Mainframe Surrogat Chains
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Labelle, Jake
Question and answer session for Jake Labelle - Getting Shells on zOS with Surrogat Chains
 Alright. And we are live. Alright. We are here in another QA session with Jake LaBelle. Talking about ZOS and surrogate chains. Jake, could you please talk a little bit about the QA session. And how you got into mainframe hacking. Hi, I'm Jake. So I guess how I got into it. My company does some jobs in it. I was looking at some of the reports they wrote and I went, Alex pretty cool. Looked at some pictures of mainframes and was like, yeah, that looks like my type of thing. And yeah, just jumped right into it. It's, yeah, it's. I know I think it looks cool and so just went for it. That's awesome. And I believe this is your first time presenting at Defcon, correct. Yeah, first time. Yeah. So we have a tradition here at Defcon. Whenever you do your first talk, you can do a lot of stuff. Defcon, whenever you do your first talk, we welcome you on to the big stage with a drink. This is for contributing content back to the community and answer taking the time to answer questions. So, cheers to you, Jake. Welcome to Defcon. I'm going to be telling us we're filling up my drink though, so. All right. Cheers. Yeah. So we've already got a few questions that have been going through the chat. You kind of already mentioned like what got you into hacking mainframes. So I'm going to go on to the next one. So, the security systems security plans will have periodic audits of rights to make sure the former super user accounts cannot be taken advantage of your talk sort of goes into how these permissions get changed between users and how they're just sort of left alone. Is there, do you encounter any of these like issues and audits where like you, you're like you have to remove these accounts or is it pretty much a no go on touching things. You don't have like an audit you'll have like, for example, okay, well, we don't want to make some users access this special user which is basically root. But what about that user which accesses that user what about that user which has access to that user. That's not really possible to order you don't really have the ability to. You don't really have the ability when you're well you probably kids but they probably should but they don't. This, can you use this technique that you had to like, at one point you show like this massive graph is graph of nodes. It looks like you were able to fully enumerate all those chains. Could you extend that into some kind of like security auditing. Yeah, 100%. So, they someone. They said that the company he made like a tool which so this this one is more of like a. Not an expert exploitation tool but like one that you would use if you didn't have full access but if you had full access, what you could do is you're allowed to. You can do what's called unloading the rack f databases which is all the security. So you just take that and then offline you can use that to create all the tools but this one's more for. If you didn't have access so from what what from what from your user, what can you access but from offline you that does that someone else with the company was making a tool which takes the rack of to the pits puts into any SQL database and then you can query it however you like. What sounds handy. Someone else is asking, ZOS is tied to IBM. Do you think this could be applied to IBM I. I've never been on a IBM I need to be on an IBM I system just to see what it's like but I've never actually been on it so I have no clue what the security is on there. So, I've got to say that my knowledge of mainframes is fairly weak. In the beginning of your talk you mentioned a couple mentioned partition data sets versus normal ones as if they were like significantly different. Could you explain what the differences are in those. Yeah, so it's, there's no there's no such thing as folders and in ZOS. So, I don't know why but they like to have a flat file systems instead of having that you have, you have data sets, and then there's just. Data sets can have multiple members in them so it's kind of like it acts like a folder but they're all part of one single file. So it's okay. I don't know it's. It's how they do it. So we think of the partition data set as kind of like a file inside of a folder and the data sets the folder. Yeah, yeah, close enough. So, when I was going through the first thing was like, okay, how do these correlate to like, you next things and then it was like, wait a minute, nothing correlates. That's kind of where I was going to go with. But you did mention the the OMS subsystem I believe it was that is a UNIX like environment. How comfortable with someone that is like Linux centric feel inside this OMS environment. It's basically exactly the same. The only thing is that, once you're in that system, you can run anything on the mainframe as well so you can just say, you can run a TSO TSO which is the, like the make the normal mainframe part and just go TSO whatever scripture we're going to run in the mainframe thing so it's, it's exactly the same as any sort of Linux system like all the, like privileges are the same, just, you can also, if you have it, you also have access to that uses mainframe stuff. Okay, got it. I think. So, do you think your tool could work on ACF to or TSS. Again, never been on that I've only been a couple mainframe jobs. But if it allows so I get submission then yeah, that was yeah. So, from my kind of understanding of what surrogates are is they are delegating it's like a tree of delegated permissions right so you, you get the surrogate permission for another user and then you are effectively gaining all the rights of them right. So depending on what type of surrogate you give so the main the main one is you'll have user dot star in class surrogate. And that means that you can submit a job as user dot star. But there's other there's other type of ones you can have but a lot of times, if you have surrogate and one person you can do all the stuff from that like, like for example, there's one that I had where you can say surrogate which allows you to write to do so. So if you can do