Steal This CD/steal_this_cd.iso/Chapter 02 - The First Hackers -- The Phone Phreakers/vmbhaq.txt

Text File | 2005-09-27 | 34KB | 1,651 lines

 Stripped Ink

      Issue 4,  Volume 1

   Presents





      *********************************

      *                               *

      *       Voice Mail Hacking      *

      *                               *

      *         By: ROADKILL          *

      *                               *

      *       March/April 1994        *

      *                               *

      *********************************





Contents:



  I. Introduction

 II. Voice Mail Hacking Basics

III. AUDIX

 IV. Message Center

  V. Infostar VX Voice Processing System

 VI. Meridian Mail

VII. ASPEN

       VIII. Phone Mail

 IX. Ready

  X. Sydney

 XI. Pac-Tel Meridian

XII. System Manager Functions (TaKiNG C0NTR0L!)

   A. System Management Overview

   B. Message Center Administration

   C. Infostar VX Administration

       XIII. Hacking Unknown Systems

XIV. Advanced VMB Hacking

 XV. Conclusion

_________________________________________________________________



    Introduction:



OK, so you want to know how to hack  VMB's. In  case  you

don't know already, VMB is an acronym for Voice  Mail Box. A  VMB

is basically a sophisticated  answering  machine run by computer.

The  computer  is  usually  an  IBM  compatible with a large hard

drive, and the necessary voice mail equipment. Some  systems such

as ROLM's Phone Mail store their data on magnetic  tape, and  the

ASPEN, made  by  Octel,  uses  a  modified  Quantum hard drive. A

typical voice mail system can have hundreds, sometimes  thousands

of voice mail boxes available. Most companies now use voice mail.

A voice mail system can be of great convenience to a  company. It

can  reduce  the  number  of  calls  to a receptionist, therefore

providing her/him with more time for other tasks. It also aids an

employee by being able to record messages while  he/she is out of

the office or on another line.  Some  voice mail systems can even

page  a  person  when they receive a message, and most voice mail

systems allow you to transfer messages to another user and  other

cool functions.

"What the hell can I use a VMB for?" you ask?  Well  they

are  handy  to  have  to trade with, or if your K-RaD enough, you

could run an 3l33t code line (k0DeZ!). However, most  people  use

them as an easy way to keep in touch with people. What I'm  going

to  describe  in  this file is how to get a box on a system,  and

some  other  stuff I hope you find interesting. Well,  enough  of

this; let's learn how to hack some VMB's!

_________________________________________________________________



Voice Mail Hacking Basics:





To  hack  VMB's,  it's necessary  to be  able to know the

following things:



   What kind of system it is,

   Some of the common defaults,

   How to transfer to the box itself,

   How to login to the box,

   The number of digits the boxes are,

   The range of the boxes (ex.2200 to 9999),

   How to access the names directory...





If you know what kind of system you're  trying  to get  a

box  on, it  will  be  easier  for you because you'll know how to

exploit the weaknesses of a system. Read  the  individual  system

descriptions that are in this file.



OK, as usual, people  are  often  lazy and use a passcode

that is easy  to  remember.  The  following is a list of the most

common passcodes that people use:



Box Number (ie. Box number:2225, Passcode:2225)



1234 12345 123456

0000 00000 000000

1111 11111 111111

2222 22222 222222

3333 33333 333333

4444 44444 444444

5555 55555 555555

6666 66666 666666

7777 77777 777777

8888 88888 888888

9999 99999 999999



Some  systems  have  a  default  that  is  unique to that

system. I'll  cover  these  in  the  system  descriptions  below.



Finding out how to transfer to the box should  be  pretty

easy, the reason for this should be obvious. Finding out  how  to

login to the box can sometimes be a little more difficult, but it

shouldn't be that hard.



Determining the number of digits  and  the  range  of the

boxes is essential; you need to  know  this  in order to find out

where the boxes are.



  It  is  not  necessary  to use the names directory. However, it

sure does make finding empty boxes, the number  of  digits in the

box number, and the range a lot easier.

