Breaking in to the Iron Fortress - How I hack IBM mainframes

Philip Young, who leads mainframe penetration testing at NetSPI, walks through how he tests IBM mainframes from first contact to data theft. He explains why public breach details are scarce and gives newcomers a primer on the platform: batch-driven job control, the TSO shell, Rexx scripting, and access checks handled by security products such as RACF.

The middle of the talk follows the attack path. Scanning begins at the TN3270 gateway, where Nmap scripts enumerate SNA application IDs and users before a password spray. He shows a web server compromise on a Tomcat-based system, and describes trusted nodes in Network Job Entry that can let an attacker run jobs as other users without credentials. Once inside, he covers enumeration of datasets, memory-resident control blocks and Unix, then privilege escalation through APF-authorized programs and a buffer overflow class once thought impossible. He also shows how to find outbound ports the mainframe can reach, using a Java port checker to avoid slow timeouts.

He ends with data exfiltration, where EBCDIC and ASCII translation and binary transfer modes make common tools behave unexpectedly. The practical takeaways are to review trust relationships, default credentials, world-readable datasets and outbound egress, and to test mainframes only with permission and specialist care.