours = timestamp_h.to_i
+    minutes_f = (timestamp_h - hours) * 60
+    minutes = minutes_f.to_i
+    seconds = ((minutes_f - minutes) * 60).to_i
+    format('%<h>02d:%<m>02d:%<s>02d', h: hours, m: minutes, s: seconds)
+  end
+
+  # @param timestamp_ms [Integer]
+  # @return [String]
+  def self.timestamp_to_time_ter(timestamp_ms)
+    total_seconds = timestamp_ms / 1000
+    hours = (total_seconds / 3600).floor % 24
+    minutes = (total_seconds % 3600) / 60
+    seconds = total_seconds % 60
+    format('%<h>02d:%<m>02d:%<s>02d', h: hours, m: minutes, s: seconds)
+  end
+
+  # @param timestamp_ms [Integer]
+  def self.display_times(timestamp_ms)
+    remote_time = timestamp_to_time(timestamp_ms)
+    puts TermLog.colorize(:blue, 'Remote time:')
+    puts format_time(remote_time.utc)
+    puts format_time(remote_time.getlocal)
+    puts
+    puts TermLog.colorize(:blue, 'Local time:')
+    mytime = Time.now
+    puts format_time(mytime.utc)
+    puts format_time(mytime.getlocal)
+    puts
+    puts TermLog.colorize(:blue, 'Time shift:')
+    puts time_diff(remote_time, mytime)
+  end
+
+  # @param time [Time]
+  def self.format_time(time)
+    "#{time.strftime('%H:%M:%S')} #{time.zone}"
+  end
+
+  # @param time_a [Time]
+  # @param time_b [Time]
+  # @return [String]
+  def self.time_diff(time_a, time_b)
+    a = Time.new(1970, 1, 1, time_a.hour, time_a.min, time_a.sec)
+    b = Time.new(1970, 1, 1, time_b.hour, time_b.min, time_b.sec)
+    diff = a > b ? a - b : b - a
+    Time.at(diff).utc.strftime('%H:%M:%S')
+  end
+
+  # Wrapper around the Logger class to get shorter syntax
+  class TermLog
+    COLORS = {
+      red: 31,
+      green: 32,
+      yellow: 33,
+      blue: 34,
+      pink: 35,
+      light_blue: 36
+    }.freeze
+
+    def initialize
+      @logger = Logger.new($stdout)
+    end
+
+    def self.colorize(color, msg)
+      "\e[#{COLORS[color]}m#{msg}\e[0m"
+    end
+
+    def fatal(msg)
+      @logger.fatal(TermLog.colorize(:red, msg))
+    end
+
+    def close
+      @logger.close
+    end
+  end
+end

metadata

@@ -0,0 +1,69 @@
+--- !ruby/object:Gem::Specification
+name: chronoleak
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Alexandre ZANNI
+bindir: bin
+cert_chain: []
+date: 2025-03-30 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+description: Leaks time on a remote machine by using ICMP timestamp requests (13)
+  and replies (14).
+email: alexandre.zanni@europe.com
+executables:
+- chronoleak
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- bin/chronoleak
+- lib/chronoleak.rb
+- lib/chronoleak/version.rb
+homepage: https://github.com/noraj/ChronoLeak
+licenses:
+- MIT
+metadata:
+  bug_tracker_uri: https://github.com/noraj/ChronoLeak/issues
+  changelog_uri: https://github.com/noraj/ChronoLeak/releases
+  documentation_uri: https://noraj.github.io/ChronoLeak/
+  homepage_uri: https://github.com/noraj/ChronoLeak
+  source_code_uri: https://github.com/noraj/ChronoLeak/
+  funding_uri: https://github.com/sponsors/noraj
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.1.0
+  - - "<"
+    - !ruby/object:Gem::Version
+      version: '4.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.2
+specification_version: 4
+summary: ICMP Timestamp Remote Time Leaker.
+test_files: []