_________________________________________________________________



AUDIX



AUDIX (AUDio Information eXchange) is a voice mail system

made  by  AT&T.  It  is  easily  identified by the command voice:

"Entry not understood, please try again  after the tone. [BEEP!]"

You'll  hear  this  message  after  you  enter  an invalid key or

option. You  can  usually snag  a box off an AUDIX system without

much  difficulty.  First,  press  "*"+"T" (to transfer). Try this

when  you  get  the  main  greeting.  It  should  say enter the X

(number) digit  extension.  Remember  the number  of  digits  the

extensions are. Now  press "*"+"*"+"N" (for the names directory).

Now, try  a couple of common names to get an idea of the range of

the  boxes. After  you got an idea of the range press "*"+"A" (to

look up by extension).  Now, just start  scanning  for  boxes. Do

this  by entering  the  box number  plus  "#".   You  should  get

one of following responses:



1. The name of the box owner.

2. Extension XXXX, Not Valid.

3. Extension XXXX (This is what we're looking for).



OK,  keep  track  of  all  the  extensions  that give you

response number three. After you're done scanning, press  "*"+"#"

to exit  the directory. Now enter "*"+"R" (to login). Enter   the

number of one of the boxes you found while  scanning, then  press

"#". You'll now be prompted for a password. The  default password

for AUDIX is the "#" sign (ie. Bx.1234, Pw.#). If you can't login

using the "#" sign try the defaults listed above.



Once you get into a box, if no one has used it before, it

will give you a brief tutorial, and help  you  set  the  box  up.

DO NOT record a name for the box. Just leave  silence. You  don't

want some one going through the directory and hearing: "For [your

name] press 2222". So, just record silence. Sometimes you'll find

an empty box that won't have the tutorial. These are cool to  use

too (as long as they are empty).  Remember, anytime you need help

on an AUDIX, press "*"+"H".



AUDIX Commands:



       *R - login

       *H - help

       *T - transfer to extension

      **N - names directory (*A to look up by extension)

1 - send message to another user

2 - get messages

3 - personal greetings

4 - check outgoing messages

5 - personal options(see below)

6 - outcalling information(see below)

7 - autoscan incoming messages



Personal Options:



1 - mailing lists

2 - personal directory

4 - password

5 - record mailbox name





Outcalling Information:



AUDIX can be set up to  notify you when  you  receive  an

incoming  message.  From  the   outcalling   menu, you  enter the

number that it will contact you at. It  can   also   be  used  to

call a pager. When you receive a  message AUDIX will call you and

say:  "This  is  AUDIX".  "[mailbox name],   please   enter  your

password." This is a neat feature, but I don't recommend that you

use it, for obvious reasons.

_________________________________________________________________



Message Center



Message Center is another system that is widely used with

companies  today.  A  good  way to tell if you've found a Message

Center is to press "*" or "* + *" at the system greeting. If it's

a Message Center it will say "Welcome to the Message Center". OK,

find the range of the boxes by checking out the directory. If you

come across an entry that just lists the box number, take note of

it, it's probably a vacant box. Now, transfer to  the  box. While

the greeting is playing press "*". One of two things will happen:



1. You'll be prompted for the passcode

2. You'll be let into the box



There is no real default for the Message Center. If a box

hasn't been assigned a passcode, pressing "*" during the greeting

will  let you into the mailbox. If it asks for a passcode you can

try the regular defaults. You can  also press "*" at the passcode

prompt to transfer another extension.



The Message Center  uses a couple of tricks to discourage

hacking. This can also be of use to us. The  first trick is: When

entering the passcode, it will  stop you when you enter one digit

more than the length of the passcode. The corollary  is, that the

passcode length is one digit less than the length of the passcode

you entered before you were stopped. The second trick is: If your

first passcode guess is wrong, but the second is correct, it will

still  give  you  an error. If you enter the correct passcode the

third time it will  let  you  in  the  mailbox. However, both the

second and the third entry must  have the correct passcode entry.



