Awesome
TPX Brute - The z/OS TPX logon panel brute forcer
- By: Quentin HARDY (quentin.hardy@bt.com or quentin.hardy@protonmail.com)
- Based on: https://github.com/mainframed/TSO-Brute
- Thanks to "Soldier of FORTRAN".
TPX (Terminal Productivity Executive) is a multiple session manager for IBM mainframes. The TPX logon panel tells you if you have a valid user account. Consequently, you can enumerate users allowed to authenticate on the z/OS system. With valid users, you can do a dictionnary attack on passwords.
Features
Thanks to TPX_brute tool, you can (from a TPX logon panel):
-
enumerate valid users :
You have to give a file of usernames to the tool. It will try to use each username to log in. For information, TSO only allows characters A-z, 0-9, @, # and $ in its username. Additionally a username cannot start with a number and it must be seven characters or less. This script will skip items that would be invalid TSO username. As TSO_brute tool, this mode is envoked by passing -e or --enumeration.
-
brute force passwords:
The brute forcer does the same as the enumerator except it requires a file of passwords to use. As TSO_Brute tool, the same rules for passwords apply except it can start with a number and has a max length of eight instead of seven. This is the default mode for TPX_Brute.
As TSO_Brute tool, TPX_Brute makes use of x3270 and s3270 to perform much of the heavy lifting, using py3270 which has been modified for TPX interface (included with this tool).
The tool comes 2 modes:
-
Movie Mode: In this mode you can watch script typing commands in a 3270 emulator in real time. It can be enabled with the --moviemode or -m option.
-
Quiet mode: In this mode only valid Usernames/passwords are printed to the screen. It can be enabled with the -q or --quiet option
SETTINGS FOR YOUR TARGET
The ADPAPT section in the TPX_Brute.py script is used to get to the TPX logon panel with an invalid/valid credentials. You will have to change this section of the script before being able to use it.
Screens are saved to an HTML file (tso_screen.html file). See the following line in source code:
em.exec_command('PrintText(html,tso_screen.html)')).
Examples
- To just enumerate users:
python TPX_Brute.py -t target:23 -u users.txt -e
- To enumerate users and then brute force the password for the found user ID, using movie mode and sleep 2 seconds between actions:
python TPX_Brute.py -t target:23 -u users.txt -p passwords.txt -m -s 2
Installation
Install 3270/x3270 to /usr/bin.
sudo apt-get install s3270 x3270
Install missing python packages with pip.
Known Issues:
- TSO accounts can be locked during brute force attacks.