Hacker's Arsenal - The Cutting Edge of Hacking

home *** CD-ROM | disk | FTP | other *** search

/ Hacker's Arsenal - The Cutting Edge of Hacking / Hacker's Arsenal - The Cutting Edge of Hacking.iso / texts / misc / HackingGuide.txt < prev next >

Wrap

Text File | 2001-07-11 | 169.1 KB | 3,776 lines

------------------------------------------------------------------------------ %%%%%%%%%%%%%%%%%%%%%%%%%%%%-%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % % THE NEOPHYTE'S GUIDE TO HACKING % % =============================== % % 1993 Edition % % Completed on 08/28/93 % % Modification 1.1 Done on 10/10/93 % % Modification 1.2 Done on 10/23/93 % % by % %% >>>>> Deicide <<<<< %% %%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% < The author of this file grants permission to reproduce and > < redistribute this file in any way the reader sees fit, > < including the inclusion of this file in newsletters of any > < media, provided the file is kept whole and complete, > < without any modifications, deletions or ommissions. > < (c) 1993, Deicide > TABLE OF CONTENTS ================= 1. INTRODUCTION 2. ETHICS/SAFETY 3. WHERE TO START 4. PACKET-SWITCHED NETWORKS A. Intro to PSNs B. How packet-switching works C. The Internet 1. Introduction 2. Getting access 3. FTP D. X.25 Networks 1. NUAs 2. PADs & NUIs 3. CUGs 4. SprintNet 5. BT Tymnet 6. Datapac 7. DNIC List 5. SYSTEM PENETRATION A. Unix B. VMS C. MPE (HP3000 mainframes) D. VM/CMS E. Primos F. TOPS 10/20 G. IRIS H. NOS I. DECServer J. GS/1 K. XMUX L. Starmaster/PACX M. Access 2590 N. PICK O. AOS/VS P. RSTS Q. WindowsNT R. Novell Netware S. System75/85 T. AS400 U. TSO 6. BRUTE FORCE A. Passwords B. Usernames C. Services 7. SOCIAL ENGINEERING 8. TRASHING 9. ACRONYMS 10. CONCLUSION A. Last words B. Recommended Reading C. BBSes D. References E. And finally.. F. Disclaimer INTRODUCTION: ============ ------------ Over four years ago the final version of the LOD/H's Novice's Guide to Hacking was created and distributed, and during the years since it has served as a much needed source of knowledge for the many hackers just beginning to explore the wonders of system penetration and exploration. The guide was much needed by the throng of newbies who hadn't the slightest clue what a VAX was, but were eager to learn the arcane art of hacking. Many of today's greats and moderates alike relied the guide as a valuable reference during their tentative(or not) steps into the nets. However, time has taken it's toll on the silicon networks and the guide is now a tad out of date. The basic manufacturer defaults are now usually secured , and more operating systems have come on the scene to take a large chunk of the OS percentile. In over four years not one good attempt at a sequel has been made, for reasons unbeknownst to me. So, I decided to take it upon myself to create my own guide to hacking.. the "Neophyte's Guide to Hacking" (hey..no laughing!) in the hopes that it might help others in furthering their explorations of the nets. This guide is modelled after the original, mainly due to the fact that the original *was* good. New sections have been added, and old sections expanded upon. However, this is in no means just an update, it is an entirely new guide as you'll see by the difference in size. This guide turned out to be over 4 times the size of The Mentor's guide. Also, this guide is NOT an actual "sequel" to the original; it is not LOD/H sponsored or authorized or whatever, mainly because the LOD/H is now extinct. One last thing.. this guide is in no way complete. There are many OS's I did not include, the main reasons being their rarity or my non-expertise with them. All the major OS's are covered, but in future releases I wish to include Wang, MVS, CICS, SimVTAM, Qinter, IMS, VOS, and many more. If you feel you could help, contact me by Internet email or on a board or net(if you can find me). Same thing applies for further expansion of current topics and operating systems, please contact me. Ok, a rather long intro, but fuck it.. enjoy as you wish.. Deicide - deicide@west.darkside.com ETHICS/SAFETY: ============= ------------- One of the most integral parts of a hacker's mindset is his set of ethics. And ethics frequently go hand in hand with safety, which is obviously the most critical part of the process of hacking and the system exploration, if you plan to spend your life outside of the gaol. A hacker's ethics are generally somewhat different from that of an average joe. An average joe would be taught that it is bad to break laws, even though most do anyways. I am encouraging you to break laws, but in the quest for knowledge. In my mind, if hacking is done with the right intentions it is not all that criminal. The media likes to make us out to be psychotic sociopaths bent on causing armageddon with our PCs. Not likely. I could probably turn the tables on the fearmongering media by showing that the average joe who cheats on his taxes is harming the system more than a curious interloper, but I refrain.. let them wallow.. The one thing a hacker must never do is maliciously hack(also known as crash, trash, etc..) a system. Deleting and modifying files unnecessary is BAD. It serves no purpose but to send the sysadmins on a warhunt for your head , and to take away your account. Lame. Don't do it. Anyways, if you don't understand all of these, just do your best to follow them, and take my word for it. You'll understand the