Two more things, if your scanning through the  directory,

and happen to come across a  box with the name  System Manager or

System Administrator, remember this; this is the  System  Manager

mailbox. See the section on System Manager functions below.  Also

the  Message Center  will  tell  a  mailbox  subscriber   when  a

suspicious  amount  of  invalid  passcodes  have   been  entered.





Message Center Commands:



M(6) - Send a message to another user

P(7) - Play messages

U(8) - User options

X(9) - Exit system





User Options Menu:



N(6) - Change mailbox name

P(7) - Change passcode

L(5) - Distribution list

T(8) - Tutorial (not always implemented)

X(9) - Exit user options

_________________________________________________________________



Infostar VX Voice Processing System





The Infostar VX is another common  system. To  login to a

mailbox you press the "#" sign at the main greeting. You are then

prompted  to  enter  your  mailbox number, then your password. To

transfer to a box press "*" then the box number. The  Infostar VX

has no set default. When a mailbox is created it assigns a random

passcode for the box. The system  manager usually changes this to

something easy to remember, so when you find an empty box try all

the common defaults.



A good  way  to find boxes on an Infostar is to go to the

directory. It will tell you to enter  the first couple of letters

of a  person's name. A  cool  trick  here is that you can usually

enter just one letter, and  it will start spitting all the people

whose name's begin with that letter. If you happen to transfer to

a  box  that  says  "This  is  the  Infostar  VX Voice Processing

System." "Dial the number of the person you're calling." "If  you

have a mailbox on the system press pound." Remember  this  is the

administrator  mailbox.  See  the  section  on  system management

below.





Infostar VX Commands:



  Main Menu:



    1 - To listen to messages

    2 - Record and send a message

    3 - Personal options

    4 - Check delivery



User Options:



    1 - Greetings

    2 - Access code

    3 - Group list

    4 - Message notification



-----------------------------------------------------------------



Meridian Mail





Meridian Mail  is  a  very  popular  system. It's made by

Northern Telecom. A good way to tell is, when  you  transfer to a

box it will usually say "Meridian Mail, mailbox?". Another way to

tell is pressing "81" during the  mailbox  greeting. If  it  says

something  like  "mailbox?",  you  can  be  pretty  sure  it's  a

Meridian. "81"  is  the  command to login to a box. You enter the

box number and "#", followed by the passcode and "#". The default

is usually the mailbox number.



Meridian Mail Commands:



* - Help

       0* - OUTCALLING! (see below)

2 - Play message

4 - Goto previous message

6 - Goto next message

9 - Call the sender of a message

       70 - Message options

       71 - Reply to the message you just listened to.

       72 - Play envelope

       73 - Forward message to another mailbox

       74 - Record one reply for all messages

       75 - Record a message. Press "#" to stop recording.

       76 -Delete message

       79 - Send message

       80 - Mailbox options

1  -Change operator assistance number

2 - Remote notification (depends on class of service)

       81 - Login

       82 - Change greeting

1 - Internal greeting

2 - External greeting

       83 - Logout

       84 - Change passcode

       85 - Create distribution list



       ( This can be used to scan for other  mailboxes.

 Press "5" to compose a new list. Now enter the

 box number plus "#". Take  note  of boxes that

 respond  with  "mailbox  XXXX". Press "#+#" to

 stop, then 76 to delete the list. )



       86 - Goto message

       89 - Personal verification

4 - Exit

5 - Record mailbox name



Outcalling:



Yes, you can dial out of a  Meridian Mail  mailbox. Press

"0+*", it will then say something like: "This  is a  service that

will connect you to the number that you specify." On some systems

you can only connect to another extension. A lot  of them usually

dial  local.  However,  there  are  a  few  that  can dial LD and

overseas.  There  are  a  few  different  formats  that are used.



Extension+#

9+Local number+#

9+0+Local number+#

9+1+Local number+#

8+Local number+#

8+0+Local number+#

8+1+Local number+#

9+Area code/number+#

9+1+Area code/number+#

8+Area code/number+#

8+1+Area code/number+#

9+011+Country code/city code/number+# (Very rare)





A lot of companies are  becoming  aware  of  this  little

trick, so you might have to look for a while until  you  can find

one that will outdial to  anything other than another  extension.

