SuperHack

home *** CD-ROM | disk | FTP | other *** search

/ SuperHack / SuperHack CD.bin / Hack / MISC / DATAPAC.ZIP / DATAPAC.HAK

Wrap

Text File | 1996-05-19 | 33.9 KB | 754 lines

The THC Hack/Phreak Archives: DATAPAC.HAK (2024 lines) Note: I did not write any of these textfiles. They are being posted from the archive as a public service only - any copyrights belong to the authors. See the footer for important information. ========================================================================== (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*) (*) (*) (*) The Lost Avenger And Spectrum Proudly Present: (*) (*) (*) (*) The Beginner's Guide To Hacking On Datapac (*) (*) (*) (*) Written On October 22, 1990 (*) (*) (*) (*) Copyright 1990 - All Rights Reserved (*) (*) (*) (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*) - Table Of Contents - Part I Disclaimer Part II Introduction Part III The Ten Commandments of Hacking Part IV How To Find Different Types Of Systems On Datapac Part V How To Connect To Datapac Part VI Explanation Of Datapac's "Call Conencted" Message Part VII Datapac Network Messages Part VIII What Is A NUI? Part IX Why Have A NUI? Part X Datapac Family Of Services (a) Datapac 3000 (b) Datapac 3101 (c) Datapac 3201 (d) Datapac 3203 (BSC) (e) Datapac 3203 (SDLC) (f) Datapac 3304 (g) Datapac 3305 (h) Datapac Access Software (DAS) Part XI Identiifing The Different Operating Systems (a) Hp-x0000 (b) Prime (c) Tops (d) Unix (e) Vax/Vms (f) Vm/370 Part XII Conclusion Appendix A Datapac 3000 Public Dial Ports Appendix B Datapac 3101 Public Dial Ports Appendix C Datapac 3305 Public Dial Ports Appendix D Datapac Network Identifier Codes (DNIC) Appendix E Trouble Shooting Appendix F CCITT Recommendations Appendix G Glossary - Part I - - Disclaimer - The puropse of this document is to educate people about the Datapac network. The author nor the group (Spectrum) will be held responsible for the reader's actions before, during, and following exposure to this document as well as the validity or accuracy of the information contained within this document. - Part II - - Introduction - After reading through my large collection of g-files. I have found that there hasn't been a good text file for beginner's about hacking the Datapac network. This guide will give a general insite on how to identity different types of operating systems when you are hacking about Datapac. I hope this will give you enjoy of my knowledge to help get you started. Hope you learn a lot about Datapac and enjoy reading it at the same time. - Part III - - The Ten Commandments of Hacking - These are the ten rules of hacking that I go by when I hack around on systems. These rules are important in order maintain from being caught or discovered illegally hacking on a system. I. Do not intentionally damage *any* system. II. Do not alter any system files other than ones needed to ensure your escape from detection and your future access (Trojan Horses, Altering Logs, and the like are all necessary to your survival for as long as possible.) III. Do not leave your (or anyone else's) real name, real handle, or real phone number on any system that you access illegally. They *can* and will track you down from your handle! IV. Be careful who you share information with. Feds are getting trickier. Generally, if you don't know their voice phone number, name, and occupation or haven't spoken with them voice on non-info trading conversations, be wary. V. Do not leave your real phone number to anyone you don't know. This includes logging on boards, no matter how k-rad they seem. If you don't know the sysop, leave a note telling some trustworthy people that will validate you. VI. Do not hack government computers. Yes, there are government systems that are safe to hack, but they are few and far between. And the government has inifitely more time and resources to track you down than a company who has to make a profit and justify expenses. VII. Don't use codes unless there is *NO* way around it (you don't have a local telenet or tymnet outdial and can't connect to anything 800...) You use codes long enough, you will get caught. Period. VIII. Don't be afraid to be paranoid. Remember, you *are* breaking the law. It doesn't hurt to store everything encrypted on your hard disk, or keep your notes buried in the backyard or in the trunk of your car. You may feel a little funny, but you'll feel a lot funnier when you when you meet Bruno, your transvestite cellmate who axed his family to death. IX. Watch what you post on boards. Most of the really great hackers in the country post *nothing* about the system they're currently working except in the broadest sense (I'm working on a UNIX, or a COSMOS, or something generic. Not "I'm hacking into General Electric's Voice Mail System" or something inane and revealing like that.) X. Don't be afraid to ask questions. That's what more experienced hackers are for. Don't expect *everything* you ask to be answered, though. There are some