pentesting.md

May 21, 2020 · View on GitHub

  ╔═╛                    ╘═╗
 ┊║  ⊏r@sH ⊏☺urs3 t☺ ℤ╱ʘS  ║┊
  ╚═╕                    ╒═╝

ToC

Intro

Bla bla, yada yada, let's get into it ...

Recon

At this stage the primary goal is to obtain as much information as possible about the system and its configuration.

  • Check organoleptically information present on the login screen.

  • Check IPL and syslog messages in SDSF:

    TSO: sdsf

    ISPF: tso sdsf

    While in SDSF:

    SDSF: log // show syslog

    SDSF: M + PF7 // reach the top of messages with cmd + key combo

  • In the master console run the following commands and collect info:

    d iplinfo

    d m=cpu

    d prog,reg

    d XCF

    d prog,apf

    d prog,exit

    d smf,o

    d sms,options

    d ios,config

    d xcf,sysplex

    d consoles

    d parmlib

    d JOBS,ALL // Lists the address space identifiers for all batch jobs and started tasks

    d ASCH,ALL // Lists the address space identifiers for all APPC/MVS transaction programs

    d TS,ALL // Lists the address space identifiers for all logged-on time-sharing users

    d OMVS,ASID=ALL or DISPLAY OMVS,A=ALL // Lists the address space identifiers for all z/OS UNIX processes

  • In the ISPF investigate the following:

    All PARMLIB datasets retrived from the "d parmlib" command. The PARMLIB dataset contains control parameters for the whole system (similar function to /etc in other unices). The SVCs, Exits, APF authorisation configuration, Program Properties Tables, functional subsystems etc.

    ISPF: =3.4 // navigate to the dataset search screen

    Investigate the given PARMLIB's contents using (b)rowse command:

    ISPF: SYS1.IPLPAR* // search term for "dsname level" field

    Show the contents of any interesting members using the (s)how command and take a note of the IEASYM, NUCLEUS, SYSCAT (master catalog) and PARMLIB values. Press PF9 and and search for the first PARMLIB, e.g.:

    ISPF: SYS2.PARMLIB // search term for "dsname level" field

    Edit contents of the library using (e)dit command and locate the IEASYM member using (l)ocate command, e.g.:

    ISPF: l IEASYM // command and argument for "Command" field

    Show contents of the member (e.g. IEASYMTE, as per the value in PARMLIB) using the (s)how command. It will contain definitions (SYMDEFs) of various system symbols. Take a note of these since you'll have to use them later on (e.g. replace the "xx" in the members' names with SYSCLONE symbol).

    Also, investigate the contents of the following members in PARMLIBs:

    Also, investigate members and contents of the following datasets/libraries (many of these datasets are commands on their own which you can run, much like /bin:/sbin:/usr/bin:/user/sbin etc. in unices):

    • SYS1.UADS - if ACP is not used for whatever reason, then definitions in this dataset will be used to grant access to the system.
    • SYS1.NUCLEUS - contains the basic supervisor ("kernel") modules of z/OS.
    • SYS1.PROCLIB - contains JCL procedures distributed with z/OS. In practice, there are many other JCL procedure libraries (supplied with various program products) concatenated with it.
    • SYS1.LINKLIB - contains many of the basic execution modules of the system (z/OS components and utilities). By default, SYS1.LINKLIB is the first data set in the linklist, which is a collection of libraries containing system and user code. In practice, it is one of a large number of execution libraries that are concatenated.
    • SYS1.LPALIB - contains system execution modules that are loaded into the LPA when the system is initialised. There may be several other libraries concatenated with it. Programs stored here are available to other address spaces.
    • SYS1.SVCLIB - contains operating system routines / supervisor calls (SVCs).

  • In OMVS/USS session run:

    SHELL: uname -a

  • Use IODF to check for hardware & I/O configuration if installed:

    http://www.ibm.com/support/knowledgecenter/SSLTBW_2.2.0/com.ibm.zos.v2r2.ieag800/iea3g814.htm

  • General:

RACF

Testing various RACF aspects.