However there are a lot out there that will still  dial  locally.

_________________________________________________________________



ASPEN





The  ASPEN  (Automated SPeech Exchange Network)  is  made

by  Octel. The  is a good article on the  hardware  specifics  of

this system in Phrack #45. To hack  a box  start scanning through

the boxes until you come across one that says: "You  have reached

mailbox  number  XXXX  please record a message at the tone." Most

likely  that  is  an  empty  box. To login to an ASPEN press "#".

You'll be prompted for your mailbox number  and your passcode. If

it  is  a  new  box  after  you enter the box number it will say:

"Welcome to your new mailbox, please enter the temporary passcode

assigned to you by your system manager". There  is no set default

for an ASPEN mailbox. Just  try all the common ones until you get

in.  ASPEN's  are  full  of  features  that  make it appealing to

people.



ASPEN Commands:



     Main menu:



   1 - Review messages

   2 - Send message

   3 - Check for a receipt (of a message sent)

   4 - Personal options





Review Messages menu:



     During message review:



   1 - Rewind

   2 - Pause or restart

   3 - Forward

   4 - Play slower

   5 - Message envelope

   6 - Play faster

   7 - Quieter

   8 - Normal volume



     After message review:



   4 - Replay

   5 - Message envelope

   6 - Send copy

   7 - Delete message

   8 - Reply

   9 - Save message



     Send Message menu:



   1 - Private message

   2 - Urgent message

   3 - Message confirmation

       1 - Confirm receipt

       2 - Notify of non-receipt

   4 - Future delivery



     Personal Options menu:



   1 - Message notification on/off

   2 - Administration

       1 - Change password

       2 - Distribution list

       3 - Prompt levels

   3 - Greetings

       1 - Personal greeting

       2 - Extended absence greeting

       3 - Mailbox name

   4 - Notification schedule

       1 - First schedule

       2 - Second schedule

       3 - Temporary schedule

_________________________________________________________________



Phone Mail





Phone Mail  is  made  by  ROLM. It  is  one  of the  most

challenging voice mail  systems  to  hack. It  is also one of the

most rewarding. On  some  boxes you can  have  over  a ten minute

greeting (depends on class of service). The Phone Mail system can

be  configured  in  several  different ways, one  which is almost

impossible to hack. Phone Mail  can  be  set  up  to be a sort of

information center. When  it's  set up for this there are usually

no boxes on the system. You can usually tell if a system has been

set up this way if it says  something  like  "Press 1  for  info.

on "blah." Press 2 for info. on blah, etc." These are usually set

up by companies for advertising, and it  will  not  allow  you to

leave a message.

When  you  do  find a system, just start scanning through

the directory. All Phone Mail systems have some sort of directory

you can scan through.

The  hardest  thing  about  Phone  Mail  is  finding  the

access method. Some  are  set up where you have to dial an access

number (try  scanning  around where you found the Phone Mail at).

On these you dial the number and it says: "This is the Phone Mail

system,  you  can  either  enter  your  extension  or your name."

Sometimes  they  set  up  a  specific  extension you have to dial

before you can access your mailbox. Also  sometimes  they have it

set up where  you just  press  "#"  to  login  to  your  mailbox.

No  matter  what  method  they  use,  there's no reason to worry,

because there's a simple way around this.

Here's  an  example  of how  to use  this: Transfer to an

extension. Wait  until  you  heard the greeting and the tone. Now

press "*"+"6"+"#". It will now say something  like: "Please enter

the extension of the person you are calling, or  press "#" to use

the Phone Mail features". Now  all  you  have to  do is enter the

extension + "#",  then   the   passcode + "#".  The  default  for

Phone Mail seems to be "111" or "1111". I'm  not  positive  about

this, but it's what I've usually came across.



