Approach to mainframe penetration testing on z/OS. Deep dive into RACF

This article analyzes IBM RACF internals and database structure, introduces racfudit — a cross-version offline RACF DB analysis tool — and demonstrates how extracted profile relationships and password material (DES and KDFAES-based) can be used to identify misconfigurations and privilege escalation paths on z/OS mainframes. The authors describe extracting password and passphrase values, mapping explicit and implicit profile relationships (e.g., group-SPECIAL, group-OPERATIONS), SQL queries for finding risky settings (UACC, owners), and outline how these findings can lead to full system compromise, while recommending mitigations such as KDFAES adoption, UACC control, and regular relationship audits.