things (LMOS, for instance) that a begining hacker shouldn't mess with. You'll either get caught, or screw it up for others, or both. - Part IV - - How To Find Different Types Of Systems On Datapac - I think in my own opinion the best way to find systems is by scanning them out. Getting them off a board or off a friend is not very safe as them may already have been hacked to death. Now you are probably wondering how you scan for systems, well this is what you do. You select a four digit number eg. 4910 or something like then, what you do is when you connect to Datapac network you type in the four digit number you selected then type in a four digit ending number and then increase the last four digit number and press enter. Datapac wil give respond by giving you a Network message (see Part VII for the Datapac network messages), which will tell you if the systems you are reaching is out of service, up, busy, and so on. If you successfully connected to a system and want to disconnect from if type in "^(Control)-P Clear <CR>". Then to scan for more systems just add one to the last four digit number entered before and keep on sccaning up until whatever suits your needs eg. start scanning at 4910 0000 and stop scanning at 4910 1000. - Part V - - How To Connect To Datapac - Network Response 1) Make sure your computer on. 2) Load your terminal program. 3) Call your local Datapac node. (See Appendix A, B, And C) 4) Once connect type in "..<CR>" DATAPAC: XXXX XXXX 5) Enter your NUA address to access. - If it connects to the NUA specified, it will display this message. Call connected to: XXXX XXXX - Otherwise it will display a different message. See Part VI for other Datapac Network Messages. - Part VI - - Explanation Of Datapac's "Call Connected: Message" - When a Datapac call is established through the network, a call connected message is received at the originating DTE. All or some of the following messages may be identified depending on the type of call, options used for the call, and the type of destination. Example: [HUNTED] [BACKED UP] [BACKED UP & HUNTED] [i LCN] [P/N PACKETSIZE: (128 OR 256)] [NUI (6 to 8 CHAR)CHARGING] [CUG:(CUG#)] [REVERSE CHARGE] MESSAGE EXPLANATION ------- ----------- Call connected to: XXXXXXXX A virtual circuit has been established between an originating DTE and a remote (receiving) DTE. Hunted The remote logical channel is part of a hunt group. Backed Up The call attempt to the remote DTE has failed. The network has re-directed the call to another predetermined DTE that has been optioned as backup. i The call has been placed to an international address. P Priority service. Packet size: 128. N Normal service. Packet size: 128 or 256. DNA Data Network Address of the originating DTE. LCN Logical Channel Number of the recipient DTE. NUI The call will be billed to the 6 to 8 character Network User Identifier. CUG The recipient DTE is part of a closed user group. Reverse Charge The recipient DTE has accepted the charge associated wih the established call. - Part VII - - Datapac's Network Messages - There are thirty-three messages which may appear when you are accessing the Datapac network. All of these network-generated messages which are sent to a terminal, are written as "Datapac: text". The "text" will be one of the following messages: ADDRESS This is a Datapac herald message for an SVC terminal. The "address" displayed is your Datapac network address. This message indicates that you are connected to the Datapac network. Proceed with the call request command. {P,R} TERMINAL ADDRESS -- (DESTINATION ADDRESS LOGICAL CHANNEL) This is a Datapac herald message for a PVC terminal. It indicates that you are connected to the network (address and destination address) CLOSED USER GROUP ERROR INVALID ADDRESS, MORE THAN 12 DATA CHARACTERS, or COMMA REQUIRED BEFORE DATA CHARACTERS These messages indicate an error in the call request command--correct and re-enter the command. CALLED BY [P][R] or [N][I] ADDRESS (XXX) This message indicates that a host or terminal has called you. Proceed with sign-on. (Note: P or N denotes grade of service. R specifies the charging option, if applicable. I specifies that it is an international call. (XXX) specifies the logical channel number if it is a national call, and specifies the gateway id if it is an international call. CALL CONNECTED This message indicates that the SVC connection between your terminal and the destination has been established successfully. RE-ENTER This message indicates that a transmission error has occurred in the current input line. Re-enter the line. If the problem persists, report the trouble to Telecom Canada. INPUT DATA LOST This message indicates that a transmission error has occurred. Since part of your input line has already been transmitted to the destination, enter a "line delete" character for your application and a carriage return (CR). When the destination replies, re-enter the line. PARITY ERROR This message indicates that a parity error has occurred in