so you can run any TSO command. So it basically means you have full privileges on there. Got on their thing. So is it something that you have to like it generally you have to specifically invoke to get the other users permissions, or do they all just like it wrapped up into. So that's one of the things that why why why it required the tool was that you couldn't just say from if user one had submit on user two, you couldn't just run like you can just run user two stuff you have to run a job as user two, and that will get returned sometime later so that that that's why the tool was required is that you can't just run the you don't have the privileges you can submit a job as that user. Okay, I actually think that I like literally have that in my head now that that's that's awesome though it was really well described. What are your thoughts on JCL. It's a great language. What am I. Yeah, it's a, it takes a while getting used to because reading the IBM doctors. It's a skill in itself like I think I've actually started to, it's really I don't know if it's something I should be worried about but I've actually started to be able to understand IBM documentation and that's, that's that's worrying. Like, wait, wait, I get it now. But yeah, so it's a, yeah, so JCL is just just a way to submit batch jobs and yeah. So, I think kind of like tooling that makes like interacting with that kind of like languages easier or I know that like the one of the current hot things is like building languages on top of languages. So yeah, the writing, like when I when I whenever I write my programs or any type of thing that I use because it's just easier is the JCL I don't really understand how I don't really understand how you pass like parameters to it. I just put it all in like one little rec script and then it will just run itself and then. So Rex is like, it's just a scripting language is easy to use so I just. Yeah, that's a. Yeah, there was an example. Yeah, that's right. Yeah, it's just, um, I think in JCLs they just, there's lots of like programs that it can run that I have no clue what it does. But I know I know like I now know like what the, like the most important ones do so that's, that's fine. I mean, it's probably enough. Like, if you know, if you know like 75% of most systems you, you are very comfortable in that system. So Jake, have you made any other tools that kind of help to assist with mainframe hacking? Yeah, so I've got, I've got a couple which are varying in their in their usefulness so I've got one which is so the database for all the security is held is just it's just a database so if you have access if you have right access to that, you have access to anything. So I created a quick tool which if you do have right access to it, it will just insert. It will look for your user finds the special flag and just turn it to one. So that's a tool which it's very unlikely that you'll have access to that like that is something that is audited that it's like, make sure that no one has access to this file because if they do, they can put access to everything. So, I made another, so a, a socks proxy in Rex. So that allows you to, if there's any like, so for example, if there's any like internal ports you want to hit, or if there's any like, because everyone trust the, everyone trust the mainframe so why wouldn't you accept all the firewall stuff from that so there's like, if you want to like hit from the mainframe then there's a socks proxy which you can just run in Rex and then just pass on to any, any any port that you can see from there. So Rex is like, is like, it's not just like, like a scripting language like bash which just has like consumes a bunch of tools like it is like a language like it's like fully capable of doing like hosting like network sockets and stuff like that. So Rex you can do any, anything you want to do. And there's also a, I don't really understand what the functionality is but I know how to use it so that's like, so if you run, if you write something called address, so for example, so if you want to write a TSO command, you write address TSO. And that means that any command you run in, in, in quotes runs as TSO. So the way I describe it is that you can run a program as another program but I don't even know if that's actually what's happening I just know that you can be like address db2 which is an SQL database and set up an IBM and so, and that will then run a command as db2 so it's, it's a fairly useful language so just be like, this program, I want to run this command. Yeah, it will do it. And the mainframe is asking, could you talk a little bit more about TK for in the difference between ZOS. So TK for is, it's a beautiful thing. It's a, it's a open source mainframe from well for public domain I don't know what the actual term like specific term is but it's a, in 1980. So they made a mainframe operating system which is now in the public domain. And so it made some tools they made from there. They've created TK for and TK for just allows you to just muck around with, I think I put it in my link in my, in my presentation but if you want just download that to like TK for, you can run it on anything. You can run it on Raspberry Pi. So it's kind of fun. Nice. Yeah, if you want to run like, like, do you like JCLs you can install rex on there. You can still kicks, but also not actually, this is actually one of the things in my presentation that like, I didn't know how to say like, so there's something called kicks with a C and then something kicks with a K. And I was trying to say that the difference between them I was just like, so yeah, my program this this has kicks but this has kicks on here and I was like, wait a minute, I just said this. Yeah, so KIC at CS is a open source. If you want to muck around with kicks on a, which is one of the most like, use thing on a mainframe it's kind of like a web server ish type of thing it's. I don't know. There's no like equivalent to it kind of but yeah if you. Yeah, TK for it's really good if you want to just muck around with mainframe bits. I can put the open source so muck around with that and. Do you have, do you know of any like good resources for like learning how to use and operate