MF-JCL-OWNERPrivilege Escalation

z/OS JCL / Surrogate Abuse

Submit a JCL job under another user's surrogate; the job runs in their security context — privilege escalation classic.

§ Where this technique fits

MF-JCL-OWNER is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

z/OS TN3270 → RACF userID brute → mainframe shell
Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons.
step 6 / 6

§ Where this technique fits

§ Dossiers chaining this technique

z/OS TN3270 → RACF userID brute → mainframe shell