One more thing: when you're in the directory try entering

"Test" or "TestMailbox"  for  the  person's   name.  Most systems

usually have one of these boxes set up. It's usually  empty (This

also may work on some other voice mail systems  also). Try  using

"111" or "1111" to get in the mailbox.





Phone Mail Commands:



   1 - Record message

   3 - Listen to messages

   8 - Answering options

   9 - Mailbox options

  70 - Transfer out of Phone Mail

  76 - Disconnect from Phone Mail



Answering Options menu:



   1 - Greetings

   2 - Answering mode

   3 - Set referral extension

   4 - Mailbox name

   # - Goto main menu



Mailbox Options menu:



   1 - Distribution lists

   2 - Prompt level

   3 - Password

   4 - Outcalling schedule

   # - Goto main

_________________________________________________________________



Ready Systems





Ready  systems  are  also   known  as  Bix. Hacking  this

system  is easy, but it can take a while. First  you  can  do two

things: the  first  is  that  you  can scan through the directory

until you find an empty box. Now  go  back  to  the main menu and

login to the box by pressing "#". You'll then be prompted for you

mailbox number then your passcode. If the box is  new,  you  will

not need a  passcode.  It will let you right in. Sometimes people

assign a simple passcode for new boxes. If that  is the case, try

the defaults. The second way to hack a Ready system is  after you

find  the  range of the boxes, go back to the main menu and login

(by pressing "#"). Now enter the  number  of the mailbox you want

to start scanning from. If it prompts you for  a  passcode, press

"*"+"0"+"#".  Then  try  the  next  box. You can scan through the

entire range to see if you can get into any boxes.



   What the "*"+"0"+"#" combination does is this:



* - Aborts the passcode entering feature.

0 - Pages the operator  (You should get a message, but

     if a human answers, hang up and  try  hacking the

     system after hours. When  you  page  the operator

     this sets the error count to zero.)

# - Command to login to a box.



   Ready Commands:



4 - Change greeting

5 - Listen to messages

6 - Record and send a message

9 - Exit

0 - Dial another box

9 - Exit system

* - Continue using mailbox

      1+8 - Change volume of prompts

      1+6 - Administration options

1 - Message waiting

2 - Passcode

# - Return to main

0+Command - Help description for command

_________________________________________________________________



Sydney



The Sydney system is from Australia, and  can  be  easily

identified by  its  unique  logoff message of "Good day" (it also

can  be  "Good morning" or "Good evening" -depends on the time of

day). Another  indication  is  that  when  you  press "*" it will

change  the  volume  level.  Sydney  can  be  hacked pretty easy,

however  you'll  get  logged  off  if  you  enter  three  invalid

mailboxes in a row.

There is a simple trick to hacking Sydney.  For  example,

let's  say  the  boxes  start at 100. You transfer to the box and

during the greeting press "0" (This is the login command. You can

also use this at the system greeting). Now it will prompt you for

a passcode try "0".  If  it  doesn't say "You have no messages.",

then press "#"+"#". Repeat the process for mailbox 101 and so on.

"0" is the default passcode for mailboxes that have  just

been  set  up.  If  you  press  "0" and it just sits there, it is

actually  waiting for you to enter three more digits (the maximum

passcode length on a Sydney seems to be four digits) which is why

you press "#"+"#".

Sydney has a function called "Call Placement". Using this

you  can  record  a  message,  have  Sydney dial a number and the

person will hear the message, and their response will be saved in

your mailbox. You  can  set  it  up  so that Sydney will call the

number every X number of minutes, and deliver the  message. (This

is great for pranking someone you dislike.)



   Sydney Commands:



      1 - Record message

      2 - Receive messages

      3 - Message forwarding

      4 - Call Placement

      5 - Group messages

      6 - Certified messages

      7 - Guest accounts (Create an account for a buddy.)