a mainframe. It's like coming into it cold which is like booting up a Raspberry Pi image seems like. So, yeah, yeah, the best place. Well, the thing is that it, this is 1980s, my mainframe so even the IBM docs doesn't tell you what to do how to do on this so. The kind of two places where it's the most so on there's a a matter most community called mainframe doc community. Super helpful. If you have any like stuff asking questions on there we'll get. Why did you get questions answers instead of just being like ask ask your. Ask your SME how to do this it's like yeah so mainframe doc community very good place for if you can ask just like stuff. So, yeah, some other places you might find that your questions don't get answered but that's good. Well the place. I think so on my on my YouTube on this person could moshics on YouTube. Very, very helpful like TK for like how to install these things how to. Yeah, how to do a lot of stuff on TK for. Now was there anything for your research or even in your presentation that you didn't get to or that you wanted to look further into that you. Maybe we'll look more into in the future or you think it might be good if other people were to try to build upon what you've done. So. So on the surrogate change I basically just done the there's the star dot submit privileges and the ppx dot serve dot star privileges but like. There's other surrogate classes. I don't really know how they work, but if they could all get if they're like, I don't know how and also how if those surrogate classes other classes can get you access to everything, then there should also be added to the program like if that's, if there's like a. Yeah, if there's another surrogate that I've missed and yeah, that's definitely should be something that should be added is your, your, have you like open source of tools that publicly available at this point. Yeah, and get hub I've put my. I think I've, yeah, I've put my toilets. Live made it public. Oh, well. I'm just putting it onto the into the track chat. Oh, there's lots of chat. So very confused about where it is. Yeah, I'm just going to use a good luck finding it isn't the defcon talk tracks group. You can either put it in track one found it. There you go. You can't work out how the tech works it's like, sorry, I'm trying to work out to get scope working with my with my audio. Please give me 10 minutes to work this out please. I am running out of questions. Is there anything in particular that you want to like talk about or advocate for or anything else you want to any other areas of interest in the info sec world anything like that anything you want to share. I guess there's the thing about like, I think a lot of people like mainframes. Why mainframes what's the point of them. Yeah, it's so. So, so what makes us incredibly, incredibly efficiently like people are like, oh yeah just go cloud it's like, yeah you don't when you're trying to deal with like millions of like credit card transactions. It may not be the most cost effective to do it on on a on like a AWS instance, that might that might be pretty expensive. And you also the other thing where all the codes already in on a mainframe so like, it's going to be pretty difficult to convert your to whatever whatever whatever that you're trying to convert it to. Yeah, the popular languages. Hawkeye is asking about breaking the mainframe. So, with any of the things that you're ever like around with or do do you, is that a concern is that something that you have to like, keep in your mind. The, there's the thing where like, on client side but so when a web app when you're in a testing environment you're like okay I'll just, I'll just keep throwing stuff out and let's see what happens let's, let's see there let's let's just keep throwing stuff out and like, like scripts at it on a mainframe you're like, Hello, like person I'm testing this on. Can I throw this at this before I like, I don't want to break your like, your massively expensive system. Let's just make sure this is this okay first like a major backbone in your, your organization. Can I just, yeah, potentially screw it up right now. Yeah, so it's, there's also the the fun, the fun thing is that, like maybe on like a mainframe you might the testing environment, maybe completely different to the, to the actual like production environment, which is great fun where you're like, Oh look I found something. I found something in your actual like, no. Okay, cool. That was a good like, I was a good like, six hours looking at that great thanks. Cool. So it seems as though that what you're doing is coming probably even more into demand I'm seeing where people are looking for people like in programming cobalt and maintain mainframes. So something that you think might be an area that would be good for people to get into and if so somebody with experience wanted to make the jump over. What sorts of things could they look into how could they even get started in being able to support or test or work with a company. So, there is so, so I guess like if you're on if you're in like a like, like a, like a company you could just shadow a job that that's probably like, there's also the, there is a ZOS 1.10 on pirate bay, which over the course I would not be supporting you know policy is bad and very illegal to never do that. But if you do have that, that might be useful. Yeah. So, who does still use mainframes today like what industries or major companies, we can say any still make use of mainframes. So, basically every, every bank that's big still uses mainframes there. Again, they're doing like massive batch like jobs, and they already have all the infrastructure already so they're not going to, when they're like okay who do we need to go do we need to like, do we want to move everything to cloud or do we want to continue on a mainframe. And so the answer that question is, they're not going to change their entire system to get to try and maybe. I don't even know if it would save money but maybe I don't know. And then, I guess a lot of government still use mainframes like, for example, I think there was a freedom of information request the UK government about what mainframes are still in use and one of the