Getting Shells on z/OS with Surrogat Chains

Presented at DEF CON 28 (2020) Virtual, Aug. 8, 2020, 5:30 p.m. (30 minutes).

z/OS allows a user to submit a job as another user without a password with the surrogat class. However, z/OS systems often have hundreds of thousands of users and have been running for decades. This means that it is very likely that from a low priv user there is a surrogat chain that will give you special (z/OS' root). RACF (z/OS' Security), does not allow users to view the security of resources to which they do not have access. This means that manually enumerating a chain required you to submit a reverse shell each time you wanted to move up the chain. This will take a long time with 200k users. Gator (my tool), submits a batch job that will call a REXX program which will output the user's privs and the current surrogat chain of that user. It will then list all of that user's surrogat privs, and call the same batch job as before, but running as those users. Gator also provides a macro that will generate a CATSO (similar to a meterpreter shell), for any of the users in the surrogat chain. Gator can also be exported to a GraphVis python program, which will display the users information and chain as a network of nodes.

Presenters:

• Jake Labelle - Security Consultant - F-Secure
  Jake Labelle graduated from Southampton University with a MEng in Computer Science. He currently works at F-Secure in Basingstoke as a Security Consultant. He discovered z/OS this year in January, and now can not stop dabbling. He has created a number of security labs in z/OS and is currently scripting everything in REXX. If he had a choice between a windows host and an emulated z/OS host on his laptop, it would not be a competition. He is currently ecstatic that Hercules, a mainframe emulator, can be compiled for arm and ran on a Raspberry Pi. There is also an open source mainframe (http://wotho.ethz.ch/tk4-/). I'm probably carrying my portable open source mainframe with me right now. https://github.com/southamptonjake

Links:

• https://defcon.org/html/defcon-safemode/dc-safemode-speakers.html#Labelle
• https://infocon.org/cons/DEF CON/DEF CON 28/DEF CON Safe Mode video and slides/DEF CON Safe Mode - Jake Labelle - Getting Shells on zOS with Surrogat Chains - Q&A.mp4
• https://infocon.org/cons/DEF CON/DEF CON 28/DEF CON Safe Mode video and slides/DEF CON Safe Mode - Jake Labelle - Getting Shells on zOS with Surrogat Chains.mp4
• https://infocon.org/cons/DEF CON/DEF CON 28/DEF CON Safe Mode video and slides/DEF CON Safe Mode - Jake Labelle - Getting Shells on zOS with Surrogat Chains.srt (subtitles)
• https://www.youtube.com/watch?v=KUND0KllCKc
• https://www.youtube.com/watch?v=MK8JOMa-kjw

Similar Presentations:

• 30C3 (2013) / Beyond the Tech: Building Internet Freedom Tools for Real People
• BSidesLV 2019 / Supply Chain Security
• Kawaiicon (2019) / Finding a poisonous seed