#caworld

As promised I made all the slides available over at slide share (http://www.slideshare.net/PhilipYoung14/philip-young-current-state-of-mainframe-hacking-vanguard-101016, http://www.slideshare.net/PhilipYoung14/advanced-mainframe-hacking and http://www.slideshare.net/PhilipYoung14/ca-world-mft1755-gaps-in-your-defense-hacking-the-mainframe-philip-young. In the rest of this write-up I’m going to be covering the tools I discussed with some demo’s and links to where you can find the tools. 

Before I get started I wanted to say a HUGE thank you to CA World and Vanguard C&S for having me speak at their conferences. 

Network Scanning With Nmap:

https://github.com/zedsec390/NMAP

Basically get a current version of Nmap (for Linux) and download these scripts to a folder. You need the file tn3270.lua for most of them to work. You use them by calling them with nmap:

nmap -sV -p 992 <ip address> —script vtam-enum

for more verbosity/debug information you can use -v through -vvvv and -d through -dddd the more d/v the more detailed it gets.

Demos: VTAM APPLID Enumeration, NJE Node Brute Forcing and TSO User ID Enumeration

Logica Breach Code

https://github.com/mainframed/logica

I mentioned the Logica breach during my talk and talked briefly about the exploits and code that was used. Located here are all the files from the logica breach (which you can read everything about here: https://wikileaks.org/gottfrid-docs/) retyped by hand for historical purposes. The only one not in that batch is DeFeNeStRaTe.C (https://github.com/mainframed/logica/blob/master/DeFeNeStRaTe.C). Really interesting stuff. Also of interest is https://github.com/mainframed/logica/blob/master/kuku.rx which works on unpatched z/OS 1.10.

Demo: Screenshot of DeFeNeStRaTe.C

CICSpwn

https://github.com/ayoul3/cicspwn

This tool is cool as hell and can be used to conduct penetration tests against CICS. Written in python, it can be used to identify weakness in CICS security implementations.

Demos: CICSpwn gathering information, CICSpwn uploading a TSO shell, Netcat being used to connect to that shell

PrivEsc (ELV.APF)

https://github.com/ayoul3/Privesc

This is the coolest one. It came out WHILE I was at the conference. @zospentest (@ayoul3__ on twitter) released this awesome rexx script. Basically takes what Mark Wilson (@ich408i on twitter) has been talking about for a while and automates chunks of it. If you’ve never seen Marks talks at SHARE or GSE do yourself a favor and try to find them. 

Demos: ELV.APF on a test system. 

Metasploit

For those who don’t know @bigendiansmalls is the MAN! He worked hard to add the zARCH to metasploit which means you can now do cool things like FTP JCL to Shell. It’s seriously cool. No links to metasploit github because it’s a pain to build yourself, just get Kali linux if you want to mess around with it (that’s right, mainframe hacking tools come built in to Kali linux now, how cool is that?!)

Demo: Metasploit using JCL, FTP and assembler to get a unix shell.

Thanks again for everyone who attend my talks, I hope you enjoyed attending them as much as I enjoyed giving them!