5 This will be an article on what you can do with VMB's.
\r
6 I was not sure if I really could add anything new to this topic, but I think
\r
7 I can give you a complete list of "What they can do for you" and also I pro-
\r
8 mised this artcle to van Hauser so here it is.
\r
9 Don't blame me if you already know anything, again, it is WHY someone should
\r
10 concern about VMB's.
\r
11 There are quiete a lot of text files on VMB Systems and I will give
\r
12 you an overview of files which deal with the hacking of special systems at
\r
13 the end of this article.
\r
15 1. Overview of what-do-to with VMB's
\r
16 ------------------------------------
\r
17 -use them as (simply) Voice-Mail
\r
18 -use them as 3rd party call possibility
\r
19 -use them to call for free
\r
20 -use them to make conferences
\r
21 -use them to find switching systems
\r
25 The originating thing why VMB's got invented. Suppose you have a company and
\r
26 50 guys working there. Let's say you got 20 calls after hours on your
\r
27 answering machine and each one is for a different guy. So why not having a
\r
28 system where anybody can leave a message to the specific guy he wants?
\r
29 So each guy has his own mailbox where he gets his calls if he is away from
\r
30 his desk or not at home. If you connect to a voicemail, you will always get
\r
31 a prompt where normally you can leave a message to the company or if you know
\r
32 the extension of the guy you want to talk to to him directly.
\r
33 So within your own VMB, you can hear messages from outside callers or from
\r
34 someone within your company. That's the basis.
\r
35 If you want to hack a VMB, you always have to find where the 3 or 4 (the
\r
36 only system with 2 digit extensions I know is Partnell Mail from AT&T?)
\r
37 digit extension are, they are mostly grouped. You always have 2 possibilities,
\r
38 you can transfer to extensions and see if they do exist (meaning you hear
\r
39 some greetings) or enter a mailbox and see if it prompts with password.
\r
40 There are different systems but I suggest you always transfer to extensions
\r
41 because you can find interesting things (see later on). If you have a clue
\r
42 where the most extensions are, you can start hacking one box with trying
\r
43 passwords like 1234 or the boxnumber. I would never concern on more passwords
\r
44 because if no easy password fits, than the system is often better protected,
\r
45 and there are enough silly systems with stupid administrators you can hack.
\r
46 If you have hacked a box belonging to someone else, you should NEVER hear
\r
47 any mails, you just find free boxes belonging to noone by using the
\r
48 distribution list command or the message received command which exists on
\r
49 all systems. Normally you notice a free box (either when transfering to a
\r
50 box from outside or when using the commands from inside) when there is no
\r
51 greeting and just a message like 'extension 123' or 'record at the tone'.
\r
52 A very good way to locate boxes is to use the name-search which exists on
\r
53 almost any systems. Hear the company's greeting and they often tell some-
\r
54 thing like "press 9 to use the directory". Enter the beginnings of common
\r
55 names and you will get the person's extension number.
\r
56 So well, why should you hack a VMB and have a extension? Simply because
\r
57 it's quiete cool & useful to keep in contact with other hacker's.
\r
58 If you hack more extensions on one system, they invite your friends and
\r
59 have a big communication tool - tollfree! (Ah btw, NEVER ever hack voice-
\r
60 mail systems in your own country, because of the bust & trace possibility,
\r
61 but if you hack american systems on toll-free numbers [of course reachable
\r
62 from within your own country], you cannot be busted. At least not in Germany)
\r
63 The THC posse uses an Aspen system for more than 6 month with more than
\r
64 20 extensions I hacked in September '95. Really, it is a big helpful tool to
\r
65 keep in touch with each other for free, and we do not only talk about hacking
\r
66 stuff, it is quiete funny to leave messages to the other's if you are drunken
\r
67 at a party or whatever!
\r
68 The most comfortable system in my eye's is Aspen from Octel ("Voice Infor-
\r
69 mation processing") which exits in different dimensions and cost up to
\r
70 $600.000. It has become -sad but true- hard to hack because most systems
\r
71 have no defaults anymore. The Aspen systems can be integrated into several
\r
72 switches and often has the bridge capacibility. (see later)
\r
74 3. 3rd party calling
\r
75 --------------------
\r
76 I guess you know what this is. If not, you can pay calls over certain
\r
77 companies (e.g. MCI) which accept that a 3rd party pays all costs.
