Getting Shells on z/OS with Surrogat Chains (Q&A)
Jake Labelle answers community questions regarding mainframe penetration testing, RACF SURROGAT graph modeling, and z/OS privilege escalation.
Summary
In this technical Q&A session from the DEF CON Safe Mode Main Stage, mainframe penetration tester Jake LaBelle explores IBM z/OS exploitation techniques. Opening at 00:00, Jake answers questions regarding RACF (Resource Access Control Facility) permissions and Unix System Services (USS) subsystems within z/OS environments.
At 07:00 and 14:00, he explains "surrogate chains," demonstrating how misconfigured surrogate authorization profiles allow an unprivileged user to submit batch jobs under another user's identity, chaining privileges up to administrative authority.
Concluding at 21:00 and 28:00, Jake addresses the surging industry demand for mainframe security expertise, comparing automated auditing scripts with manual RACF profile inspection to detect privilege escalation vectors. (AI summary — Gemini Flash)
Related talks
Main Stage·16 min
Jake Labelle
Jake Labelle demonstrates automated privilege escalation on IBM z/OS mainframes by discovering and chaining complex RACF SURROGAT class permissions to gain root.
Main Stage·16 min
Jake Labelle
Jake Labelle presents advanced exploitation methodologies for IBM z/OS mainframes, mapping out complex RACF SURROGAT permission graphs to elevate to SPECIAL.
Main Stage·39 min
Jake Labelle
Jake Labelle demystifies IBM z/OS mainframe security, demonstrating how to find and exploit memory corruption buffer overflows in legacy enterprise mainframes.