reasoning behind these guidelines later. I. Don't ever maliciously hack a system. Do not delete or modify files unnecessarily, or intentionally slow down or crash a system. The lone exception to this rule is the modification of system logs and audit trails to hide your tracks. II. Don't give your name or real phone number to ANYONE, it doesn't matter who they are. Some of the most famous phreaks have turned narcs because they've been busted, and they will turn you in if you give them a chance. It's been said that one out of every three hackers is a fed, and while this is an exaggeration, use this as a rule and you should do fine. Meet them on a loop, alliance, bbs, chat system, whatever, just don't give out your voice number. III. Stay away from government computers. You will find out very fast that attempting to hack a MilTac installation is next to impossible, and will get you arrested before you can say "oh shit". Big Brother has infinite resources to draw on, and has all the time it needs to hunt you down. They will spend literally years tracking you down. As tempting as it may be, don't rush into it, you'll regret it in the end. IV. Don't use codes from your own home, ever! Period. This is the most incredibly lame thing i've seen throughout my life in the 'underground'; incredible abuse of codes, which has been the downfall of so many people. Most PBX/950/800s have ANI, and using them will eventually get you busted, without question. And calling cards are an even worse idea. Codes are a form of pseudo-phreaking which have nothing to do with the exploration of the telephone networks, which is what phreaking is about. If you are too lazy to field phreak or be inventive, then forget about phreaking. V. Don't incriminate others, no matter how bad you hate them. Turning in people over a dispute is a terrible way to solve things; kick their ass, shut off their phones/power/water, whatever, just don't bust them. It will come back to you in the end.. VI. Watch what you post. Don't post accounts or codes over open nets as a rule. They will die within days, and you will lose your new treasure. And the posting of credit card numbers is indeed a criminal offense under a law passed in the Reagan years. VII. Don't card items. This is actually a worse idea than using codes, the chances of getting busted are very high. VIII. If for some reason you have to use codes, use your own, and nothing else. Never use a code you see on a board, because chances are it has been abused beyond belief and it is already being monitored. IX. Feel free to ask questions, but keep them within reason. People won't always be willing to hand out rare accounts, and if this is the case don't be surprised. Keep the questions technical as a rule. Try and learn as much as you can from pure hands on experience X. And finally, be somewhat paranoid. Use PGP to encrypt your files, keep your notes/printouts stored secretly, whatever you can do to prolong your stay in the h/p world. XI. If you get busted, don't tell the authorities ANYTHING. Refuse to speak to them without a lawyer present. XII. If police arrive at your residence to serve a search warrant, look it over carefully, it is your right. Know what they can and can't do, and if they can't do something, make sure they don't. XIII. If at all possible, try not to hack off your own phoneline. Splice your neighbour's line, call from a Fortress Fone, phreak off a junction box, whatever.. if you hack long enough, chances are one day you'll be traced or ANI'd. Don't believe you are entirely safe on packet-switched networks either, it takes a while but if you scan/hack off your local access point they will put a trace on it. XIV. Make the tracking of yourself as difficult as possible for others. Bounce the call off several outdials, or try to go through at least two different telco companies when making a call to a dialup. When on a packet-switched network or a local or wide area network, try and bounce the call off various pads or through other networks before you reach your destination. The more bounces, the more red tape for the investigator and the easier it is for you to make a clean getaway. Try not to stay on any system for *too* long, and alternate your calling times and dates. XV. Do not keep written notes! Keep all information on computer, encrypted with PGP or another military-standard encryption program. Written notes will only serve to incriminate you in a court of law. If you write something down originally, shred the paper.. itty bitty pieces is best, or even better, burn it! Feds DO trash, just like us, and throwing out your notes complete will land in their hands, and they'll use it against you. XVI. Finally, the day/night calling controversy. Some folks think it is a better idea to call during the day(or whenever the user would normally use his account) as to not arouse the sysadmin's suspicion of abnormal calling times, while others think it is better to call when nobody is around. This is a tough one, as there is no real answer. If the sysadmin keeps logs(and reads over them) he will definetly think it strange that a secretary calls in at 3 am.. he will probably then look closer and find it even stranger that the secretary then grabbed the password file and proceeded to set him/herself up with a root shell. On the other hand, if you call during the time the user would normally call, the real owner of the account may very well log in to see