Dealing The Perfect Hand - Shuffling Memory Blocks On z/OS
summary
Shows how attackers get shells and escalate to SPECIAL/OPERATIONS on IBM Z running z/OS by combining cleartext TN3270 sniffing, brute forcing predictable 7‑char usernames (example results: ~27% username+number, ~19% username), and exploiting unprotected APF libraries or SVC entries to run the modset macro. Demonstrates working tools — kikspoon to drop an APF payload, an SVC scanner/elf to find magic SVCs, and alpha to copy ACE tokens across address spaces — and shows demos that successfully impersonate users and read protected business files.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 4:47What are we gonna talk about
- 5:33Network Protocols
- 8:45Brute Force
- 12:19Hacking Paris
- 17:02Buffer Overflow
- 17:52Rack F
- 20:39List User
- 22:21Control Blocks
- 27:45ModSet Macro
- 30:00Find PF Libraries
- 30:53The Program
- 33:58Weaponizing
- 34:57Supervisor Calls
- 35:47SVCs
- 36:34SPC Script
- 36:47Proof of Concept
- 38:15Who will use it
- 40:08Why I didnt like it
- 41:14Incognito
- 42:00Script
- 43:18Demo
- 44:33Summary
related talks
55mMainframe Hacking in 2019
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
48mEverybody be Cool, This is a Robbery!
25mCommSec D1 - A Deep Dive Into Malicious Documents
02h 27mHow hacking works (Workshop edition)
57mThe Anatomy of an Exploit
41mSimulation Hacking, the Good, Bad and the Ugly