Why z/OS Unix Is Familiar Attack Surface

▶ Watch (07:00)

z/OS runs TCP/IP, serves web apps, and exposes SSH. Its Unix subsystem, called Unix System Services or ZOS Unix, is a POSIX interface bolted onto the mainframe OS, not a separate system. File permissions follow the standard three-octet read/write/execute model. Directory traversal and path manipulation work the same way they do on Linux.

RACF, the mainframe’s external security manager, functions like Active Directory: it controls authentication and authorization. APF authorization is the mainframe’s equivalent of kernel-level privilege. Those two concepts are the main additions a Linux pentester needs before starting.

Enumeration Tools and What They Find

▶ Watch (09:56)

Three open-source tools cover the first phase of a mainframe pentest. enum.rex is a REXX script that pulls security information directly from memory control blocks, bypassing the commands that would generate log entries. OMVS enum extends linum with RACF-specific checks. zashog works like TruffleHog: it scans the Unix file system for passwords, tokens, and credentials in properties files.

“if you pull the information directly out of memory, there’s no downside to that.” — Chad Rickensrude

A port scan script written by Owen Henty rounds out recon by testing outbound connections. On multiple real engagements, mainframes had open paths directly to AWS instances on dozens of ports, running services the client hadn’t touched in a decade.

APF Authorization and Privilege Escalation

▶ Watch (18:30)

APF authorization lets a Unix program switch the CPU to supervisor state and set memory key zero, which grants read/write access to any memory. The attacker runs extattr +a on a compiled program, requiring read access to BPX.FILEATTR.APF. Once authorized, the MODESET macro enters supervisor state. Then RACROUTE generates a fresh ACE for any target user. Swapping one pointer makes the ESM treat the attacker’s process as that user.

He walked through the su-to-root SSH key persistence demo (26:30) and the privileged mount attack walkthrough (29:08): pre-authorized binaries built on a lab system mount and run unchanged on the target, gaining RACF SPECIAL and OPERATIONS.

Detection and Hardening

▶ Watch (34:13)

Three RACF profiles carry most of the risk: su-to-root without a password, privileged file system mounts, and BPX.FILEATTR.APF. None of them belong on a daily-driver account. Restricting them to break-glass IDs shrinks the pool of accounts worth targeting in a password spray.

On the detection side, SMS logs every APF authorization attempt and every su. Look for successes, not just failures. Someone repeatedly APF-authorizing programs in Unix System Services is unusual. For file-level visibility, ls -W shows audit bits per file. Setting those bits to “all” on privileged files generates a log entry on every read, write, and execute attempt, catching both reconnaissance and active exploitation.

Notable Quotes

you are all using this platform whether you know it or not Philip Young · ▶ 4:13

if you pull the information directly out of memory, there’s no downside to that. Chad Rickensrude · ▶ 15:24

Sometimes mainframe hacking is really easy, right? Philip Young · ▶ 18:00

Key Takeaways

  • z/OS Unix speaks SSH and POSIX, so Linux pentesting skills apply with minor mainframe-specific additions.
  • APF authorization plus key zero lets an attacker spoof any user’s ESM privileges from within Unix.
  • Audit every privileged file access and restrict RACF su-nopasswd and privileged-mount profiles to break-glass accounts.