AI
Mainframes Still Run the Financial Stack
Every major airline processes reservations on a mainframe. Every credit card transaction touches one. Banks, auto manufacturers, UPS - any company older than 50 years almost certainly runs ZOS. “Mainframe’s dead” articles appear constantly; successful migration announcements almost never do. A CIO starts the process, gets halfway, then quits. The hardware looks identical to 1970s equipment but now fits in a single cabinet processing thousands of transactions per minute without interruption.
ZOS Unix: The Familiar Attack Surface
ZOS Unix was developed in 1994, became POSIX compliant in 1996, and at that point took over TCP/IP for the operating system. IBM rebranded it twice before settling on “ZOS Unix.” It runs inside ZOS as a System V shell environment with only two shells: bin/sh and bin/tcsh. Pentesters reach it via SSH, JCL, or by typing “uss” inside TSO. File permissions mirror Linux, but RACF can override them - creating misconfigurations where filesystem ACLs say allowed while the ESM says no.
Enumeration Tools Built for the Platform
Three open-source tools ship on every Young pentest. enum.rex is a REXX script that pulls system information directly from memory, including undocumented structures that cannot be listed through normal commands. OMVS enum is lin-enum rewritten for TCSH with mainframe-specific checks added. Zosshog, based on trufflehog, searches ZOS Unix files for secrets using regex. The output is immediate: RACF databases using DES instead of KDFAES are trivially cracked by John the Ripper or hashcat. One engagement produced every user password in under three hours.
Three Paths to Full Control
Young has found hardcoded credentials in world-readable shell scripts on multiple engagements. SSH in with the stolen creds, run “list user,” see “special and operations” in the output, and the pentest becomes an assessment. A more technical path uses the extattr command with the APF attribute: once a program is APF authorized, it can call the MODESET assembly macro to switch to CPU key zero. From key zero, a program replaces the ACEE memory structure (the user’s runtime identity) with any admin account on the system.
Mount-Based Payload Delivery and Buffer Overflows
If RACF grants update access to SUPERUSER.FILESYS.USERMOUNT, a tester can mount a dataset from their own mainframe onto the target while preserving APF and set-UID bits. The payload is crafted offline, transferred, mounted, and executed - no extattr access needed on the target. Beyond mounting: C programs in ZOS Unix are not memory safe. Any APF-authorized binary with a buffer-overflow bug gives the attacker ring-zero code execution. Jake Leel’s DEF CON 30 talk and a publicly available Docker lab both walk through the full exploit chain step by step.
Prevention and Detection
File permissions need active review: run find to identify everything chmod 777. Lock down three RACF profiles: BPX.SUPERUSER, BPX.FILEATTR.APF, and SUPERUSER.FILESYS.USERMOUNT. Access to all three should be restricted to break-glass accounts only. For detection, ZOS SMF logs every RACF profile check, including failed access attempts. No client has ever asked Young why 30,000 file access failures appeared during a pentest - nobody was watching. The chaudit command sets per-file audit records in ZOS Unix, logging every read and write to critical paths like /etc.
Notable Quotes
Mainframe hacking is not hard. It’s not Philip “Soldier of FORTRAN” Young · ▶ 23:22
at this point, it’s game over. We can Philip “Soldier of FORTRAN” Young · ▶ 23:53
it then made my account special. Philip “Soldier of FORTRAN” Young · ▶ 38:04
Key Takeaways
- RACF “special and operations” attributes give complete control over the mainframe; finding either ends the pentest.
- APF authorization in ZOS Unix is gated by a single RACF profile; misconfigured access enables full privilege escalation via assembly.
- No client has ever noticed 30,000 failed file access attempts during a pentest - SMF log monitoring is essentially absent.
About the Speaker(s)
Philip Young, known as Soldier of FORTRAN, is Director of Mainframe Penetration Testing Services at NetSPI. A ’90s hacker kid who started on an Amiga 500 and a modem, he learned his craft on Datapac, the Canadian X.25 network. He turned his focus to mainframe security after recognizing how far behind the platform had fallen compared to Windows and Linux systems. Since then he has presented at Black Hat, DEF CON, and RSA, taught mainframe security workshops, and released multiple open-source pentesting tools. He was also once under investigation by the Swedish secret police.