his name already there, or even worse be denied access because his account is already in use. In the end, it is down to your opinion. And remember, when you make a decision stick to it; remember the time zone changes. WHERE TO START ============== -------------- Probably the hardest period in hacking is that of when you are first starting. Finding and penetrating your first system is a major step, and can be approached in many ways. The common ways to find a system to hack are; - UNIVERSITIES : Universities commonly have hundreds of users, many of which aren't too computer literate, which makes hacking a relatively simple chore. And security is often poor, so if you don't abuse the system too much your stay could be a long one. On the other hand, for a nominal fee you can usually pick up a cheap *legitimate* (now there's a concept) account. Or you could enroll in the university for a few credits, and just go until the accounts are handed out. Unfortunely, if you are caught hacking off your own account it won't be hard to trace it back to you. If you get a legimate account at first, you might be best to hack a student's account for your other-system hacking. The other fun part about universities is often they will provide access to a number of nets, usually including the Internet. Occasionally you'll have access to a PSN as well. - CARRIER SCANNING: Carrier scanning in your LATA(Local Access Transport Area), commonly known as wardialing, was popularized in the movie War Games. Unfortunely, there are a few problems inherent in finding systems this way; you are limited to the systems in your area, so if you have a small town you may find very little of interest, and secondly, ANI is a problem within your own LATA, and tracing is simple, making security risks high. If you are going to hack a system within your own lata, bounce it at least once. There are many programs, such as ToneLoc and CodeThief (ToneLoc being superior to all in my humble opinion), which will automate this process. - PACKET-SWITCHED : This is my favorite by far, as hacking on PSNs is how NETWORKS I learned nearly all I know. I've explored PSNs world-wide, and never ran out of systems to hack. No matter what PSN you try you will find many different, hackable systems. I will go more indepth on PSNs in the next section. PACKET-SWITCHED NETWORKS ======================== ------------------------ Intro to PSNs ============= First off, PSNs are also known as PSDNs, PSDCNs, PSSs and VANs to name a few. Look up the acronyms in the handy acronym reference chart<g>. The X.25 PSNs you will hear about the most are; Sprintnet(formerly Telenet), BT Tymnet(the largest), and Datapac(Canada's largest). All these networks have advantages and disadvantages, but i'll say this; if you are in the United States, start with Sprintnet. If you are in Canada, Datapac is for you. The reason PSNs are so popular for hackers are many. There are literally thousands of systems on PSNs all around the world, all of which(if you have the right facilities) are free of charge for you to reach. And because of the immense size of public PSNs, it is a rare thing to ever get caught for scanning. Tracing is also a complicated matter, especially with a small amount of effort on your part to avoid a trace. How packet-switching works ========================== The following explanation applies for the most part to all forms of packet-switching, but is specifically about PSNs operating on the X series of protocols, such as Datapac & SprintNet, as opposed to the Internet which operates on TCP/IP. It is the same principle in essense, however. Packet-Switched Networks are kinda complicated, but I'll attempt to simplify the technology enough to make it easy to understand. You, the user, connect to the local public access port for your PSN, reachable via a phone dialup. You match communications parameters with the network host and you are ready to go. From there, all the data you send across the network is first bundled into packets, usually of 128 or 256 bytes. These packets are assembled using Packet Assembly/Disassembly, performed by the public access port, also known as a public PAD(Packet Assembler/Disassembler), or a DCE(Data Communicating Equipment or Data Circuit-Terminating Equipment). The packets are sent along the network to their destination by means of the various X protocols, standardly X.25 with help from X.28, X.29 & X.3 within your home network, and internationally using X.75/X.121. The X protocol series are the accepted CCITT standards. The host system(DTE: Data Terminal Equipment, also a PAD) which you are calling then receives the packet and disassembles the packet using Packet Assembly/Disassembly once again into data the system understands. The DTE then assembles it's data in response to your packet, and sends it back over the network to your PAD in packet form, which disassembles the packet into readable data for you, the user. And that is the simplified version! The Internet ============ Introduction ------------ Contrary to popular belief, the Internet is a packet-switched network; just not an X.25 packet-switched network. The Internet operates on the TCP/IP protocols(as a rule), which is why it is sometimes disregarded as a packet-switched network. In fact, the Internet's predecessor, the ARPAnet, was the first large-scale experiment in packet-switching technology. What was then Telenet came later. The confusion comes from