DEF CON Safe Mode - Jake Labelle - Getting Shells on zOS with Surrogat Chains
z/OS allows a user to submit a job as another user without a password with the surrogat class. However, z/OS systems often have hundreds of thousands of users and have been running for decades. This means that it is very likely that from a low priv user there is a surrogat chain that will give you special (z/OS’ root).
RACF (z/OS’ Security), does not allow users to view the security of resources to which they do not have access. This means that manually enumerating a chain required you to submit a reverse shell each time you wanted to move up the chain. This will take a long time with 200k users.
Gator (my tool), submits a batch job that will call a REXX program which will output the user’s privs and the current surrogat chain of that user. It will then list all of that user’s surrogat privs, and call the same batch job as before, but running as those users.
Gator also provides a macro that will generate a CATSO (similar to a meterpreter shell), for any of the users in the surrogat chain.
Gator can also be exported to a GraphVis python program, which will display the users information and chain as a network of nodes.
1 view
1031
330
2 months ago 00:00:00 1
Resonancerz - Let The Galaxy Burn
2 months ago 00:03:09 1
Jay Z - 99 Problems OFFICIAL VIDEO
2 months ago 00:00:00 1
Classic Rock Songs 70s 80s 90s Full Album - Queen, Eagles, Pink Floyd, Def Leppard, Bon Jovi
2 months ago 00:00:00 1
Top 100 Classic Rock Songs Of All Time - ACDC, Pink Floyd, Eagles, Queen, Def Leppard, Bon Jovi
2 months ago 00:01:29 1
Peaceful 31
2 months ago 00:04:54 1
Los Borbones son unos Ladrones VIDEOCLIP + LETRA
2 months ago 01:14:27 1
[Angels Of Love] Dave Morales ’’Revoluciòn’’ live @ Disco Metropolis 31-08-2002
3 months ago 00:03:19 8
NOELIA RODILES & FERNANDO ARIAS en FILARMÓNICA DE ZARAGOZA. Letanía D 343 de
3 months ago 00:46:42 1
ЛУЧШИЕ ИГРЫ про ХОЛОДНУЮ ВОЙНУ
3 months ago 00:35:15 1
The Absolute Craziest Mind Blowing Knives / Stuff at a Knife Show
3 months ago 01:04:33 2
Danny Eaton Guestmix
3 months ago 00:22:46 1
PREPARE YOUR FAMILY FOR A FULL SCALE EVACUATION OF THE URBAN AREAS BEFORE SHTF!
3 months ago 00:42:23 1
⚡ALERT: WW3 GROUND WAR BEGINS! US SENDS TROOPS! KREMLIN/ IRAN EMERGENCY! PUTIN GOES DEFCON 2!
3 months ago 00:02:22 1
Les manifestations après le décès de Philippine
3 months ago 00:44:06 1
DEF CON 25 - Chris Sumner - Rage Against the Weaponized AI Propaganda Machine
3 months ago 00:04:38 1
VIEUX CON !
3 months ago 00:00:00 1
Mamy Samb et Ngoné à Bougane “nagn ko barricadé nakh mou bagna guénati def conférence presse“
3 months ago 00:04:02 1
Resonancerz - Power Of Harmony
3 months ago 00:15:23 1
Russian short film – “Defcon“ (2009)
3 months ago 00:08:22 1
“Rusia entraría en DEFCON4 si Zelensky usa los misiles de largo alcance de EEUU”. Villaroya
3 months ago 01:33:23 1
Cyber Risk Thursday: Internet of Bodies
3 months ago 02:03:39 1
Ori Uplift - Uplifting Only 422 (March 11, 2021) [All Instrumental]
3 months ago 00:04:25 1
Resonancerz - Sigmar Lied
3 months ago 00:00:00 1
ACDC, Pink Floyd, Eagles, Queen, Def Leppard, Bon Jovi, U2 Power Ballads | Classic Rock Songs