the current input line from a terminal which is operating in echo mode. The character which is in error is not echoed. Re-enter the character and continue normal input. If the problem persists, report the trouble to Telecom Canada. INPUT ERROR This message indicates that there is a network problem, due to overruns. If the problem occurs often, contact Telecom Canada. PVC DISCONNECTED - TEMPORARY NETWORK PROBLEM This message indicates that a network problem is preventing the requested call from continuing. Wait for the Datapac herald message, then continue. If the condition persists, contact Telecom Canada. PVC DISCONNECTED - DESTINATION NOT RESPONDING This message indicates that either the access line to the destination, or the destination itself is down. Try again later. If the condition persists, contact the destination. PVC DISCONNECTED - REMOTE REQUEST This message indicates that the desti- nation has asked that the connection be discontinued. INVALID COMMAND This message indicates that there is a syntax error in the command. Correct it and re-enter the command. COMMAND NOT ALLOWED This message indicates that the command which was entered, although syntactically correct, cannot be implemented either due to the NIM state, or because it violates and/or conflicts with the service options selected --e.g., a call request command, when an SVC is already established. CALL CLEARED -- DESTINATION BUSY This message indicates that the destination computer cannot accept another call. Try again later. CALL CLEARED -- INCOMPATIBLE CALL OPTIONS This message indicates that the call request command includes facilities which are not available at the destination or are incompatible with it. Verify and try the call again. If the problem persists, contact the destination. CALL CLEARED -- TEMPORARY NETWORK PROBLEM This message indicates that a network problem has occurred--try again later. If the problem persists, report it to Telecom Canada. CALL CLEARED -- DESTINATION NOT RESPONDING This message indicates that the destination is either not acknowledging your request to connect or it is inoperable. Try again later. If the problem persists, contact the destination. CALL CLEARED -- ACCESS BARRED This message indicates that the network has blocked your call because of a Closer User Group violation. Verify the call establishment procedures with the destination. CALL CLEARED -- ADDRESS NOT IN SERVICE This message indicates that the network address in the call request command identifies a non-existent destination-- i.e., the address is not yet (or is no longer) assigned. Verify the address and re-enter the call request command. If the condition persists, contact the destination. CALL CLEARED -- COLLECT CALL REFUSED This message indicates that the desti- nation is not willing to accept the charges for the connection (e.g., it does not accept calls from Datapac public dial ports). Verify the call establish- ment procedures and try the call again. If the condition persists, contact the destination. (See Part VII and Part VIII for more information. CALL CLEARED -- LOCAL PROCEDURE ERROR This message indicates that a network protocol error has occurred. Try the call again. If the condition persists, report the trouble to Telecom Canada. CALL CLEARED -- REMOTE PROCEDURE ERROR This message indicates that a destination protocol error has occurred. Try the call again. If the condition persists, contact the destination. CALL CLEARED -- LOCAL DIRECTIVE This message indicates that a virtual circuit has been cleared in response to a clear command from a terminal user. CALL CLEARED -- REMOTE DIRECTIVE This message indicates that a virtual circuit has been cleared in response to a clear request packet from the destination. CALL CLEARED -- REMOTE REQUEST This message indicates that a virtual circuit has been cleared in response to an invitation from the destination to clear the call. RESET -- TEMPORARY NETWORK PROBLEM This message indicates that a network problem has occurred on the PVC connection. Wait for the Datapac herald message, then continue. If the condition persists, report the trouble to Telecom Canada. RESET -- DESTINATION NOT RESPONDING This message indicates that the destination end of the PVC connection is not responding-- i.e., either the access line to the destination, or the destination itself, is down. Try again later. If the condition persists, contact the destination. RESET -- LOCAL PROCEDURE ERROR This message indicates that the PVC has been reset because of a network protocol error. Wait for the Datapac herald message, then continue. If the condition persists, report the trouble to Telecom Canada. RESET -- REMOTE PROCEDURE ERROR This message indicates that the PVC has been reset because of the destination protocol error. Wait for the Datapac herald message, then continue. If the condition persists, contact the destination. If the host computer is connected via the ITHI option, this message indicates that data has been disregarded due to the host not