      8 - Personal Options

      9 - End call



   Personal Options menu:



      1 - Change greeting

      2 - Change passcode

      3 - Change mailbox name

      4 - Listen to system bulletin

      9 - Return to main menu

_________________________________________________________________



Pac-Tel Meridian





This is a great  system. It's easy to  use  and  you  can

have a long greeting. Sometimes you  can  identify one because it

will play four tones when the system answers. Some  systems  have

this disabled. The way to  login  is  to  press "#" at the system

greeting. The  default  is "0000". A good way to find empty boxes

is to go to the directory.  When  it  asks  you to press a letter

just press one key. It will go through  all  the  extensions that

begin with  the  corresponding   letters. When  you  come  across

something like "Mailbox XXXX", you've found a blank box.





   Pac-Tel Meridian Commands:



      2 - Record and send a message

      3 - Phone manager functions

      * - Quit

      # - help



   Phone Manager Functions:



     1 - Personal Options

       1 - Immediate message notification

       2 - Daily message reminder

       3 - Record greeting

       4 - Change passcode

       5 - Record mailbox name

       6 - Record announcement for a mailbox you sponsor

       * - Exit personal options

     2 - Voice Mail Options

       1 - Check unacknowledged messages

       2 - Record the name for a mailbox you sponsors

       3 - Change distribution list

       * - Exit voice mail options

     3 - Automated Attendant Options

       1 - Call Screening

       2 - Call processing

       3 - Extension specific processing

       * - Exit automated attendant options

_________________________________________________________________



System Manager Functions (TaKiNG C0NTR0L!)





Overview:



If  you have come across a  box  with  the  name  "System

Manager" or "System Administrator"  definitely try to access this

box. This could be the Administrator Box!  Once  in  this box you

can create boxes, delete boxes, change class of  service,  send a

broadcast message (sends the message to every box on the system),

change passcodes and a lot of other stuff. In other words this is

the God box. It is usually the last (most common) or first box on

a system. Not all systems have  administrator  boxes. For example

all Phone Mail  administration is handled through a computer dial

up. (There will be an article on this in a future  issue  of this

publication). Basically, if you can get in  the administrator box

you control the system. Out of the  systems  I  covered  in  this

article,   Infostar,   ASPEN   and   the   Message   Center  have

administrator boxes. I'm going to cover Infostar  and the Message

Center  here.  Alas,  I  haven't  been  able  to  access an ASPEN

administrator box yet, so I don't know the  commands.  If  anyone

reading this does please contact me.



  Message Center Administration Commands:

     (Once in the admin box press "*" from user options)



      A(2) - Add a mailbox

      D(3) - Delete a mailbox

      M(6) - Modify a mailbox

      P(7) - Change the passcode of a mailbox

      K(5) -  Clock

      I(4) - Backup to floppy

      U(8) - Usage statistics

 * - Exit mailbox administration





When  you  add  a  mailbox you need to enter a  class  of

service, a limits  class  of service and a message waiting class.

Here is a list of the ones to use:



      Normal Box    Check In   Check out   Time Box

 Class:    01          04          05          09

  Limits class:    03          05          05          05

  Mess.waiting:    00          05          05          05



The  Time  Box  tells  the time when you transfer to  the

box. The Check In  and Check Out boxes allow you to read mail and

change the passcode on other boxes.



  Infostar VX Administration Commands:



      1 - System greetings

      2 - Broadcast message

      3 - Mailbox administration

1 - Change passcode

2 - Add mailbox

3 - Delete mailbox

8 - Record mailbox greeting

9 - Reset message waiting indicator

      4 - System group lists

      5 - Time and date



When you add a box on an Infostar system always use "100" for the

class of service. The mailbox types are:



      1 to 3-Regular box

      10-Administrator box (You can have more than one on

     a system!)



Also   when  you  create  a  mailbox you'll be prompted  for  the

following:



      Extension number

      Attendant extension number

      Department number

      Spell subscriber's name



When you get these prompts,just hit "#" to skip  them.  The  only

things  you  need  to  enter  are:  The  mailbox number, class of

service and mailbox type. The  system will add the box and assign

a random four digit passcode.