\r
78 You tell the operator to place a 3rd party call and he calls the number you
\r
79 give him to verify he will accept the charges. Because operators are dumb
\r
80 (well why they are just operators) and because of the good line quality,
\r
81 you can trick them with a VMB which has a greeting like "hallo? ah .... hmm
\r
82 (pause) ... yes ... I accept the charges".
\r
83 Well you ask, how can an american operator dial a toll-free number in Germany
\r
84 and enter an extension or what? In fact, many VMB systems have a direct dial
\r
85 (Especially Meridian's) and if it is an american company, of course in the
\r
86 states. (and this number can be dialed from the operator)
\r
87 Direct dial means that your extension is not only reachable over the main
\r
88 number (where you can enter the person's extension), it is reachable over
\r
89 a normal telephone number. Let's say the company originates in AC 718, and
\r
90 the company wants their guys (of course) to be called by customers. So they
\r
91 have a whole prefix which belongs to the company, The last four digits are
\r
92 for the guys in the company. If this company owns a VMB, the extensions of
\r
93 the guys normally are the last four digits of the phonenumber. So if you
\r
94 hacked extension 3000, and the company is located in 718-123-xxxx, your
\r
95 direct dial would be 718-123-3000. So go and ask the operator (by paging
\r
96 or within business hours) for their main number in the states, and they
\r
97 will tell you the things you need (AC, prefix). If they give you an 1-800
\r
98 number ask them for their fax number or whatever, to get the missing digits.
\r
99 If anything fails go and ask them for their direct dial.
\r
100 So know you can change your greeting to the one above and tell the operator
\r
101 to bill the call to 718-123-3000.
\r
102 Again, many companies already got abused and have restricted their whole
\r
103 prefix for accepting 3rd party calls, but it is always worth a try and MCI
\r
104 has good overseas lines from Germany.
\r
108 Remember the things of a direct dial. Think of the use of a PBX and
\r
109 what a PBX does. Bingo, of course if the company has PBX and has a direct
\r
110 dial, you can reach their dialtone toll-free. So if you are scanning a VMB
\r
111 (by transfering to the extensions) you may run over a dialtone which VERY
\r
112 often has no code on it. I think the systems which have the possibility of
\r
113 being a part of the PBX are limmited. Audix (by AT&T) and Meridian (by
\r
114 Northern Telecom) are worth a try and I have run over severals dialtones
\r
115 on these systems. I guess Aspen has the possibility too, but I never found
\r
116 anything. If you have a girlfriend which speaks a good english, you can try
\r
117 to social-engineer the extension where the dialtone is located. (Use a name
\r
118 which is really in the company you got from the names directory, say you
\r
119 are struck in Europe and forgot all your paper's with the extension. Better,
\r
120 [because not too many companies have agents which travel to Europe] you let
\r
121 your call look like it originates from the US by using the 3rd party call
\r
122 way or so. Or if you have hacked a box, page the operator from within the box,
\r
123 because he cant see where your call is originating from!)
\r
124 Anyway if you are struck by scanning the system but you do think it really
\r
125 must have a dialtone (probably because the company is so big and has direct
\r
126 dial), go and do social-engineering, especially after hours, because these
\r
127 operator are unsophisticated and often have no idea of fraud. At business
\r
128 time, they could connect you to security (oops) or they even are the security
\r
129 operator (ooooops).
\r
130 There is also a way to call for free if the VMB system has the ability to for-
\r
131 ward calls. If you want that all calls after hours are forwarded to your home
\r
132 phone, you enter configure this within your box. Many bigger systems like
\r
133 Audix do have the capacibility, but it is disabled very often. Smaller
\r
134 systems like Cindy or The Message Desk have this feature not disabled and you
\r
135 can use it to divert your calls by entering the phone number you want within
\r
136 your hacked box and then transfer to your own hacked extension which will
\r
137 forward the call to your favourite BBS.
\r
138 As small bonus, I include a special section on The Message Desk systems,
\r
139 because I haven't found any text file about it and because Germans can abuse
\r
140 Message Desk Systems in UK very easy! A big Thanks & GOOD LUCK! to Krew-l-t
\r
141 who introduced me to this neat system.