things that really got me was. And so, the people who do like the, the Treasury I think. And so they are like okay here are the, the four mainframes that are out of date that we use. And they're like 10 years old. And they also say, here are three other mainframes that are managed by Fujitsu that we use. Through some research, I'm pretty certain that these are like 20 year old mainframes that have like, probably never ever been looked at ever. They're just running like, and I looked at them and I was like okay what are the ones that are running it's like, are these do all the customs in the UK. Huh, I bet they never want to ever change that shit ever. They're literally just like, we're never changing this 20 year old mainframe that we have. No one's ever looked at it. It's not even like, it's not even an IBM mainframe. It's a special UK mainframe that got bought out by Fujitsu that is now running the customs in the UK. And I'm like, this has never been looked at. Like even with a mainframe specialist looked at it, they wouldn't be able to know anything. It's like, it's written in this weird language that I've never heard of. Other people have heard SCL. I don't know. Have you guys heard of that? I think that I've come across it in another DEF CON talk. Maybe. I get exposed to a lot of things. We did have another talk related to past talks. I've enjoyed various ZOS talks at DEF CON over the last few years. When I never hear about mainframe security, otherwise, are they a common attack target? Or do they tend to go overlooked because of the foreignness of the platform? What does the defense side look like outside of the kind of audits you mentioned? I don't actually know. Like the access that. So it feels like the only people who would actually be able to access this are people with like, who are fairly. Like sophisticated. You wouldn't have like, just a random attacker going after a mainframe because it's, it's normally like hidden in their internal network. So like, it'd probably be like a nation state attacker. So like, or like that type of like level. So I feel like if attack, they wouldn't be going after financial stuff. So you wouldn't really ever see that it was happening. Maybe. I don't know. I mean, Oh, sorry. Yeah. Oh, sorry. Sorry. I mean, so like this might have been in us chatting before the actual stream start, but you did mention that you've like, you found some mainframes that were just exposed online just by dropping something into show Dan. So, so like, maybe not just a deep internal threat. Yeah, the majority of the ones I saw on show Dan were like, there's actually, there's actually a fun site of that mainframe sent me about all the internet. It's, it's just the bot that you just, the people have sent mainframe my piece to it, and it just goes straight to the picture of the like, the initial screen of it. And that's, I think, is a fairly, fairly fun, fairly innocent. But yeah, yeah, so. There's a couple of government ones, but a lot of them are just like emulated ones but Yeah, I think it's a, I think it's like the thing I was going to say was that, like, if a nation state ever got a hold of something, it's unlikely they would ever like reveal like reveal themselves in that way that like that they had got access to that like it's not like a criminal organization where they'd be trying to like go after like those type of things so that's the thing where I don't know if there was in the news recently the the owner of part bay. The hack to mainframe it was it was a while ago but there's the I must miss that one. Yeah, it was But how secure it are they from the inside it would it be as simple as just being able to access somebody's workstation from inside to be able to get, get to the mainframe mainframe saying it's the logical breach. Yeah, the logical breach and the fun thing about that one as well is that they released. Well, I don't know if they released on purpose but all of the like the court documents were released. Don't get her by the way, so you can see what fun tools they used to like to access all the to do all the stuff. Yeah, mainframe says it's on wiki leaks. So anyone out there that's looking for more information. Apparently there's a lot more data out there. That sounds pretty fascinating. See, writing a writing a tool and I looked at logical and I was like, wait a minute. They did this already. I got beat out by a by the hackers by a dump of random hacker activity. I love it. So you just had to one up them by presenting a deaf gone. Yeah. So we are, we are approaching the end of the time of our QA session. Is there anything else you want to talk about while you still have the camera. I think I'm all topped out. Fair enough. Well, thank you very much for doing this Q and a session. Thank you for presenting to deaf con once again for your first time. Really hope you come back. This was great content. I need to get back to at least get to Vegas at least. You got to you got to experience in person deaf con as well. All right. Well, thank you very much and we'll talk to you later.
 Alright.  And we are live.  Alright.  We are here in another QA session with Jake LaBelle.  Talking about ZOS and surrogate chains.  Jake, could you please talk a little bit about the QA session.  And how you got into mainframe hacking.  Hi, I'm Jake.  So I guess how I got into it.  My company does some jobs in it.  I was looking at some of the reports they wrote and I went, Alex pretty cool.  Looked at some pictures of mainframes and was like, yeah, that looks like my type of thing.  And yeah, just jumped right into it.  It's, yeah, it's.  I know I think it looks cool and so just went for it.  That's awesome.  And I believe this is your first time presenting at Defcon, correct.  Yeah, first time. Yeah.  So we have a tradition here at Defcon.  Whenever you do your first talk, you can do a lot of stuff.  Defcon, whenever you do your first talk, we welcome you on to the big stage with a drink.  This is for contributing content back to the community and answer taking the time to answer questions.  So, cheers to you, Jake.  Welcome to Defcon.  I'm going to be telling us we're filling up my drink though, so.  All right.  Cheers.  Yeah.  