SSH-nanigans: Busting Open the Mainframes Iron Fortress Through Unix
Demonstrates practical attack paths against IBM z/OS Unix System Services, showing how weak file permissions and buffer overflows allow privilege escalation on mainframes.
Summary
The Overlooked Unix Side of IBM z/OS
While mainframe penetration testing traditionally focuses on MVS and ISPF interfaces, IBM z/OS includes a complete Unix environment known as Unix System Services (OMVS). This environment exposes distinct attack paths that enterprise defenders often neglect.
File Hygiene and Database Exposure
Inadequate file system permissions in OMVS frequently expose sensitive configuration files, database credentials, and unencrypted dataset backups. Attackers leveraging standard Unix shells can discover credentials that facilitate lateral movement into mainframe databases.
Privilege Escalation via APF Authorized Datasets
Misconfigured External Security Manager (ESM) rules and poorly restricted superuser permissions allow attackers to execute privileged commands. Demonstrating buffer overflows in Authorized Program Facility (APF) datasets illustrates how local shell access leads to complete control.
Detection and Defensive Hardening
Securing z/OS Unix environments requires enforcing strict dataset protection, auditing OMVS superuser privileges, and deploying monitoring tools to detect anomalous Unix commands on mainframe infrastructure.
Related talks
Main Stage·20 min
Cernica Ionut Cosmin
Explores techniques for harvesting cached credentials, environment tokens, and process memory artifacts across multi-tenant shared Linux systems.
Creator Stage·43 min
Brandon Colley
Walks through attack paths in the Game of Active Directory lab environment and demonstrates practical misconfiguration mitigations.
Briefings·40 min
Philip Young · Chad Rikansrud
Those stories often focused on the MVS/ISPF side of the IBM z/OS.