peoples ignorance of the principles of packet-switching, which is simply a type of network, explained in technical detail earlier. It doesn't matter what protocols the network may use, if packet-switching is in use it is obviously a packet-switched network. Ok, now you may have noticed that the Internet has a rather small section, which is true. The reasons are many. This is a hacking guide, not an Internet tutorial, so I didn't include the IRC or Archie or whatever. And the main reason is I spent about 100% more time on X.25 nets than I did the Internet. Nonetheless, I decided to include the essential aspects of the Internet. You should be able to take it from there. The following section is derived mostly from personal experience, but the Gatsby's Internet file helped out somewhat, specifically in the classes of IP addresses. Getting Access -------------- Getting access is somewhere between easy and very difficult, depending where you live and how good(or lucky!) a hacker you are. First of all, if you are going to hack on the Internet then you must be on a system that has full Internet access, not just mail. That cuts Compuserve and Prodigy out of the picture. Most universities and some high schools have Internet access, see what you can do to get yourself an account, legitimatly or not. Some BBSes offer full Internet access for a fairly reasonable price, and that would be a good choice. If you are in an area with a FreeNet, then you get full Internet access.. for free! Check around with local hackers or PD boards to inquire where the nearest FreeNet is. Some businesses provide Internet access, for a price. Check with local netters to see what local options there are. And lastly, you can try and hack your way on. When you hack a system, check and see if they are on the net. Usually this is accomplished by doing a test call using telnet.. explained later. FTP --- FTP is the acronym for File Transfer Protocol, and it is the primary means of transporting remote files onto your own system(actually, usually the system which you are calling the Internet through). I will only provide a brief overview, as FTP is fairly easy to use, has help files online and comprehensive documentation offline at your local h/p BBS. First off, FTP can be initialized by typing 'ftp' at any system which has it. Most do, even if they don't have the Internet online. That a frustrating lesson more than a few novices has learned.. if you hack into a system that has FTP or telnet on line, it does not necessarily(and usually doesn't) have Internet access. Some SunOS's will have two sets of ftp and telnet utilities. The standard ftp and telnet commands can be used for local network connects, but not Internet. Another set of commands, itelnet, iftp and ifinger (and occasionally iwhois) is used for the Internet. When you enter the FTP utility, you'll usually find yourself at a 'ftp>' prompt, and typing 'help' should bring up a small set of help files. The commands available, along with the help files, vary from system to system. Procedure is then defined by what type of system you are on, as again, it varies. But what you usually do next is open a connection to the system you want to get a file off of. Type 'open' followed by the host name or IP address of the system you wish to connect to.. explained later. Next, you will usually find yourself at a sort of login prompt. If you have a username on that system, then type it in. If not, try 'anonymous'. Anonymous is a great little guest account that is now being built in to some OS's. Conscientious sysadmins may disable it, for obvious reasons. If however, it is not, you will be asked for a password. Type anything, it doesn't matter really. Type a few d's if you want, it really doesn't matter(as a rule don't sit on your keyboard though.. it may not like it.. type something boring). Next you simply use the 'get' command to get the file you want. Usually it is a good idea to not put the files in a directory that they will be noticed.. the sysadmin will suspect something is up if he runs into a few files that he supposedly copied into his own directory. Which brings us to the next segment.. give your files benign names, especially if they are something like /etc/passwd files or issues of Phrack. A note about FTPing /etc/passwds. It rarely works. Oh yes, you will get an /etc/passwd file, but rarely on the Internet will it be the real /etc/passwd. Check the size of the file first.. if it is 300 bytes or less, then it will likely be a substitute. Telnet will, however, get the real /etc/passwd on most occasions. Now quit the FTP utility and peruse your new files.. be sure to remove them when done. Telnet ------ While FTP has no real parallel in X.25 networks, you could equate telnet to a private PAD. Telnet lets you connect to and operate on Internet systems over the Internet as if you were connected locally. Telnet is initialized by typing 'telnet' at your shell. The operative command is, again, 'open'. Again, type 'open' followed by the domain name or the IP address. When connected, you will be at a login prompt of some kind(usually..). Enter a username if you have one, and if not you can either attempt to hack one or see if the system accepts the 'anonymous' guest user, explained in the FTP section. If all goes well, you should have a remote connection of some kind, and what follows depends on the system you are connected to, just like in any other