  • Are the RACF recovery scenarios/mechanisms/tools prepared, in place and tested?

  • Check RACF status and datasets location(s):

    TSO: rvary

  • List and check RACF currently configured options:

    TSO: setr list

  • Check if RACF is synchronized with Active Directory/LDAP etc. Compromising credentials stored/used by these systems can provide you with access to z/OS. Is RACFEVNT class active and NOTIFY.LDAP.USER is defined?

    ftp://public.dhe.ibm.com/s390/zos/racf/pdf/nyrug_2004_04_heterogeneous_password_sync.pdf

    https://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha700/pwenv.htm

  • Check if PROTECT-ALL is active, also its value should be set to FAIL:

    TSO: setr list

    TSO: setr protectall(fail)

    https://www.stigviewer.com/stig/zos_racf/2015-06-24/finding/V-276

  • Locate copies and unloads of the RACF database:

    • Search for datasets containing "RACF" in their name:

      ISPF: =3.4 // navigate to the dataset search screen

      ISPF: *.*RACF*.** // search term for "dsname level" field

    • Search for volume/other backups, e.g. datasets with BACKUP/BAK/BK in their names:

      ISPF: =3.4 // navigate to the dataset search screen

      ISPF: *.*BACKUP*.** // search term for "dsname level" field

  • Generate and review RACF reports (e.g. violations, see JCLs for details):

    TSO: racfrw

    TSO: IRRDBU00

    https://www.ibm.com/support/knowledgecenter/SSB27U_6.3.0/com.ibm.zvm.v630.icha8/icha8158.htm

  • Check for WARNING mode set on dataset profiles. If so, it will log an event warning but will allow action anyway:

    TSO: sr class(dataset) warning

  • Check users with SPECIAL, OPERATIONS, AUDITOR, CLAUTH attributes set for both, group-level and system-wide. The OPERATION attribute in 99.9% shouldn't be granted at all.

    TSO: setr list //check if SAUDIT and OPERAUDIT attributes are set

    DSMON: ICHDSM0

    https://www.ibm.com/support/knowledgecenter/SSLTBW_1.13.0/com.ibm.zos.r13.icha800/ichza8c087.htm // Selected User Attribute Report

  • Check PRIVILEGED vs. TRUSTED profiles. Same privs but TRUSTED is fully audited and should be used instead of PRIVILEGED.

    DSMON: ICHDSM0

  • Check if AUDIT(ALL(READ)) is set on RACF and any copy of it:

    TODO

  • Except UACC of the profile, check access list to the given datasets:

    TODO

System auditing configuration

Userids (individual)

  • Check if you can see the userids in the ISPF command history datasets which can contain passwords:

    ISPF: =3.4 // navigate to the dataset search screen

    ISP: USERID.spflogX.list // search term for "dsname level" field

  • Check if you can see in the SDSF output of jobs run by other userids:

    SDSF: log // show syslog

    SDSF: M + PF7 // reach the top of messages with cmd + key combo and browse downwards

  • Check userid basic account info:

    TSO: lu userid

Userids (global)

OMVS/USS

Finally something you can recognise! Hack it as usual *nices with some twists.

  • If BPX.DAEMON is not defined then assuming other userids identities is possible:

    TODO

  • Privelege escalation vector: as SPECIAL userid set BPX.SUPERUSER (su root without passwd) for USS:

    PERMIT BPX.SUPERUSER CLASS(FACILITY) ID(USERID) ACCESS(READ)
SETROPTS GENERIC(FACILITY) REFRESH

  • Check for SUID programs:

    TODO: find / ...

