The Soldier of Fortran explained recently how one can hack into an IBM mainframe. (Some of) his scripts are available here (interesting web design!) and if one scrolls down to TSHOCKER the main idea becomes quite clear. Btw many years ago I had to work with an MVS system, TSO, JCL and all that - so I find all this quite interesting.
How many mainframes are actually on the internet?
Quite a lot it seems and this web page lists some of them, discovered with a simple search bot.