\r
142 Well basically when you dial press # and then enter a box number...most
\r
143 are unpassworded...to find extensions dial in and press * then dial
\r
144 3 digits or 4 (there is also boxes 1,2 and 3). If you hear no special
\r
145 greeting then enter this box number and if it has no password, you have your
\r
146 own box. You can also use boxes belonging to someone IF he hasnot activated
\r
147 call-forwarding; he would be quiete anxious if he is awaiting calls at his
\r
148 home and all guys will get connected to LORE BBS :). So always change the
\r
149 number back after you used it. Once in a box do 7 then 7 again...then 2, then 9+ the number you wannt to reach then #, then # again,
\r
150 then * twice, then the box number you wannt to divert to.
\r
151 There is a special possibility to dial out on Meridian voicemail system. There
\r
152 are certain extensions you can transfer to and hear nothing. You may have
\r
153 found the outdial code. Try to transfer to this extension and add a number.
\r
154 Let's say at extension 1234 you hear nothing. If you dial 1234+00-cc-number
\r
155 you may be connected to your desired target. Especially systems in the UK
\r
156 often have this outdial possibility, and since you have unlimmited tries for
\r
157 scanning extensions, you can find them quiete easily. Of course, any Meridian
\r
158 in any country has this possibility, but it must not be set up on the system.
\r
159 Something you may also try is to key in certain digits at the main prompt
\r
160 (the one with the company's greeting) and I sometimes got a dialtone just by
\r
161 pressing 9 at this prompt.
\r
165 Probably you have visited the DefCon Voice bridge in the USA. You can find
\r
166 something like this on Meridian, Aspen and Audix Systems. Basicly, it is the
\r
167 same thing as with the outdial code. You enter extensions and if you hear
\r
168 nothing, but it is not an outdial, it may be a conference setup. The Analyst
\r
169 for example found a conferences for 8 people on a Meridian in Germany.
\r
170 Let's say there was 2000 and then silence, but 2000+00-cc-number didnot work.
\r
171 So he tried something and when entering 200008 a voice said "Conference set
\r
172 up for 8 persons." They could connect to the conference when dialing 2000X1.
\r
173 If you ever want to be a part of our great conferences we hold from time to
\r
174 time just contact me or any of the THC crew.
\r
175 On Audix systems, you hear a special bridge-tone when you have found a
\r
176 conference extension. Check up if someone may transfer to this extension
\r
177 at the same time and you can speak to each other now, or try extensions near
\r
178 the bride extensions, or something like this.
\r
179 But be careful, you might stumble into existing conferences sometimes!
\r
180 (But it may be quiete funny to be a part of them!)
\r
182 6. Switching Systems
\r
183 --------------------
\r
184 In my opinion, this is the interesting part now, becuase it can give you a
\r
185 lot of power if you have managed it to hack a switching system through a
\r
187 Almost all voice mail systems are a part of a switching system, but there
\r
188 are certain systems that are ONLY for voicemail. Let's say you have a big
\r
189 switching system of the Definity Series from AT&T. You can integrate a voice
\r
190 mail (in this case Audix) into your PBX System. You have the possibility to
\r
191 set up an extension to maintain your PBX, let's say your company owns
\r
192 645-xxxx. You can setup the dial-in port on extension 645-9999, and if
\r
193 you dial 645-9999, you will be connected to a terminal where you can setup
\r
194 or maintain the WHOLE PBX system. (Well I guess nothing new for you guys.)
\r
195 If you have a voicemail system, you can setup the dial-in port also to be
\r
196 reachable through your voicemail, so let's say you transfer to extension 9999
\r
197 and bingo, you get the carrier. This is very interesting, because it
\r
198 is a great possibilty to reach a switching system from outside a country
\r
199 trough a toll-free number. Audix voicemail e.g. is often integrated into
\r
200 the Definity Series (System 75 and 85; the G1 - G3 series), so the chance
\r
201 of finding a Sys75 on an Audix extension is quiete high. BUT I suggest that
\r
202 you give this up. Why? Because AT&T changed ALL default login's and password's
\r
203 due to a massive abuse in the States. I talked to a woman from Lucent on
\r
204 the CEBIT this year (she is in the toll-fraud prevention center), and she
\r
205 said that they still ship the Definity Series with the defaults, BUT their
\r
206 technicians are told to change them. You may try the looker/browser account
\r
207 but in general, you have no chance of entering the system easiely. Of course,
\r
208 social-engeneering is a possibility. You should concentrate on the switches
\r
209 from Nortel. (Sl-1 series etc.) A Meridian Voice Mail system is sometimes
\r
210 integrated into this PBX system, and the hacking is quiete easy.