So we've already got a few questions that have been going through the chat.  You kind of already mentioned like what got you into hacking mainframes.  So I'm going to go on to the next one.  So, the security systems security plans will have periodic audits of rights to make sure the former super user accounts cannot be taken advantage of your talk sort of goes into how these permissions get changed between users and how they're just sort of left alone.  Is there, do you encounter any of these like issues and audits where like you, you're like you have to remove these accounts or is it pretty much a no go on touching things.  You don't have like an audit you'll have like, for example, okay, well, we don't want to make some users access this special user which is basically root.  But what about that user which accesses that user what about that user which has access to that user. That's not really possible to order you don't really have the ability to.  You don't really have the ability when you're well you probably kids but they probably should but they don't.  This, can you use this technique that you had to like, at one point you show like this massive graph is graph of nodes.  It looks like you were able to fully enumerate all those chains. Could you extend that into some kind of like security auditing.  Yeah, 100%. So, they someone.  They said that the company he made like a tool which so this this one is more of like a.  Not an expert exploitation tool but like one that you would use if you didn't have full access but if you had full access, what you could do is you're allowed to.  You can do what's called unloading the rack f databases which is all the security. So you just take that and then offline you can use that to create all the tools but this one's more for.  If you didn't have access so from what what from what from your user, what can you access but from offline you that does that someone else with the company was making a tool which takes the rack of to the pits puts into any SQL database and then you can query it however you like.  What sounds handy.  Someone else is asking, ZOS is tied to IBM. Do you think this could be applied to IBM I.  I've never been on a IBM I need to be on an IBM I system just to see what it's like but I've never actually been on it so I have no clue what the security is on there.  So, I've got to say that my knowledge of mainframes is fairly weak.  In the beginning of your talk you mentioned a couple mentioned partition data sets versus normal ones as if they were like significantly different. Could you explain what the differences are in those.  Yeah, so it's, there's no there's no such thing as folders and in ZOS. So, I don't know why but they like to have a flat file systems instead of having that you have, you have data sets, and then there's just.  Data sets can have multiple members in them so it's kind of like it acts like a folder but they're all part of one single file. So it's okay. I don't know it's.  It's how they do it. So we think of the partition data set as kind of like a file inside of a folder and the data sets the folder.  Yeah, yeah, close enough.  So, when I was going through the first thing was like, okay, how do these correlate to like, you next things and then it was like, wait a minute, nothing correlates.  That's kind of where I was going to go with. But you did mention the the OMS subsystem I believe it was that is a UNIX like environment.  How comfortable with someone that is like Linux centric feel inside this OMS environment.  It's basically exactly the same. The only thing is that, once you're in that system, you can run anything on the mainframe as well so you can just say, you can run a TSO TSO which is the, like the make the normal mainframe part and just go TSO whatever scripture  we're going to run in the mainframe thing so it's, it's exactly the same as any sort of Linux system like all the, like privileges are the same, just, you can also, if you have it, you also have access to that uses mainframe stuff.  Okay, got it. I think.  So, do you think your tool could work on ACF to or TSS.  Again, never been on that I've only been a couple mainframe jobs.  But if it allows so I get submission then yeah, that was yeah.  So, from my kind of understanding of what surrogates are is they are delegating it's like a tree of delegated permissions right so you, you get the surrogate permission for another user and then you are effectively gaining all the rights of them right.  So depending on what type of surrogate you give so the main the main one is you'll have user dot star in class surrogate. And that means that you can submit a job as user dot star.  But there's other there's other type of ones you can have but a lot of times, if you have surrogate and one person you can do all the stuff from that like, like for example, there's one that I had where you can say surrogate which allows you to write to do so.  So if you can do so you can run any TSO command. So it basically means you have full privileges on there.  Got on their thing.  So is it something that you have to like it generally you have to specifically invoke to get the other users permissions, or do they all just like it wrapped up into.  So that's one of the things that why why why it required the tool was that you couldn't just say from if user one had submit on user two, you couldn't just run like you can just run user two stuff you have to run a job as user two, and that will get returned  sometime later so that that that's why the tool was required is that you can't just run the you don't have the privileges you can submit a job as that user.  Okay, I actually think that I like literally have that in my head now that that's that's awesome though it was really well described.  What are your thoughts on JCL.  It's a great language.  What am I.  Yeah, it's a, it takes a while getting used to because reading the IBM doctors.  It's a skill in itself like I think I've actually started to, it's really I don't know if it's something I should be worried about but I've actually started to be able to understand IBM documentation and that's, that's that's worrying.  