reacting to flow control conditions sent by the PAD. RESET -- LOCAL DESTINATION This message is the network's response to a reset command from the terminal user. Continue. RESET -- BY DESTINATION This message indicates that the destination has reset the virtual circuit. Data may have been lost. Continue. If the condition persists; report it to the destination. RESET -- TEMPORARY NETWORK PROBLEM These messages indicate that the network has reset the switched virtual circuit. Data may have been lost. Continue. If the problem persists, report it to Telecom Canada. RESET -- LOCAL PROCEDURE ERROR These messages indicate that the network has reset the switched virtual circuit. Data may have been lost. Continue. If the problem persists, report it to Telecom Canada. - Part VIII - The Datapac Manual File #3/7 - What Is A NUI? - Description The Network User Identifier (NUI) is a credit card-like system associated with the Datapac Network - similar to a calling card used to bill long distance calls. A NUI is a 6-8 character alphanumeric code which is entered during call set-up to indicate an account to which Datapac calls may be billed. Associated with each NUI is a password which is used as a security check when establishing a connection to the Datapac network. The password is confidential, known only to the user. Purpose The purpose of a NUI is to allow a Datapac user to make use of the Datapac network for data communications without the requirement of a dedicated Datapac connection or the need for the destination to accept reverse charge calls. Once the NUI/password pair has been correctly validated, the call is set up to the requested destination and call usage billed to the NUI/Datapac account number. Use At call set-up time, the user specifies the NUI and password to the network. The password is used by the network to authenticate the use of the NUI. After the NUI/password pair has been correctly validated (process whereby NUI/password is checked by NUI application), the user will be able to bill all subsequent session usage to the specified NUI. - Part IX - - Why Have A NUI? - There are many useful applications for NUI. - NUI, when provided to authorized users, can eliminate the need for host to accept reverse charge calls. - NUI is required by users of public dial who are placing calls to a host application with the reverse charge blocking option. - NUI permits subscribers of dedicated and private dial Datapac services to "Third Party" usage charges to a NUI account. For example, some users may decide that they do not want usage charged to the dedicated access line which they are using (i.e., if using someone else's line/terminal). By entering the NUI, all usage for subsequent calls during the same session would be billed to the account associated with the specified NUI. - NUI permits sender paid calls to domestic Datapac network addresses and to foreign networks. Users can make international calls to overseas networks and charge the call usage to their NUI when using public dial ports. Offshore networks accessed via Teleglobe do not accept collect calls. Users also have the capability of placing sender paid calls to Domestic Datapac addresses, Telenet, Tymnet, Autonet, ACUNET and DASNET in the United Sates. - NUI is required to complete calls using Datapac indial/outdial ports (i.e., devices at destination not connected to Datapac). - NUI can be used to achieve benefits of departmental accounting. The Datapac bill is itemized to indicate the charges related to each NUI. This will assist in determining which department has generated usage and the associated charges. - Part X - - Datapac Family Of Services - Section A - Datapac 3000 Datapac 3000 is synchronous, application independent service that allows data terminals (DTE's) and data communicating equipment (DCE) to exchange data in a packet-mode over a public or private packet switching network. The DTE/DCE interface connection, disconnection and transmission rules are defined in a packet switching protocol called X.25 recommendation which is developed and governed by the international telephone and telegraph consultative committee (CCITT). X.25 protocol is a bit oriented framing structure based on the high level data link control (HDLC). The CCITT recommendations for X.25 are divided into three levels, namely: The Physical Interface (Level 1); The Frame Level Logical Interface (Level 2); The Packet Level Logical Interface (Level 3). Level 1 Level 1- Specifies the use of four-wire, point-to-point synchronous circuit between the dte and the network (DCE). This circuit includes two modems or datasets (one connected to the DTE and the other connected to the network). Characteristics are: - 4-wire point-to-point or dial via a V.22 bis modem - Full duplex ; - Via RS232 convention. Level 2 - Defines the frame level link procedures used to synchronize transmission, initiate the "handshaking" necessary to establish the 'R-U-There'/Yes-I-Am sequence, flow control mechanism and perform error