MF-USS-SHELLExecution

z/OS UNIX System Services Shell

OMVS / USS shell on mainframe — modern post-ex (sh-style commands, file edits) without dealing with TSO / 3270 quirks.

§ Where this technique fits

MF-USS-SHELL is catalogued under the Execution tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 5 on average.

§ Dossiers chaining this technique

z/OS TN3270 → RACF userID brute → mainframe shell
Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons.
step 5 / 6

§ What commonly comes next

01
z/OS JCL / Surrogate Abuse
MF-JCL-OWNER · Privilege Escalation
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

z/OS TN3270 → RACF userID brute → mainframe shell

§ What commonly comes next