Getting Shells on z/OS with Surrogat Chains
Jake Labelle demonstrates automated privilege escalation on IBM z/OS mainframes by discovering and chaining complex RACF SURROGAT class permissions to gain root.
Summary
Mainframe Security Architecture and the SURROGAT Class
IBM z/OS enterprise mainframes rely on Resource Access Control Facility (RACF) security databases, where the SURROGAT class permits submitting batch jobs as another user without a password.
The Emergence of Implicit Permission Chains
In legacy mainframe environments spanning decades and hundreds of thousands of accounts, nested job delegation rules inadvertently create complex privilege elevation graphs.
Automating Graph Analysis to Discover Root Paths
Jake Labelle introduces automated graph analysis tooling that maps out multi-step user-to-user SURROGAT chains leading directly to SPECIAL (mainframe root) privileges.
Auditing and Remediating RACF Configurations
The presentation provides mainframe system programmers with auditing scripts to identify circular delegations and enforce strict batch job submission controls.
Related talks
Main Stage·16 min
Jake Labelle
Jake Labelle presents advanced exploitation methodologies for IBM z/OS mainframes, mapping out complex RACF SURROGAT permission graphs to elevate to SPECIAL.
Main Stage·29 min
Jake Labelle
Jake Labelle answers community questions regarding mainframe penetration testing, RACF SURROGAT graph modeling, and z/OS privilege escalation.
Main Stage·39 min
Jake Labelle
Jake Labelle demystifies IBM z/OS mainframe security, demonstrating how to find and exploit memory corruption buffer overflows in legacy enterprise mainframes.