\r
211 A SL-1 switch answers like this:
\r
212 OVL111 IDLE and has different signs on the screen like TTY and such.
\r
213 (Check the reference article; read the end of this file)
\r
214 To logon, you type LOGI and it responds with PASS?.
\r
215 The older SL-1 switch ONLY allows a 4 digit numeric code and you have
\r
216 UNLIMMITED tries, so fuck, write a script and you are in FAST!
\r
217 The newer one (sigh) allows 16? signs so give it up.
\r
218 Once in, you can setup DISA's and more ... remember, if you have access
\r
219 to a switching system, you can do ALL with their telephone system.
\r
220 (Even shut-down if you are malicious).
\r
221 You sould be abled to access a ROLM CBX system through Phonemail, but
\r
222 I never found this myself.
\r
224 7. End / Contact the author
\r
225 ---------------------------
\r
226 I hope you found this article enjoyable to read and know, why to concern
\r
227 with VMB's now. Something I wanted to add: DON'T think you cannot hack
\r
228 those systems and their PBX systems, because most technicians are not
\r
229 half that intelligent as you are. The often chose simple passwords and
\r
230 left a backdoor open. I know it myself, because I'm a low-level technician
\r
231 of a German PBX system and the technician who installed the whole system
\r
232 was really stupid without any knowledge that got behind his manual.
\r
233 To maintain the system for me was really hard because of the bad setup.
\r
234 I'll write a file about German PBX systems later this year.
\r
235 (Octopus from Telekom, HiCOM from Siemens and 4000 series from Alcatel)
\r
236 BTW, use the WWW to gain good informations about anything! Use
\r
237 Lycos and you will get a lot of interesting pages with stuff for you,
\r
238 concerning VMB's and PBX systems.
\r
239 To contact me from within Germany, dial 0130-817698 and leave mail to
\r
240 extension 2389. From outside Germany, please call +1-510-624-7120 and
\r
241 leave me a voicemail. Or call LORE BBS in Germany to leave me a mail,
\r
242 or you can also ask any THC member how to reach me. And yes, I am
\r
243 on IRC sometimes, try to catch me in #bluebox.
\r
250 NOTE: These are ONLY the *best* textfiles I found about these VMB systems.
\r
251 I didn't put a description of hacking tools for boxes in too, because
\r
252 hacking boxes with tools is senseless once you have one valid box on
\r
259 This file describes a lot of VMB systems and their features. Short-cut,
\r
260 but the best you can get! Written by (?) accidential tourist.
\r
267 Both files were written by CaveMan and are also distributed under caveasp.zip
\r
268 They give you a good overview about the commands and on how-to-hack.
\r
269 NOTE: The 3-digit-error is STILL found very often!
\r
276 The article from DeadKat in the Cotno Mag #1 is about the hacking of Audix;
\r
277 the second one is from Crazybyte. It contains some mistakes but reading it
\r
278 is still worthwhile.
\r
284 The Cindy system is not very common, but quiete nice.
\r
285 Article from Slycath.
\r
287 Meridian Voice Mail
\r
288 -------------------
\r
292 Again, DeadKat brings us an excellent article in Cotno Mag #4. (He, please
\r
293 contact me if you read this!) The other one is from ColdFire and concerns
\r
294 about the setup of the voicemail system through the computer extension.
\r
296 ROLM CBX / Phonemail
\r
297 --------------------
\r
301 The first article from OleBuzzard deals with the PBX system; the second
\r
302 one from Substance is on how to setup Phonemail through the dial-in port.
\r
308 The article from IceMan in Phrack #44 is a good article for beginners.
\r
309 It introduces the features of the SL-1 series and gives a command overview,
\r
310 but it doesnot explain enough on the programming. Where is the promised
\r
311 part 2? Nortel "secures" its systems with a variety of abbreviations, so
\r
312 you must have a manual or simply have to guess. Special Info: If you
\r
313 try something, and you want to cancel the commands, press **** and you
\r
314 will be back at the main screen.
\r
320 You see, Cotno is really a great mag. The article from Panther Modern is
\r
321 one of the best one's about System 75, and there are a lot of them.
\r
projects / oweals / thc-archive.git / blob