_________________________________________________________________



Hacking Unknown Systems



There are a lot of  systems  out  there  that  I  haven't

covered. A lot of companies also use proprietary  systems. It can

be just as easy (if not easier) to  get a box on these systems as

well. Start by finding out  the  main  functions (See VMB Hacking

Basics above). Go through the directory, and all that good stuff.

Look  for  administrator boxes. Do it all.  Just  remember,  most

people aren't security conscious when it comes to voice  mail, Oh

well, their negligence can be to your benefit.

_________________________________________________________________



Advanced VMB Hacking



These are just some tips that  I  picked  up  over  time.

OK, first of all check out all of the  extensions  you  can (this

takes time), and see what  you  find. You  may  come  across  fax

machines, carriers, PBX  tones  or a bridge. Sometimes these will

be  in  the  directory  as  an  extension  with no recorded name.

Definitely  check  the  box  out. If you transfer to the  box and

don't  get  anything  but  a short  beep,  have  a  friend try to

transfer  to  the same extension while you are on it to see if it

is  a  bridge.  I  don't think I need to explain what is possible

with  a  PBX  tone.  The  carriers  can  be PBX dial-ups, company

dial-ups, anything is possible. If  you're  nosy  like myself you

can login other peoples boxes and hear thief messages. Take  care

when doing this, because you don't want the  company  to know you

are doing this. It's a good idea to  reset  the  message  pointer

(if you can).  The  boxes  I  always  try to listen messages are:

Computer  Room,  MIS,  System  Administrator,  Switch   Room  and

Computer Operations. Well, you get the idea just try  to  get  in

any  box  that  might  have  something that could be interesting.

Another  thing  you may want to find is an after hoursorder line.

If  you  can  get  into  one  of these you could have an abundant

supply of credit cards (KeWL! KaRDZ F0R MY K0De LiNE!).

Another thing is for those of you that  want  a  800 VMB,

but  can't  get  a  box on it. Try to find a company in your area

code that has an 800 number going to their voicemail system. Find

the local number and go through the system and find the boxes you

want. Now go load up your favorite code hacker. Now  you  can set

it up to try to get into the box. You can do a  couple of things:

You can set it up to go in and change the passcode , or  you  can

set it up to send a message after it has got into  the  box. Just

find a box you can get into. It  doesn't  matter  if  someone  is

using it or not. Now have your code hacker programmed to dial the

system, access the box, enter a passcode, and  send  a message to

the box you can get in. For example we'll  say  that  you  have a

Message Center that the box you want the passcode  to  is 999 and

you can get into box 222.



Now set your code hacker to dial the following string:



   atdt  XXX-XXXX,,,999,,*,,YYYY,,6,,222,,,#,,,,,#,9



   XXX-XXXX-The number of the voice mail system

   999-Transfers to the box you want to hack

   *-to login

   YYYY-The passcode the for the code hacker to try

   6-To send a message to another user

   222-The box to send the message to.

   #-To start recording to message

   #-To stop recording

   9-Send message



Now  all  you have to do is  check  mailbox  number  222,

and see what time the message was delivered.Now look at your scan

logs  and  see what number it dialed at the time your message was

sent.   Voila!   You   now   have   the  passcode  for  box  999!

If your can't set your code hacker to record all  numbers

dialed, just set it to scan sequentially. Every 30 minutes or  so

jot down what code it's trying. This way you can get a  good idea

of the area that the passcode is in.  Another  way: If  you  came

across a carrier on the system. Set  the code  hacker to transfer

to the extension of the carrier. When it  connects to the carrier

you'll have the passcode in  your  log. (This  is  the  method  I

prefer.)

_________________________________________________________________



Conclusion



Well that's about it for this file. I hope  some  of  out

there  found  this  file  useful.  If  anyone  has any questions,

comments or complaints, you can email me at:



    [e-mail]





Greetings to:

       Bane(314), Cjesus(313), Mr.Smith(615),

       Lucid Nightmare(214), Sirius(214),

       Dr.Strange(901), FuNKY G00DHeaRT(214)

       and to Jack the Ripper(214) for putting

       this in Stripped Ink.

_________________________________________________________________