network. Domain Names and IP Addresses - Intro ------------------------------------- For those of you unfamiliar with those terms I will give a small, condensed explanation of what the two are. One or the other is needed for connecting to a remote system, either by FTP or Telnet. The IP address could be equated to the X.25 net's Network User Address. The Domain name is a mnemonic name, used for convience more than anything, as it is generally easier to remember. If you wish to scan for systems on the Internet it is usually much easier to scan by IP address, as you won't know the mnemonic for most systems. IP addresses are 4 digit-combinations separated by dots. Address examples are 192.88.144.3(EFF) and 18.72.2.1(MIT). Addresses fall into three classes; Class A - 0 to 127 Class B - 128 to 191 Class C - 192 to 223 The earliest Internet systems are all in Class A, but it is more common to find class B or C systems. Moreover, a lot of systems are placed specifically in the 128 or 192 address prefix, as opposed to 184 or 201 or whatever. Scanning an IP address set can be accomplished in many fashions. One of which would be to pick a prefix, add two random one to two digit numbers, and scan the last portion. ie: take 192.15.43 and scan the last digit from 0 to 255. Unfortunely, the last portion (or last two portions in the case of Class C) are ports, meaning you may come up completely blank or you might hit the jack pot. Experiment to your own liking, after a while you will fall into a comfortable groove. You can also connect to specific systems using the domain name, if you know or can guess the domain name. To guess a domain name you will need to know the company or organization's name, and the type of organization it is. This is possible because host names must follow the Domain Name System, which makes guessing a lot easier. Once you have both, you can usually take a few educated guesses at the domain name. Some are easier than others. First of all, you will need to understand the principle of top-level domains. The top level is at the end of a domain name; in the case of eff.org, the top-level is 'org'. In the case of mit.edu, the top-level is 'edu'. Top levels fall into a few categories; com - commercial institutions org - non-profit organizations edu - educational facilities net - networks gov - government systems (non military) mil - non-classified military Along with various country codes. The country codes are two letters used for international calls; the US's is 'US', Brazil's is 'BR'. Determine which top-level the system falls under, and then make a few guesses. Examples are; compuserve.com xerox.com mit.edu eff.org For further reading, I suggest picking up a few of the printed Internet guides currently on the market, as well as the Gatsby's file on the Internet, printed in Phrack 33. X.25 Networks ============= From here on in the PSN section of this file is dedicated to X.25 networks. I use the acronym PSN interchangably with X.25 networks, so don't get PSN confused with all the other types of PSN networks. From here on in, it is all X.25. Network User Addresses ---------------------- NUAs(Network User Addresses) are the PSNs equivalent of a phone number. They are what you need to connect to systems on PSNs around the world, and thanks to the DNIC(Data Network Identifier Code), there are no two the same. The format for entering NUAs is different from PSN to PSN. For example, on Datapac you must include 0's, but on Sprintnet 0's are not necessary. Tymnet uses 6 digits NUAs rather than the standard 8. But the standard NUA format is this; PDDDDXXXXXXXXSS,MMMMMMMMMM Where; P is the pre-DNIC digit D is the DNIC X is the NUA S is the LCN(Logical Channel Number, subaddressing) M is the Mnemonic Various segments may be omitted depending on your PSN and where you are calling. The P is commonly a 0, but is a 1 on Datapac. It is not usually even counted as part of the NUA, but must be included(usage varying) when making calls to another PSN other than your own. Within your own PSN it is not necessary to include the pre DNIC digit. The D is the DNIC also known as the DCC(Data Country Code). The DNIC is the 4 digit country code, which insures that each NUA worldwide is unique. The DNIC is only used in calling international NUAs. If you are in Datapac(DNIC 3020) you do not have to include the DNIC for Datapac when making calls to NUAs within Datapac, but if you are in another PSN you must include the DNIC for calls to Datapac. The X symbolizes the actual NUA, which along with the optional S (subaddressing) must always be included. You can simplify the NUA even greater using this format; PPPXXXXX Where P is the prefix of the NUA, and the X's are the suffix. The prefix corresponds to an Area Code in most cases in that the NUAs within that prefix are in a certain part of the country the PSN serves. In the case of Sprintnet, the prefix corresponds directly with the Area Code(ie: all NUAs in the 914 prefix on Sprintnet are in New York, and all phone numbers in the 914 Area Code are in New York). Subaddressing, S on the diagram, is a somewhat complicated thing to explain. Subaddressing is used when desired by the owner of the DTE, and is used to connect to specified system on the same NUA. You may find more than one system on the same NUA, and these can be reached using subaddresses. ie: NUA SYSTEM PPPXXXXXSS ========== =================== Ex.1 12300456 Unix Ex.2 123004561 VMS