Like, wait, wait, I get it now. But yeah, so it's a, yeah, so JCL is just just a way to submit batch jobs and yeah.  So, I think kind of like tooling that makes like interacting with that kind of like languages easier or I know that like the one of the current hot things is like building languages on top of languages.  So yeah, the writing, like when I when I whenever I write my programs or any type of thing that I use because it's just easier is the JCL I don't really understand how I don't really understand how you pass like parameters to it.  I just put it all in like one little rec script and then it will just run itself and then. So Rex is like, it's just a scripting language is easy to use so I just. Yeah, that's a.  Yeah, there was an example. Yeah, that's right. Yeah, it's just, um,  I think in JCLs they just, there's lots of like programs that it can run that I have no clue what it does. But I know I know like I now know like what the, like the most important ones do so that's, that's fine.  I mean, it's probably enough. Like, if you know, if you know like 75% of most systems you, you are very comfortable in that system.  So Jake, have you made any other tools that kind of help to assist with mainframe hacking?  Yeah, so I've got, I've got a couple which are varying in their in their usefulness so I've got one which is so the database for all the security is held is just it's just a database so if you have access if you have right access to that, you have access to anything.  So I created a quick tool which if you do have right access to it, it will just insert.  It will look for your user finds the special flag and just turn it to one.  So that's a tool which it's very unlikely that you'll have access to that like that is something that is audited that it's like, make sure that no one has access to this file because if they do, they can put access to everything.  So, I made another, so a, a socks proxy in Rex.  So that allows you to, if there's any like, so for example, if there's any like internal ports you want to hit, or if there's any like, because everyone trust the, everyone trust the mainframe so why wouldn't you accept all the firewall stuff from that so there's  like, if you want to like hit from the mainframe then there's a socks proxy which you can just run in Rex and then just pass on to any, any any port that you can see from there.  So Rex is like, is like, it's not just like, like a scripting language like bash which just has like consumes a bunch of tools like it is like a language like it's like fully capable of doing like hosting like network sockets and stuff like that.  So Rex you can do any, anything you want to do. And there's also a, I don't really understand what the functionality is but I know how to use it so that's like, so if you run, if you write something called address, so for example, so if you want to write a TSO command, you write address TSO.  And that means that any command you run in, in, in quotes runs as TSO.  So the way I describe it is that you can run a program as another program but I don't even know if that's actually what's happening I just know that you can be like address db2 which is an SQL database and set up an IBM and so, and that will then run a command as db2 so it's, it's a fairly useful language  so just be like, this program, I want to run this command. Yeah, it will do it.  And the mainframe is asking, could you talk a little bit more about TK for in the difference between ZOS. So TK for is, it's a beautiful thing. It's a, it's a open source mainframe from well for public domain I don't know what the actual term like specific term is but it's a, in 1980.  So they made a mainframe operating system which is now in the public domain. And so it made some tools they made from there. They've created TK for and TK for just allows you to just muck around with, I think I put it in my link in my, in my presentation but if you want just download that to like TK for, you can run it on anything.  You can run it on Raspberry Pi. So it's kind of fun. Nice. Yeah, if you want to run like, like, do you like JCLs you can install rex on there. You can still kicks, but also not actually, this is actually one of the things in my presentation that like, I didn't know how to say like, so there's something called kicks with a C and then something  kicks with a K. And I was trying to say that the difference between them I was just like, so yeah, my program this this has kicks but this has kicks on here and I was like, wait a minute, I just said this.  Yeah, so KIC at CS is a open source. If you want to muck around with kicks on a, which is one of the most like, use thing on a mainframe it's kind of like a web server ish type of thing it's.  I don't know. There's no like equivalent to it kind of but yeah if you.  Yeah, TK for it's really good if you want to just muck around with mainframe bits.  I can put the open source so muck around with that and.  Do you have, do you know of any like good resources for like learning how to use and operate a mainframe.  It's like coming into it cold which is like booting up a Raspberry Pi image seems like.  So, yeah, yeah, the best place. Well, the thing is that it, this is 1980s, my mainframe so even the IBM docs doesn't tell you what to do how to do on this so.  The kind of two places where it's the most so on there's a a matter most community called mainframe doc community.  Super helpful. If you have any like stuff asking questions on there we'll get.  Why did you get questions answers instead of just being like ask ask your.  Ask your SME how to do this it's like yeah so mainframe doc community very good place for if you can ask just like stuff.  So, yeah, some other places you might find that your questions don't get answered but that's good.  Well the place.  I think so on my on my YouTube on this person could moshics on YouTube.  Very, very helpful like TK for like how to install these things how to.  Yeah, how to do a lot of stuff on TK for.  Now was there anything for your research or even in your presentation that you didn't get to or that you wanted to look further into that you.  Maybe we'll look more into in the future or you think it might be good if other people were to try to build upon what you've done.  