checking of data exchange across the DTE/DCE interface (link). the DTE is usually located at the customer premises and is called host while the DCE is located in the network. the procedures used to control the link are defined as commands and responses. Characteristics are: - HDLC; - Link access procedure balanced (LAPB) - X.25(80) or X.25(84). Level 3 - Defines the packet formats and control procedures required to establish a logical path (call request), exchange information (data packets) and for removing the logical path (clear request) between the DTE and DCR. Characteristics are: - Logical Channels (LCN`s) - Packet Size - Window Size - Throughput Class - Etc How It Works The customer's terminal (Host) is connected to a local modem which in turn, is connected to a second modem (Remote) in the central office via by 4 wires which in turn, is connected to a line processing module in the Datapac network. This configuration is called the DTE/DCE link and can be assigned speeds of 1200 bps through 19200 bps. This DTE/DCE link is assigned a unique Datapac network address (DNA) and other link parameters such as line speed, modem type, flow control and security by Telecom Canada. When the electrical signals are in the correct state as specified in level 1, the Datapac line processing module continuously transmits a CCITT command called SBMM (Set Asynchronous Balanced Node) to the customers's terminal (Host) every three seconds. If the host is ready, it responds to the sabm with a CCITT response UA (Unnumbered Acknowledgement). When this occurs, the link is initialized (level 2 ready), the host and Datapac module exchange restarts or restart/restart confirmation commands. When this occurs, the DTE/DCE link generates a transition to the next X.25 level, level 3. The DTE then signals the address it wishes to communicate with in a CCITT defined call request format (8 digits ), 10 digits if using 9th and 10th digit subaddressing on a logical channel (lcn) Datapac then routes the call request to the appropriate destination (national or international) and awaits a CCITT defined call accept packet. If this occurs, the accept packet is transmitted back to the originating host and both hosts may now exchange CCITT defined data packets. This is called a switched virtual call (SVC); permanent virtual calls (pvc's) are also offered. At the end of the session, either host can terminate the svc by transmitting a CCITT defined clear request packet. Up to 255 SVC's may be supported simultaneously. Dial access service is also offered at 2400 bps with a maximum of eight lcn's over the public telephone network Benefits Datapac 3000 provides customers with a cost effective service derived from packet switching technology and X.25 protocol. Some benefits are: Dedicated or Dial-in access - Simultaneous communication with many (up to 255) different locations - national and international; - Error free transmission; - System expansion flexibility; Communication Universality - Cost containment through reduced host port connections; - 24 hours 7 days-a-week service - Lower communication costs; - Call paramater selection to suit particular applications. Section B - Datapac 3101 Datapac 3101 is a network access service which enables teletypewriter compatible devices, such as time-sharing terminals, to access the Datapac network. Low speed, asynchronous devices are supported through an interactive terminal interface (ITI) in a packet assembler/disassembler (PAD), which allows the devices to access the network over dial-up (DDD) or dedicated access lines. ITI, the end-to-end protocol for datapac 3101 conforms to the ccitt recommendations X.3, X.28 and X.29 and supports access to the Datapac network for asynchronous, start-stop character mode terminals. X.3 specifies the operation of the pad. It contains the specifications for the twelve international parameters and their operation. Additional domestic parameters are also in place to meet canadian market requirements. X.28 specifies the command language between the teminal and the pad. It also specifies the conditions which define the command mode and the data transfer mode. X.29 specifies the procedures to be followed by an X.25 DTE to access and modify the parameters in the pad as well as the data transfer procedure. The user needs no special hardware or software to interface a terminal to the Datapac network. A knowledge of the ITI procedures is the only requirement at the terminal end. The Datapac 3101 service provides for terminal to host (user's computer) and terminal to terminal communication. The host access should conform with the X.25 protocol, using the Datapac 3000 access service, and also support the higher level protocol conventions of iti. host access may also be provided via the Datapac 3101 service for some applications. The Datapac 3101 service also provides block mode and tape support. Section C - Datapac 3201 Network access service which enables various terminals that are buffered, pollable and