Dealing The Perfect Hand

## Overview

The presentation focuses on the security posture and penetration testing of modern IBM zSeries mainframes running z/OS. Rather than legacy relics from the 1960s, contemporary mainframes (such as 2017 models boasting 32 TB of RAM and 170 processors clocked at 5.2 GHz) power critical world infrastructure, processing approximately 87% of all credit card transactions as well as core banking and airline bookings. Despite hosting highly sensitive applications and data, mainframes suffer from a major security maturity gap compared to environments like Windows. Pervasive security misconceptions—such as assuming attackers lack the tools or interest to target mainframes—leave these systems vulnerable to straightforward, legacy attack techniques.

## Initial Access and Network Exploitation

Before delving into post-exploitation and memory analysis, attackers frequently obtain initial access through fundamental network vulnerabilities without needing zero-day exploits:

- **Cleartext Communications (TN3270):** The primary protocol for connecting to mainframes is TN3270, an enhanced telnet service running over port 23 that transmits data in plaintext by default. - Using network sniffers and tools such as Ettercap (equipped with a TN3270 dissector) paired with ARP poisoning, testers can capture credentials directly from interactive login screens. - Research by Soldier of Fortran showed that roughly half of the mainframes visible on the internet do not enable SSL. - Even where SSL is deployed, TN3270 terminal emulators (e.g., x3270, wc3270) typically lack modern browser certificate-validation mechanisms, leaving them susceptible to SSL interception and decryption.

- **Predictable User Enumeration & Brute-Force:** - The Time Sharing Option (TSO) command interpreter provides feedback disclosing whether an entered username is valid. - Mainframe usernames are heavily constrained: maximum of seven characters, uppercase only, no leading digits, and restricted to three specific "national" special characters. These constraints result in highly predictable naming conventions across departments (e.g., `DEV001`, `DEV002`, or department prefixes like `GGA0` followed by three letters). - Public Nmap scripts authored by Soldier of Fortran automate this user enumeration process.

- **Weak Credential Patterns:** - Audits comparing Active Directory credential dumps (1,000 Windows users) against z/OS credential dumps (998 mainframe users) revealed that 19% of mainframe accounts used passwords identical to their usernames (`password = username`), and 27% used `username + number` (compared to just 5% in Windows).

## CICS Middleware and Application Breakout

Interactive business applications (such as in-house banking portals like the presented `EURO` demo app) largely run atop CICS (Customer Information Control System):

- **Role of CICS:** Originating in 1968, CICS operates similarly to an application server or middleware (comparable to Apache Tomcat combined with a CMS). It schedules tasks, manages locks, allocates memory, handles file caching, and routes requests to compiled programs written in COBOL, C, or Assembly, supporting workloads reaching 20 billion transactions per day. - **Breakout Vector:** Much like seeking an unauthenticated `/manager/html` path on Apache Tomcat to deploy a web shell, attackers target CICS applications by finding key combinations that exit the running business app back to the underlying CICS transaction interface. From this prompt, unauthorized administrative or utility transactions can be invoked directly to execute arbitrary code.