So.  So on the surrogate change I basically just done the there's the star dot submit privileges and the ppx dot serve dot star privileges but like.  There's other surrogate classes. I don't really know how they work, but if they could all get if they're like, I don't know how and also how if those surrogate classes other classes can get you access to everything, then there should also be added to the program like if that's, if there's like a.  Yeah, if there's another surrogate that I've missed and yeah, that's definitely should be something that should be added is your, your, have you like open source of tools that publicly available at this point.  Yeah, and get hub I've put my.  I think I've, yeah, I've put my toilets.  Live made it public.  Oh, well.  I'm just putting it onto the into the track chat.  Oh, there's lots of chat. So very confused about where it is. Yeah, I'm just going to use a good luck finding it isn't the defcon talk tracks group.  You can either put it in track one found it. There you go.  You can't work out how the tech works it's like, sorry, I'm trying to work out to get scope working with my with my audio. Please give me 10 minutes to work this out please.  I am running out of questions. Is there anything in particular that you want to like talk about or advocate for or anything else you want to any other areas of interest in the info sec world anything like that anything you want to share.  I guess there's the thing about like, I think a lot of people like mainframes. Why mainframes what's the point of them.  Yeah, it's so.  So, so what makes us incredibly, incredibly efficiently like people are like, oh yeah just go cloud it's like, yeah you don't when you're trying to deal with like millions of like credit card transactions.  It may not be the most cost effective to do it on on a on like a AWS instance, that might that might be pretty expensive. And you also the other thing where all the codes already in on a mainframe so like, it's going to be pretty difficult to convert your  to whatever whatever whatever that you're trying to convert it to. Yeah, the popular languages.  Hawkeye is asking about breaking the mainframe.  So, with any of the things that you're ever like around with or do do you, is that a concern is that something that you have to like, keep in your mind.  The, there's the thing where like, on client side but so when a web app when you're in a testing environment you're like okay I'll just, I'll just keep throwing stuff out and let's see what happens let's, let's see there let's let's just keep throwing  stuff out and like, like scripts at it on a mainframe you're like, Hello, like person I'm testing this on. Can I throw this at this before I like, I don't want to break your like, your massively expensive system.  Let's just make sure this is this okay first like a major backbone in your, your organization. Can I just, yeah, potentially screw it up right now.  Yeah, so it's, there's also the  the fun, the fun thing is that, like maybe on like a mainframe you might the testing environment, maybe completely different to the, to the actual like production environment, which is great fun where you're like, Oh look I found something.  I found something in your actual like, no. Okay, cool. That was a good like, I was a good like, six hours looking at that great thanks.  Cool.  So it seems as though that what you're doing is coming probably even more into demand I'm seeing where people are looking for people like in programming cobalt and maintain mainframes.  So something that you think might be an area that would be good for people to get into and if so somebody with experience wanted to make the jump over. What sorts of things could they look into how could they even get started in being able to support or test or work with  a company. So, there is so, so I guess like if you're on if you're in like a like, like a, like a company you could just shadow a job that that's probably like, there's also the, there is a ZOS 1.10 on pirate bay, which over the course I would not be supporting you know policy is bad and very illegal to never do that.  But if you do have that, that might be useful.  Yeah.  So, who does still use mainframes today like what industries or major companies, we can say any still make use of mainframes.  So, basically every, every bank that's big still uses mainframes there. Again, they're doing like massive batch like jobs, and they already have all the infrastructure already so they're not going to, when they're like okay who do we need to go do we need to like, do we want to move  everything to cloud or do we want to continue on a mainframe.  And so the answer that question is, they're not going to change their entire system to get to try and maybe. I don't even know if it would save money but maybe I don't know.  And then, I guess a lot of government still use mainframes like, for example, I think there was a freedom of information request the UK government about what mainframes are still in use and one of the things that really got me was.  And so, the people who do like the, the Treasury I think. And so they are like okay here are the, the four mainframes that are out of date that we use. And they're like 10 years old.  And they also say, here are three other mainframes that are managed by Fujitsu that we use.  Through some research, I'm pretty certain that these are like 20 year old mainframes that have like, probably never ever been looked at ever.  They're just running like, and I looked at them and I was like okay what are the ones that are running it's like, are these do all the customs in the UK.  Huh, I bet they never want to ever change that shit ever. They're literally just like, we're never changing this 20 year old mainframe that we have.  No one's ever looked at it. It's not even like, it's not even an IBM mainframe. It's a special UK mainframe that got bought out by Fujitsu that is now running the customs in the UK.  And I'm like, this has never been looked at.  Like even with a mainframe specialist looked at it, they wouldn't be able to know anything. It's like, it's written in this weird language that I've never heard of.  Other people have heard SCL. I don't know. Have you guys heard of that?  