Internal Network Pentest and IR Reference: as 400

# AS400

AS400 (IBM i) is a midrange computer system developed by IBM, originally released in 1988. Now known as IBM i running on Power Systems, it is widely used for business applications due to its stability, security, and integrated database (DB2 for i)

## Summary

* [Lab](#lab)
* [Enumeration](#enumeration)
* [Access and Audit](#access-and-audit)
* [Default Credentials](#default-credentials)
* [User Enumeration](#user-enumeration)
    * [Telnet](#telnet)
    * [POP3](#pop3)
    * [FTP](#ftp)
* [Useful Commands](#useful-commands)
* [NMAP Scripts](#nmap-scripts)
* [User Class](#user-class)
* [Authority](#authority)
* [Special Authority](#special-authority)
* [Adopted Authority](#adopted-authority)
* [Password Cracking](#password-cracking)
* [Privilege Escalation](#privilege-escalation)
    * [Initial Program Breakout](#initial-program-breakout)
    * [Hijack Profile - SECOFR Security Class](#hijack-profile---secofr-security-class)
    * [Hijack Profile - Authorities](#hijack-profile---authorities)
    * [Hijack Profile - Profile Swapping](#hijack-profile---profile-swapping)
    * [Unqualified Library Calls](#unqualified-library-calls)
    * [From ALLOBJ to SECADM](#from-allobj-to-secadm)
    * [Arbitrary Command Execution](#arbitrary-command-execution)
* [References](#references)

## Lab

* [mainframed/DC30_Workshop](https://github.com/mainframed/DC30_Workshop) - DEFCON 30 Mainframe buffer overlow workshop container
* [mainframed/DVCA](https://github.com/mainframed/DVCA) - Damn Vulnerable CICS Application

    ```ps1
    docker run -d \
    --name=dvca \
    -e HUSER=docker \
    -e HPASS=docker \
    -p 21:21 \
    -p 23:23 \
    -p 3270:3270 \
    -p 3505:3505 \
    -p 3506:3506 \
    -p 8888:8888 \
    -v /opt/docker/dvca:/config \
    -v /opt/docker/dvca/printers:/printers \
    -v /opt/docker/dvca/punchcards:/punchcards \
    -v /opt/docker/dvca/logs:/logs \
    -v /opt/docker/dvca/dasd:/dasd \
    -v /opt/docker/dvca/certs:/certs \
    --restart unless-stopped \
    mainframed767/dvca:latest
    ```

## Enumeration

By default, the FTP service send a banner with the following prefix:

```ps1
220-QTCP at
```

Common ports in AS400 devices:

```ps1
20, 21, 23, 25, 80, 110, 137, 138, 139, 389, 443, 446, 448, 449, 512, 910, 992, 2001, 2010, 3000, 5061, 5544, 5555, 5566, 5577, 8470, 8471, 8472, 8473, 8474, 8475, 8476, 9470, 9471, 9472, 9473, 9474, 9475, 9476
```

| Name          | Description | Port | Port (SSL) |
| ------------- | ----------- | ---- | ---------- |
| FTP           | FTP server is used to access the AS/400 file system  | 20,21 | / |
| Telnet        | Telnet server is used to access 5250 emulation | 23 | 992 |
| SMTP          | SMTP server is used to provide mail transfer | 25 | / |
| HTTP          | HTTP server is used to provide web page | 80 | 443 |
| POP3          | POP3 server is used to provide mail fetch | 110 | 910 |
| NetServer     | NetServer allows access to AS/400 integrated file system from Windows PCs | 137,138,139,445 | / |
| LDAP          | LDAP provides a network directory service | 389 | 636 |
| DDM           | DDM server is used to access data via DRDA and for record level access. | 446 | 448 |
| As-svrmap     | Port mapper returns the port number for the requested server. | 449 | / |
| As-rmtcmd     | Remote command server is used to send commands from a PC to an AS/400 and for program calls. | 512 | / |
| As-admin-http | HTTP server administration. | 2001 | 2010 |
| As-sts        | Service tools server | 3000 | / |
| As-mtgc       | Management Central server is used to manage multiple AS/400s in a network. | 5555,5544 | 5566,5577 |
| As-central    | Central server is used when a Client Access license is required and for downloading translation tables. | 8470 | 9470 |
| As-database   | Database server is used for accessing the AS/400 database. | 8471 | 9471 |
| As-dtaq       | Data Queue server allows access to the AS/400 data queues, used for passing data between applications. | 8472 | 9472 |
| As-file       | File Server is used for accessing any part of the AS/400 file system. | 8473 | 9473 |
| As-netprt     | Printer Server is used to access printers known to the AS/400. | 8474 | 9474 |
| As-rmtcmd     | Remote command server is used to send commands from a PC to an AS/400 and for program calls. | 8475 | 9475 |
| As-signon     | Sign-on server is used for every Client Access connection to authenticate users and to change passwords. | 8476 | 9476 |