  • Check filesystem privs (files/dirs):

    ls -laR /

  • Check for these sensitive permissions being set on file/dirs:

    • SUPERUSER.FILESYS.CHANGEPERMS
    • SUPERUSER.FILESYS.CHOWN
    • BPX.SUPERUSER // uid(0) for FACILITY
    • SHARED.IDS
    • CHOWN.UNRESTRICTED
    • FILE.GROUPOWNER.SETGID
    • SUPERUSER.FILESYS.MOUNT
    • SUPERUSER.FILESYS.QUIESCE
    • SUPERUSER.FILESYS.PFSCTL
    • SUPERUSER.FILESYS.VREGISTER
    • SUPERUSER.IPC.RMID
    • SUPERUSER.PROCESS.GETPSENT
    • SUPERUSER.PROCESS.KILL
    • SUPERUSER.PROCESS.PTRACE
    • SUPERUSER.SETPRIORITY
    • SUPERUSER.FILESYS
    • SUPERUSER.FILESYS.ACLOVERRIDE
    • RESTRICTED.FILESYS.ACCESS

OPERCMD profiles

  • Can I ADD my own library to the APF list (e.g. in IEAAPFxx or PROGxx)?

    SETPROG APF,ADD,DSNAME=PREFIX.FOOBAR.DATA,VOLUME=******

  • Can I update PARMLIB and wait for the next IPL?

    TODO

  • Can I update PARMLIB and dynamically add an APF authorised library?

    TODO

  • Do I have access to MVS.SETPROG.** or even ** in the OPERCMDS class?

    TODO

  • Run your own library as APF:

    SETPROG APF,ADD,DSNAME=MYOWNLIB.LOAD,SMS

    where MYOWNLIB.LOAD contains the following code:

    A START
DC X'411000300A6B58F0021CBFFFF154A774000858F0022458FF006C58FF00C896'
DC X'80F02617FF07FE'
END A

    https://share.confex.com/share/123/webprogram/Handout/Session15993/So%20you%20think%20no%20one%20can%20hack.pdf

Generic system

  • Check programs that are permitted to break out of the sandbox:

    The best (and the hardest) way to do this is by scanning control blocks, these include:

    • User SVCs (stored in the SYS1.NUCLEUS and LPALIST datasets)

    • APF and TSO APF authorisations (stored in APF-authorized datasets)

    • I/O appendages (acquire privs via APF-authorized datasets)

    • Fucntional subsystems (acquire privs via APF-authorized datasets)

    • Exits (assembler or REXX language programs which can modify the logic of standard software; stored in APF-authorized or other system datasets).

    • Programs in Properties Table (programs listed in this table only receive privileges if they reside in APF-authorized libraries).

    • Other methods to cross address space boundaries:

      SRB scheduling

      http://www.ibm.com/support/knowledgecenter/zosbasics/com.ibm.zos.zsecurity/zsecc_060.htm

      http://www.stuhenderson.com/MVSAUDL.pdf

  • Check for Processing Program Tables (PPTs) in SYSx.PARMLIB(SCHEDxx) members which have "NOPASS" attribute defined. It means that these PPTs can bypass RACF's password protection.

  • Check who can run/install APF authorized code?

    TODO

  • Check protections of APF authorised libraries:

    In PARMLIBs check IEAAPFxx and PROGxx datasets. See Recon for additional information.

    Check programs which are linkedited (in other unices better known as a binding step at compile time) with "AC(1)" attribute.

    Check PPT entries executed from the APF library. These do not require "AC(1)" attribute.

  • Check poorly coded SVCs:

    In PARMLIBs check SYS1.NUCLEUS, SYS1.LPALIB, SYS1.LNKLIB, SYS1.SVCLIB. See Recon for additional information.

    Master console: d PROG,LNKLIST

    TSO: test // finds SVCs with capability for a normal program to obtain control in supervisor state instead of using APF

    ISPF: tso test

  • Check JES2/JES3 spool:

    SDSF: init

  • Check syslog in SDSF and/or syslog datasets containing syslog entries, i.e. search for password/alu etc. commands that were issued by others/compromised account.

