ayoul3 / Privesc

Privilege escalation tools on Mainframe
73 stars 38 forks source link

ELV.SELF issue on z/OS 2.2 LPAR #6

Closed lnlyssg closed 6 years ago

lnlyssg commented 7 years ago

This is interesting, I tried to run ELV.SELF in LIST mode on the IBM Master the Mainframe LPAR (which is running z/OS 2.2) and it fails:

*** Listing active address spaces ***                                          

   291 +++        Return c2d(storage(d2x(Arg(1)),4))     /* Return a pointer */
   208 +++       cscb=ptr(ascb+56)                /* Get CSCB address          
 */                                                                            
    35 +++   call list_address_spaces                                          
Error running ELVSELF, line 291: Incorrect call to routine                     

The reason I said it was interesting is I am having a similar "incorrect call to routine" issue with my own SETRRCVT Rexx so if I have any luck with that I will update you.....

lnlyssg commented 7 years ago

And to answer my own issue. Add in "Numeric digits 20" at the top of the Rexx (line 22 should do it)

bigendiansmalls commented 7 years ago

Does that make a difference on 2.1? -- backwards compatible?

lnlyssg commented 7 years ago

I have only tried on a 1.10 LPAR and it still works fine on there. I will admit that I stumbled across the answer (looking through Mark Zeleden's IPLINFO Rexx and a hint from here) without fully understanding why it's necessary though!

mainframed commented 7 years ago

The call is correct (C2D) but you're passing it a number thats too large for the

returns the decimal value of the binary representation of string. If the result cannot be expressed as a whole number, an error results. That is, the result must not have more digits than the current setting of NUMERIC DIGITS.

From https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikja300/dup0011.htm

the precision defaults to 9 digits

Also, in rexx whenever you get an error and you want to debug the exact issue (cause the error messages are not always sensical) add 'TRACE I' to the beginning of your script.

lnlyssg commented 7 years ago

I should have elaborated: I understand what numeric digits does but I have no idea what has changed under z/OS 2.2. If I run a simple exec to get the default value of digits:

/*rexx*/    
say digits()

I get "9" on both z/OS 1.10 and 2.2 so I can only assume that something relating to pointers in storage is now being stored differently in 2.2 (the issue I had with my own Rexx was also a pointer lookup) I had a quick read of the What's new in z/OS 2.2 PDF but nothing jumped out at me....

lnlyssg commented 6 years ago

Resolved by latest commits