Getting Shells on z/OS with Surrogat Chains (Encore)
Jake Labelle presents advanced exploitation methodologies for IBM z/OS mainframes, mapping out complex RACF SURROGAT permission graphs to elevate to SPECIAL.
Summary
Mainframe Identity and Access Complexity
IBM z/OS mainframes powering global financial infrastructure utilize intricate RACF authorization tables containing decades of accumulated user permissions.
Unraveling Multi-Step SURROGAT Class Delegations
Jake Labelle details how unprivileged user accounts can traverse nested batch job submission privileges to execute unauthorized JCL jobs as privileged IDs.
Constructing Automated Exploitation Graphs
Demonstrating automated scanning tools illustrates how red teams can ingest RACF database dumps to compute optimal escalation paths directly to mainframe root.
Auditing Mainframe Security Controls
System administrators are provided with practical remediation queries to prune orphaned SURROGAT profiles and harden z/OS access controls.
Related talks
Main Stage·16 min
Jake Labelle
Jake Labelle demonstrates automated privilege escalation on IBM z/OS mainframes by discovering and chaining complex RACF SURROGAT class permissions to gain root.
Main Stage·29 min
Jake Labelle
Jake Labelle answers community questions regarding mainframe penetration testing, RACF SURROGAT graph modeling, and z/OS privilege escalation.
Main Stage·39 min
Jake Labelle
Jake Labelle demystifies IBM z/OS mainframe security, demonstrating how to find and exploit memory corruption buffer overflows in legacy enterprise mainframes.