## Access and Audit

**Access**:

* [tn5250/tn5250](https://github.com/tn5250/tn5250) - A curses-based 5250 terminal client
* [x3270](https://x3270.bgp.nu/) - IBM 3270 terminal emulator
* [ayoul3/wc3270_hacked](https://github.com/ayoul3/wc3270_hacked) - A hacked version of wc3270 that removes field protection and displays hidden fields
* [Mocha TN3270](https://mochasoft.dk/tn3270.htm) - Mocha TN3270 provides TN3270 emulation for IBM Mainframe Access
* [Mocha TN5250](https://mochasoft.dk/tn5250.htm) - Mocha TN5250 provides TN5250 emulation for IBM Mainframe Access
* IBM i Access Client Solutions (5250 Console): `servername.com/WSG` or Telnet
* IBM Navigator for i (Web Interface): `http://systemName:2001`

Signed-off profiles can still be used—not for opening a 5250 session, but they should work with other protocols.

All the objects can be queried from the database DB2.

**Audit**:

* [hackthelegacy/hack400tool](https://github.com/hackthelegacy/hack400tool/tree/master/dist) - Security handling tools for IBM Power Systems
    * [hack400auditor/hack400auditor.jar](https://github.com/hackthelegacy/hack400tool/blob/master/dist/hack400auditor/hack400auditor.jar)
    * [hack400exploiter/hack400exploiter.jar](https://github.com/hackthelegacy/hack400tool/blob/master/dist/hack400exploiter/hack400exploiter.jar)
    * [hack400scanner/hack400scanner.jar](https://github.com/hackthelegacy/hack400tool/blob/master/dist/hack400scanner/hack400scanner.jar)
* [ayoul3/cicspwn](https://github.com/ayoul3/cicspwn) - CICSpwn is a tool to pentest a CICS Transaction servers on z/OS.
* [ayoul3/cicsshot](https://github.com/ayoul3/cicsshot) - Tool to screenshot CICS transactions
* [sensepost/birp](https://github.com/sensepost/birp) - Big Iron Recon & Pwnage

![AS400 Mind Map](https://web.archive.org/web/[PII_REDACTED]2720if_/http://www.toolswatch.org/wp-content/uploads/2013/02/AS400.jpg)

## Default Credentials

```ps1
# Print users with default passwords (Username == Password case insensitive)
# Must have *ALLOBJ and *SECADM special authorities to use this command.
ANZDFTPWD
```

Other default profiles:

```ps1
QAUTPROF QBRMS QCLUMGT QCLUSTER QCOLSRV
QDBSHR QDBSHRDO QDFTOWN QDIRSRV QDLFM
QDOC QDSNX QEJB QFNC QGATE
QLPAUTO QLPINSTALL QMQM QMQMADM QMSF
QNETSPLF QNFSANON QNOTES QNTP QPEX
QPGMR QPM400 QPRJOWN QRJE QRMTCAL
QSECOFR QSNADS QSPL QSPLJOB QSRV
QSRVBAS QSVCDRCTR QSYS QSYSOPR QTCP
QTFTP QTMHHTP1 QTMHHTTP QTMPLPD QTMTWSG
QTSTRQS QUMB QUSER QYPSJSVR QYPUOWN30
```

## User Enumeration

### Telnet

Authentication