CH4 — Default Admin

Open5GS ships a WebUI management dashboard on port 3000. Operators use it to provision subscriber SIM cards, manage accounts, view network status, and configure the core. It is backed by MongoDB and exposes a REST API. The dashboard is the administrative control plane for the entire 5G core.

The WebUI ships with a hardcoded default administrator account: username admin, password 1423. This is documented in the Open5GS source code and has been the default since the project launched. In this lab, those credentials have never been changed. A planted operator account in MongoDB has the flag in its note field — and the IDOR means you do not even need admin privileges to read it.

This challenge combines two distinct security failures that are each bad on their own — and catastrophic together. Understanding both is the point of the exercise.

The moriah-mongodb container is accessible via docker exec from your jumpbox. Query the accounts collection directly — this is the raw database the WebUI sits in front of, and it has no access control of its own. The flag is in the note field of a planted operator account.

Default credentials on management interfaces are one of the most extensively documented attack classes in telecommunications. Every major GSMA security advisory addresses them. They persist because operators treat lab-hardened software as production-ready without the hardening step.

• 🔐
  OAM access equals full core control The Operations, Administration, and Maintenance interface is the highest-privilege plane in a 5G core. An attacker who logs into the WebUI as admin can provision new SIM cards, delete subscriber records, modify authentication keys, and reconfigure network functions — all through the same dashboard that legitimate operators use.
• 🏊
  IDOR enables privilege escalation without privilege The IDOR vulnerability means an attacker does not need admin credentials — any valid account will do. If a lower-privileged helpdesk account is compromised, the IDOR allows reading every other account's data, including admin accounts and their internal notes. One credential becomes all credentials.
• 💻
  Vendor-documented defaults are public knowledge Default credentials are not secrets. They appear in product documentation, GitHub repositories, public forums, and CVE databases. An attacker targeting a specific 5G core vendor has a list of known defaults to try before attempting any brute force. Open5GS's admin/1423 is in its README.
• 📋
  Internal notes expose operational intelligence The note field exploited in this challenge mirrors a real pattern: operators store internal operational data — network segments, credentials for other systems, incident notes, customer information — in fields not intended for external access. IDOR makes all of it readable by any authenticated user.