Ex.3 1230045699 HP3000 In this example, the normal NUA is 12300456(assuming DNIC and pre-DNIC digit are not used). This NUA takes you to a Unix system. But when the LCN(Logical Channel Number, subaddress) of 1 is used, you are taken to a VMS. And the subaddress of 99 takes you to a HP3000. The systems on 12300456 are all owned by the same person/company, who wished to have one NUA only, but by using subaddresses he can give access to multiple systems on a lone NUA. Subaddresses are also used occasionally as extra security. If you hit a system that gives you an error message such as 'REMOTE PROCEDURE ERROR' or 'REMOTE DIRECTIVE', you will either need a subaddress or a mnemonic. You may choose to go through the entire possible subaddresses, 1 to 99, or if you are just scanning i would suggest these: 1,2,50,51,91,98,99 Mnemonics, M, are another tricky one to explain. They are not documented by the PSNs, I discovered them on my own. Mnemonics are also used to select systems on a single NUA as a kind of port selector, but they are more commonly used as a kind of external password, which prevents you from even seeing the system in question. The same error messages as in LCNs occur for mnemonics, but again, even if you can reach a system with a standard NUA, there is a possibly a system only reachable by mnemonic exists. Here is a list of commonly used mnemonics; SYSTEM CONSOLE PAD DIAL MODEM X25 X28 X29 SYS HOST Bypassing Reverse Charging Systems: Private PADs and NUIs --------------------------------------------------------- Occasionally on PSNs you will run into systems which give you the error message 'COLLECT CALL REFUSED'. This denotes a reverse-charging system. When you make a call to a system on a PSN, the call is automatically collect. But a lot of sysadmins do not want to pay for your connect charges, and if all of their users have NUIs or private PADs, it is a good idea for them to make their system reverse-charging, which saves them money, but also acts as yet another security barrier from casual snoopers. But again, this can be avoided by using a private PAD or a NUI. Before we go into the details of these, remember that a private PAD is a different thing than your public access port PAD. A private PAD is a PAD which automatically assumes all connect charges. So, the reverse charging systems will let you past the reverse charging, as you agree to accept the charges. NUI's(Network User Identifiers) work the same way. You can think of a NUI as .. say a Calling Card. The Calling Card is billed for all the charges made on it, regardless of who made them; the owner gets the bill. The NUI works the same way. NUIs are used legitimatly by users willing to accept the connect charges. But, as hackers are known to do, these NUIs get stolen and used to call all NUAs all around the world, and the legitimate owner gets the bill. But unlike CCs, you will usually get away with using a NUI. However, as you can guess, private PADs and NUIs are fairly hard to come by. If somebody manages to get ahold of one, they usually won't be willing to share it. So, it comes down to you; you probably will have to find your own. PADs are only found by scanning on PSNs, and by hacking onto systems on PSNs. There are programs on Unix and Primos systems,for example, that serve as a private PAD. And there are some private PADs that are set up solely for the purpose of being a private PAD. But, these are almost always passworded, so it is up to you to get in. NUIs are somewhat the same thing. NUIs are different from PSN to PSN, some will tell you if a NUI is wrong, letting you guess one, but others will not. And of course, you still have to guess the password. I've heard stories of people carding NUIs, but i'm not sure i quite believe it, and the safety of such a practice is questionable. Closed User Groups ------------------ One of the most effective security measures i've ever seen is the CUG (Closed User Group). The CUG is what generates the 'CALL BLOCKED' message when scanning on PSNs. A CUG will only accept calls into the DTE from specified DCE NUAs. Meaning, if your NUA has not been entered into the list of acceptable NUAs, you won't be allowed to even see the system. However, CUGs aren't for everybody. If you have a system with many users that all call in from different points, CUGs are unusable. And a good thing for us. I've never heard of anyone finding a way past a CUG. I've got a few theories but.. Sprintnet --------- Now i'll go a bit more into the major US and Canadian PSNs, starting with the most popular in the States, Sprintnet To find a public indial port for Sprintnet you may possibly be able to find it in your telefone book(look under Sprintnet) or by Directory Assistance. If not, try Sprintnet Customer Service at 1-800-336-0437. This also will probably only function between 8:30 and 5:00 EST, maybe a bit different. Also, for a data number for in-dial look ups try 1-800-424-9494 at communication parameters 7/E/1(or 8/N/1 also i believe). Type <CR> twice or @D for 2400bps and press enter so Sprintnet can match your communications parameters. It will display a short herald then a TERMINAL= prompt. At the TERMINAL= prompt type VT100 for VT100 terminal emulation, if you are using a personal computer i think D1 works, or just <CR> for dumb terminal. Then type "c mail", at the username prompt type "phones", and for password type "phones" again. It is menu driven from there on. Now that