operate asynchronously to communicate with host computers through the Datapac network. Applications The Datapac 3201 service is typically used by the general merchandise and speciality sectors of the retail industry in Canada. It provides a cost effective communication solution whenever there is a requirement for sending small amounts of information to a host computer and obtaining a short response. The primary applications are on-line compilation of sales data to help in inventory control, and on-line credit verification to detect fraudulent credit cards. Other emerging applications involve trust companies, credit unions, banks and service stations. Access Arrangements Datapac 3201 provides support at the customers' terminal end (for example a retail store) by means of a packet assembler/disassembler (PAD) which is located in a Telecom Canada member company central office. The PAD polls the various devices for information in an on-line real time environment. Devices may communicate to the pad via two options: 1) Shared multipoint multidrop access at 1200 bps, or 2) Dedicated access at 1200, 2400 bps. Protocol support Communication between the PAD and the terminal conforms to the ansi (American National Standards Institute) X3.28-1976 ISO (International Standards Organization) poll/select asynchronous protocol. Telecom canada undertakes to test terminals which support this protocol, prior to connecting them to the Datapac 3201 network. Communication between the customers host computer location and the datapac network is accomplished by the use of a X.25 (datapac 3000) interface which supports the datapac 3201 host to PAD "Point-Of-Sale (POS) end to end protocol" specification. Communication Response Time - Data Collection: Average 1.7 to 2.3 seconds in the peak periods. - Inquiry-Response (Credit Check): Average 2.7 to 4.2 seconds in the peak periods. Message Size A typical retail Datapac 3201 application uses short input and output messages. (For example an average of 50 characters). One kilopacket (1,000 packets or 256,000 bytes) is equal to approximately 1,000 sales transactions or 500 credit authorizations. Average transaction volume would be less than 5000 packets per day. Optional Datapac Network Features: Closed User Group (CUG): Allows devices within one group to communicate only with accredited devices of the same group, resulting in a high degree of data security. Additional options are available to limit call attempts between closed user groups or within a closed user group. Reverse charge call: Allows a user to charge a call to the destination address Reverse charge call Reverse charged calls destined to a Datapac 3201 blocking: address will be blocked by the network. Section D - Datapac 3303 (BSC) Datapac 3303 (BSC) provides polled bsc communications protocol support for IBM 3270 information display systems or their emulators. Datapac 3303 (BSC) supports all the typical online inquiry response and data entry applications normally accessed with these 3270 terminal clusters. Datapac 3303 (BSC) is a pad based service. The 3270 controllers connect to the network via PAD's (Packet Assemblers/Fisassemblers). PAD's perform the host functions of communicating with the 3270 controllers in the binary synchronous communications polling protocol, and in doing so, eliminate cross-network polling. Datapac 3303 (BSC) connections are dedicated facilities (one per controller) at speeds of 2400, 4800, or 9600 bps. A virtual circuit is maintained for each terminal across the network and out to the host at the other end via a datapac 3000 line. Most datapac 3303 (BSC) connections dialogue with hosts that are running Telecom Canada's Datapac access software (DAS) in their IBM 3720, 3705, 3725 or Amdahl look-alikes front ends. DAS supports X.25 connecting. To the network via Datapac 3000. It also supports the end-to-end protocol transporting the 3270 data across the network. Datapac 3303 (BSC) - Features Aside from lower communications costs, the main reasons for using Datapac 3303 (BSC) are: - Ease of network reconfiguration, and - Dynamic multiple terminal functionality. Reconfiguration New online systems are economically feasible and equipment changes can be easily accommodated without disrupting service or affecting the network. functionality with Datapac 3303 (BSC) - Terminals are now much more versatile than ever before. - The capability exists to dynamically access multiple hosts and/or applications from the same destination (either manually, or via a user friendly mnemonic addressing scheme). This means terminals behind the same controller can access different destinations at the same time, saving equipment and communications facilities costs. - In conjunction with das (datapac access software) in the host's front end, that 3270 terminal can also act as an ascii asynchronous device and access such systems as Rnvoy 100 and iNet. - In addition, each terminal now has the ability to appear as either a bsc device to a non-SNA host or a