I think that I've come across it in another DEF CON talk.  Maybe.  I get exposed to a lot of things.  We did have another talk related to past talks.  I've enjoyed various ZOS talks at DEF CON over the last few years. When I never hear about mainframe security, otherwise, are they a common attack target?  Or do they tend to go overlooked because of the foreignness of the platform? What does the defense side look like outside of the kind of audits you mentioned?  I don't actually know. Like the access that.  So it feels like the only people who would actually be able to access this are people with like, who are fairly.  Like sophisticated. You wouldn't have like, just a random attacker going after a mainframe because it's, it's normally like hidden in their internal network.  So like, it'd probably be like a nation state attacker. So like, or like that type of like level. So I feel like if attack, they wouldn't be going after financial stuff.  So you wouldn't really ever see that it was happening. Maybe. I don't know.  I mean,  Oh, sorry. Yeah. Oh, sorry. Sorry. I mean, so like this might have been in us chatting before the actual stream start, but you did mention that you've like, you found some mainframes that were just exposed online just by dropping something into show Dan.  So, so like, maybe not just a deep internal threat.  Yeah, the majority of the ones I saw on show Dan were like, there's actually, there's actually a fun site of that mainframe sent me about all the internet.  It's, it's just the bot that you just, the people have sent mainframe my piece to it, and it just goes straight to the picture of the like, the initial screen of it.  And that's, I think, is a fairly, fairly fun, fairly innocent. But yeah, yeah, so.  There's a couple of government ones, but a lot of them are just like emulated ones but  Yeah, I think it's a, I think it's like the thing I was going to say was that, like, if a nation state ever got a hold of something, it's unlikely they would ever like reveal like reveal themselves in that way that like that they had got access to that like it's not like a criminal  organization where they'd be trying to like go after like those type of things so that's the thing where I don't know if there was in the news recently the the owner of part bay.  The hack to mainframe it was it was a while ago but there's the  I must miss that one.  Yeah, it was  But how secure it are they from the inside it would it be as simple as just being able to access somebody's workstation from inside to be able to get, get to the mainframe mainframe saying it's the logical breach.  Yeah, the logical breach and the fun thing about that one as well is that they released. Well, I don't know if they released on purpose but all of the like the court documents were released.  Don't get her by the way, so you can see what fun tools they used to like to access all the to do all the stuff.  Yeah, mainframe says it's on wiki leaks. So anyone out there that's looking for more information. Apparently there's a lot more data out there.  That sounds pretty fascinating.  See, writing a writing a tool and I looked at logical and I was like, wait a minute. They did this already.  I got beat out by a by the hackers by a dump of random hacker activity. I love it.  So you just had to one up them by presenting a deaf gone.  Yeah.  So we are, we are approaching the end of the time of our QA session. Is there anything else you want to talk about while you still have the camera.  I think I'm all topped out.  Fair enough. Well, thank you very much for doing this Q and a session. Thank you for presenting to deaf con once again for your first time. Really hope you come back. This was great content.  I need to get back to at least get to Vegas at least.  You got to you got to experience in person deaf con as well.  All right. Well, thank you very much and we'll talk to you later.
DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_0_323.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_324_1067.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_1068_1571.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_1572_2759.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_2760_3131.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_3132_3551.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_3552_3803.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_3804_4127.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_4128_8267.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_8268_8315.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_8316_8867.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_8868_9767.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_9768_9827.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_9828_10031.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_10032_10091.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_10092_10139.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_10140_15491.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_15492_17747.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_17748_18119.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_18120_18719.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_18720_22727.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_22728_26711.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_26712_27359.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_27360_27875.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_27876_33659.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_33660_36203.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_36204_38327.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_38328_38435.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_38436_39191.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_39192_39971.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_39972_42011.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_42012_42239.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_42240_42311.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_42312_42971.png DEF_CON_Safe_Mode_-_Jake_Labelle_-_Getting_Shells__mbPgDJ4misk_42972_43575.png