you have your Sprintnet public dial port number, call it up like you would a BBS, then when it connnects type the two <CR>s for 300/1200bps or the @D for 2400bps, then it will display its herald, something like: SPRINTNET(or in some cases TELENET) 123 11A (where 123 is your area code & Sprintnet's address prefix and 11A is the port you are using) TERMINAL=(type what you did previously eg:VT100,D1,<ENTER>) then when Sprintnet displays the @ prompt you know you are connected to a Sprintnet public PAD and you are ready to enter NUAs. As i mentioned before, Sprintnet NUA prefixes correspond directly with Area Codes, so to scan Sprintnet simply take an AC and suffix it with the remaining digits, usually in sequence. Since Sprintnet ignores 0's, NUAs can be as small as 4 digits. When scanning, go from lowest to highest, stopping as soon as it seems NUAs have run dry(take it a hundred NUAs further to be sure..best to take it right to 2000, maybe higher if you have time). BT Tymnet --------- BT Tymnet is owned by British Telecom, and is the biggest PSN by far, but it does have some extra security. For finding Tymnet dial-ins the procedure is much the same, look in the phone book under Tymnet or BT Tymnet, or phone directory assistance and ask for BT Tymnet Public Dial Port numbers, or you can call Tymnet customer Service at 1-800-336-0149. Generally try between 8:30 and 5:00 EST. I don't have the Tymnet data number for finding in-dials, but once you are on Tymnet type INFORMATION for a complete list of in-dials as well as other things. Once you have your in-dial number set your communication parameters at either 8/N/1 or 7/E/1 then dial the number just like you would a BBS. At connect you will see a string of garbage characters or nothing at all. Press <CR> so Tymnet can match your communication parameters. You will then see the Tymnet herald which will look something like this: -2373-001- please type your terminal identifier If it wants a terminal identifier press A(if you want, you can press A instead of <CR> at connect so it can match your communication parameters and get your terminal identifer all at once). After this initial part you will see the prompt: please log in: This shows Tymnet is ready for you to enter NUAs. A great deal of the NUAs on Tymnet are in plain mnemonic format however. To reach these, just enter the mnemonic you wish, nothing else(ie: CPU or SYSTEM). To enter digital NUAs you need a NUI though. Tymnet will let you know when a NUI is wrong. Just keep guessing NUIs and passwords until you find one. BUT, keep in mind, one of the biggest security features Tymnet has is this: it will kick you off after three incorrect attempts at anything. Thus, you'll have to call again and again, and if you are in a digital switching system such as ESS it is not a good idea to call anywhere an excessive amount of time. So keep it in moderation if you choose to try Tymnet. Datapac ------- I am the most fond of Datapac, because I grew up on it. Nearly all the hacking i've done to this day was on Datapac or the international PSNs i've been able to reach through private PADs i've found on Datapac. To connect to the Datapac network from Canada you will need to dial into your local Datapac node, which is accessible in most cities via your local Datapac dial-in number. There are quite a few ways to find your local Datapac dial-in. It will usually be in your telephone book under "DATAPAC PUBLIC DIAL PORT". If not, you could try directory assistance for the same name. Alternatively, there are a couple phone #'s for finding your dial port(these are also customer assistance): 1-800-267-6574 (Within Canada) 1-613-781-6798 Also, these numbers function only from 8:30 to 5:00 EST(Eastern Standard Time).Also, the Datapac Information Service(DIS) at NUA 92100086 has a complete list of all public dial-ins. I think you can use both communication parameter settings work, but 8/N/1 (8 data bits, No parity, 1 stop bit) is used most frequently, so set it initially at that. Some NUA's on Datapac use 7/E/1, change to it if needed after you are connected to a Datapac dial-in. Ok,if you have your Datapac 3000 Public Indial number, you've set your communication parameters at 8/N/1, then you are now set to go. Dial your indial just like a BBS(duh..) and once connnected: You will have a blank screen; Type 3 periods and press RETURN (this is to tell Dpac to initialize itself) The Datapac herald will flash up stating: DATAPAC : XXXX XXXX (your in-dial's NUA) You are now ready to enter commands to Datapac. Example: (YOU ENTER) atdt 16046627732 (YOU ENTER) ... (DATAPAC RESPONDS) DATAPAC : 6710 1071 Now you are all set to enter the NUA for your destination. NUAs on Datapac must be 8 to 10 digits(not including mnemonics). 