> For the complete documentation index, see [llms.txt](https://baric6.gitbook.io/barics-knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://baric6.gitbook.io/barics-knowledge-base/security-programs/shells/sandman-ntp.md).

# Sandman NTP

Sandman is a backdoor that is meant to work on hardened networks during red team engagements.

Sandman works as a stager and leverages NTP (a protocol to sync time & date) to get and run an arbitrary shellcode from a pre-defined server.

Since NTP is a protocol that is overlooked by many defenders resulting in wide network accessibility.

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FNVgDqMbYw8ZyAlXXkpak%2Fimage.png?alt=media&amp;token=119de7ff-cf65-4dcd-8483-85f655d66525" alt=""><figcaption></figcaption></figure>

Download

{% embed url="<https://github.com/Idov31/Sandman>" %}