  • Check if it's possible to use DITTO on catalogs and/or normal datasets:

    TODO

  • Check if it's possible to modify/update master catalog for regular users:

    TODO

  • Check apps for UIDs/GIDs 0, what means they can access anything within USS but not MVS datasets. However, UID=0 can be used to trick others to execute something that will modify RACF/datasets on behalf of an attacker:

    TSO: sr class(user) uid(0)

  • Check who can modify IODF datasets:

    http://www.ibm.com/support/knowledgecenter/SSLTBW_2.2.0/com.ibm.zos.v2r2.ieag800/iea3g814.htm

  • Check poor surrogat profiles:

    • ** profile with * READ in ACL
    • userid.SUBMIT in WARNING mode

  • Check what transactions are available for everyone:

    TODO

  • Check contents of (Extended) Common Service Area which may contain special routines easily modifiable by users:

    TODO

  • Check if automount options exclude setuid, otherwise datasets prefixed with a userids can be alterted to turn setuid and APF-authorized bits:

    • Access their file system via Unix and copy a program into their home directory
    • Exit Unix and wait for the file system dataset to be unmounted
    • Zap the file system dataset to set the owner of the program to UID 0, turn on the setuid bit, and turn on the APF-authorized bit
    • Access their file system again via Unix, and now when they execute the program, it runs as UID 0 with APF)

  • Request and review sources for the JES, RACF and Operating System Exits:

    DSMON: ICHDSM0 // find RACF exits, see JCLs for details

  • Check who can download/upload files using IND$FILE:

    TODO

  • Check for legacy products, e.g. "Extracting a password from RACF?" from RACF Discussion List (credits naqvi_aman@HOTMAIL.COM):

      >
  > So that would mean its possible to trigger an authentication
  > (successfully) to RACF with the password/userid in its encrypted form only.
  >
  
  Netview FTP does extract the encrypted password hash from the RACF
  database, sends it to the target system, and authenticates the userid there
  with RACROUTE REQUEST=VERIFY,PASSCHK=YES,PASSWRD=xxx,ENCRYPT=NO.
  ENCRYPT=NO is the magic that tells RACF not to re-encrypt the hash prior
  to comparing it with the one in the database.
  
  Note that this function no longer works when the password is hashed with
  KDFAES on the source system.  The restriction is documented in II14765.
  
  http://www-01.ibm.com/support/docview.wss?uid=isg1II14765

  • Run IEBGENER, put RACF db in SYSUT1, then transfer SYSUT2 contents to your box and run John the Ripper (credits R.Skorupka@bremultibank.com.pl):

    TODO

  • Check if there are any NJE/RJE nodes/jobs defined? If so, check security configuration (encryption, passwords etc.):

    TODO

  • Check if DFDSS can be used to read data dumps:

    TODO

  • Find CLIST/REXX Libraries that are universally updateable that are not at the bo[om of the list of concatenated datasets find an exec that is lower down in the concatenation that is used by one of the privileged users (Sec Admin, Sysprog etc) copy some code to the universally accessible dataset and add a bit of your own code:

    TODO

  • Find library that contains loads of stuff that all the teams use and we have UPDATE access update a member in the dataset and add a bit of code (e.g. exec 'some.dataset(cmd)'):

    TODO

Generic network

TOP10 z/OS vulnerabilities

  1. Excessive Number of User ID’s w/No Password Interval

If the userid is being used for started tasks or surrogate, it should be reviewed and changed to PROTECTED.

  1. Inappropriate Usage of z/OS UNIX Superuser Privilege, UID = 0
  2. Data Set Profiles with UACC Greater than READ
  3. RACF Database is not Adequately Protected
  4. Excessive Access to APF Libraries
  5. General Resource Profiles in WARN Mode

Even if access authority is insufficient, RACF is to issue a warning message and allow access to the resource.

  1. Production Batch Jobs have Excessive Resource Access

Review the SMF data for each production batch ID to determine the access required.

  1. Data Set Profiles with UACC of READ
  2. Improper Use or Lack of UNIXPRIV Profiles

UNIXPRIV class resource rules are designed to give a limited subset of the superuser UID (0) capability.

  1. Started Task IDs are not Defined as PROTECTED IDs

User IDs associated with started tasks should be defined as PROTECTED which will exempt them from revocation due to inactivity or excessive invalid password attempts, as well as being used to sign on to an application.

Benchmarks & STIGs