8 is standard, but 9 or 10 is possible depending on usage of subaddressing. NUA prefixes on Datapac are handed out in blocks, meaning they do not correspond to Area Codes, but by looking at the surrounding prefixes, you can tell where a prefix is located. When scanning on Datapac, keep in mind most of the valid NUAs are found in the low numbers, so to sample a prefix go from (example) 12300001 to 12300200. It is a good idea, however, to scan the prefix right up until 2000, the choice is yours. DNIC List --------- Here is a list of the previous PSN's DNICs, and most of the other DNICs for PSNs world wide. This was taken from the DIS, with a number of my own additions that were omitted(the DIS did not include other Canadian or American PSNs). The extras DNICs came from my own experience and various BBS lists. COUNTRY NETWORK DNIC DIRECTION ------- ------- ---- --------- ANDORRA ANDORPAC 2945 BI-DIR ANTIGUA AGANET 3443 INCOMING ARGENTINA ARPAC 7220 BI-DIR ARPAC 7222 BI-DIR AUSTRIA DATEX-P 2322 BI-DIR DATEX-P TTX 2323 BI-DIR RA 2329 BI-DIR AUSTRALIA AUSTPAC 5052 BI-DIR OTC DATA ACCESS 5053 BI-DIR AZORES TELEPAC 2680 BI-DIR BAHAMAS BATELCO 3640 BI-DIR BAHRAIN BAHNET 4263 BI-DIR BARBADOS IDAS 3423 BI-DIR BELGIUM DCS 2062 BI-DIR DCS 2068 BI-DIR DCS 2069 BI-DIR BELIZE BTLDATAPAC 7020 BI-DIR BERMUDA BERMUDANET 3503 BI-DIR BRAZIL INTERDATA 7240 BI-DIR RENPAC 7241 BI-DIR RENPAC 7248 INCOMING RENPAC 7249 INCOMING BULGARIA BULPAC 2841 BI-DIR BURKINA FASO BURKIPAC 6132 BI-DIR CAMEROON CAMPAC 6242 BI-DIR CANADA DATAPAC 3020 BI-DIR GLOBEDAT 3025 BI-DIR CNCP PACKET NET 3028 BI-DIR CNCP INFO SWITCH 3029 BI-DIR CAYMAN ISLANDS IDAS 3463 BI-DIR CHAD CHADPAC 6222 BI-DIR CHILE ENTEL 7302 BI-DIR CHILE-PAC 7303 INCOMING VTRNET 7305 BI-DIR ENTEL 7300 INCOMING CHINA PTELCOM 4600 BI-DIR COLOMBIA COLDAPAQ 7322 BI-DIR COSTA RICA RACSAPAC 7120 BI-DIR RACSAPAC 7122 BI-DIR RACSAPAC 7128 BI-DIR RACSAPAC 7129 BI-DIR CUBA CUBA 2329 BI-DIR CURACAO DATANET-1 3621 BI-DIR CYPRUS CYTAPAC 2802 BI-DIR CYTAPAC 2807 BI-DIR CYTAPAC 2808 BI-DIR CYTAPAC 2809 BI-DIR DENMARK DATAPAK 2382 BI-DIR DATAPAK 2383 BI-DIR DJIBOUTI STIPAC 6382 BI-DIR DOMINICAN REP. UDTS-I 3701 INCOMING EGYPT ARENTO 6020 BI-DIR ESTONIA ESTPAC 2506 BI-DIR FIJI FIJIPAC 5420 BI-DIR FINLAND DATAPAK 2441 BI-DIR DATAPAK 2442 BI-DIR DIGIPAK 2443 BI-DIR FRANCE TRANSPAC 2080 BI-DIR NTI 2081 BI-DIR TRANSPAC 2089 BI-DIR TRANSPAC 9330 INCOMING TRANSPAC 9331 INCOMING TRANSPAC 9332 INCOMING TRANSPAC 9333 INCOMING TRANSPAC 9334 INCOMING TRANSPAC 9335 INCOMING TRANSPAC 9336 INCOMING TRANSPAC 9337 INCOMING TRANSPAC 9338 INCOMING TRANSPAC 9339 INCOMING FR ANTILLIES TRANSPAC 2080 BI-DIR FR GUIANA TRANSPAC 2080 BI-DIR FR POLYNESIA TOMPAC 5470 BI-DIR GABON GABONPAC 6282 BI-DIR GERMANY F.R. DATEX-P 2624 BI-DIR DATEX-C 2627 BI-DIR GREECE HELPAK 2022 BI-DIR HELLASPAC 2023 BI-DIR GREENLAND KANUPAX 2901 BI-DIR GUAM LSDS-RCA 5350 BI-DIR PACNET 5351 BI-DIR GUATEMALA GUATEL 7040 INCOMING GUATEL 7043 INCOMING HONDURAS HONDUTEL 7080 INCOMING HONDUTEL 7082 BI-DIR HONDUTEL 7089 BI-DIR HONG KONG INTELPAK 4542 BI-DIR DATAPAK 4545 BI-DIR INET HK 4546 BI-DIR HUNGARY DATEX-P 2160 BI-DIR DATEX-P 2161 BI-DIR ICELAND ICEPAK 2740 BI-DIR INDIA GPSS 4042 BI-DIR RABMN 4041 BI-DIR I-NET 4043 BI-DIR INDONESIA SKDP 5101 BI-DIR IRELAND EIRPAC 2721 BI-DIR EIRPAC 2724 BI-DIR ISRAEL ISRANET 4251 BI-DIR ITALY DARDO 2222 BI-DIR ITAPAC 2227 BI-DIR IVORY COAST SYTRANPAC 6122 BI-DIR JAMAICA JAMINTEL 3380 INCOMING JAPAN GLOBALNET 4400 BI-DIR DDX 4401 BI-DIR NIS-NET 4406 BI-DIR VENUS-P 4408 BI-DIR VENUS-P 9955 INCOMIMG VENUS-C 4409 BI-DIR NI+CI 4410 BI-DIR KENYA KENPAC 6390 BI-DIR KOREA REP HINET-P 4500 BI-DIR DACOM-NET 4501 BI-DIR DNS 4503 BI-DIR KUWAIT BAHNET 4263 BI-DIR LEBANON SODETEL 4155 BI-DIR LIECHTENSTEIN TELEPAC 2284 BI-DIR TELEPAC 2289 BI-DIR LUXEMBOURG LUXPAC 2704 BI-DIR LUXPAC 2709 BI-DIR MACAU MACAUPAC 4550 BI-DIR MADAGASCAR INFOPAC 6460 BI-DIR MADEIRA TELEPAC 2680 BI-DIR MALAYSIA MAYPAC 5021 BI-DIR MAURITIUS MAURIDATA 6170 BI-DIR MEXICO TELEPAC 3340 BI-DIR MOROCCO MOROCCO 6040 BI-DIR MOZAMBIQUE COMPAC 6435 BI-DIR NETHERLANDS DATANET-1 2040 BI-DIR DATANET-1 2041 BI-DIR DABAS 2044 BI-DIR DATANET-1 2049 BI-DIR N. MARIANAS PACNET 5351 BI-DIR NEW CALEDONIA TOMPAC 5460 BI-DIR NEW ZEALAND PACNET 5301 BI-DIR NIGER NIGERPAC 6142 BI-DIR NORWAY DATAPAC TTX 2421 BI-DIR DATAPAK 2422 BI-DIR DATAPAC 2423 BI-DIR PAKISTAN PSDS 4100 BI-DIR PANAMA INTELPAQ 7141 BI-DIR INTELPAQ 7142 BI-DIR PAPUA-NEW GUINEA PANGPAC 5053 BI-DIR PARAGUAY ANTELPAC 7447 BI-DIR PERU DICOTEL 7160 BI-DIR PHILIPPINES CAPWIRE 5150 INCOMING CAPWIRE 5151 BI-DIR PGC 5152 BI-DIR GLOBENET 5154 BI-DIR ETPI 5156 BI-DIR POLAND POLAK 2601 BI-DIR PORTUGAL TELEPAC 2680 BI-DIR SABD 2682 BI-DIR PUERTO RICO UDTS 3300 BI-DIR UDTS 3301 BI-DIR QATAR DOHPAC 4271 BI-DIR REUNION (FR) TRANSPAC 2080 BI-DIR RWANDA RWANDA 6352 BI-DIR SAN MARINO X-NET 2922 BI-DIR SAUDI ARABIA ALWASEED 4201 BI-DIR SENEGAL SENPAC 6081 BI-DIR SEYCHELLES INFOLINK 6331 BI-DIR SINGAPORE TELEPAC 5252 BI-DIR TELEPAC 5258 BI-DIR SOLOMON ISLANDS DATANET 5400 BI-DIR SOUTH AFRICA SAPONET 6550 BI-DIR SAPONET 6551 BI-DIR SAPONET 6559 BI-DIR SPAIN TIDA 2141 BI-DIR IBERPAC 2145 BI-DIR SRI-LANKA DATANET 4132 BI-DIR SWEDEN DATAPAK TTX 2401 BI-DIR DATAPAK-2 2403 BI-DIR DATAPAK-2 2407 BI-DIR SWITZERLAND TELEPAC 2284 BI-DIR TELEPAC 2285 BI-DIR TELEPAC 2289 BI-DIR TAIWAN PACNET 4872 BI-DIR PACNET 4873 BI-DIR UDAS 4877 BI-DIR TCHECOSLOVAKA DATEX-P 2301 BI-DIR THAILAND THAIPAC 5200 BI-DIR IDAR 5201 BI-DIR TONGA DATAPAK 5390 BI-DIR TOGOLESE REP. TOGOPAC 6152 BI-DIR TORTOLA IDAS 3483 INCOMING TRINIDAD DATANETT 3745 BI-DIR TEXTET 3740 BI-DIR TUNISIA RED25 6050 BI-DIR TURKEY TURPAC 2862 BI-DIR TURPAC 2863 BI-DIR TURKS&CAICOS IDAS 3763 INCOMING U ARAB EMIRATES EMDAN 4241 BI-DIR EMDAN 4243 BI-DIR TEDAS 4310 INCOMING URUGUAY URUPAC 7482 BI-DIR URUPAC 7489 BI-DIR USSR IASNET 2502 BI-DIR U.S.A. WESTERN UNION 3101 BI-DIR MCI 3102 BI-DIR ITT/UDTS 3103 BI-DIR WUI 3104 BI-DIR BT-TYMNET 3106 BI-DIR SPRINTNET 3110 BI-DIR RCA 3113 BI-DIR WESTERN UNION 3114 BI-DIR DATAPAK 3119 BI-DIR PSTS 3124 BI-DIR UNINET 3125 BI-DIR ADP AUTONET 3126 BI-DIR COMPUSERVE 3132 BI-DIR AT&T ACCUNET 3134 BI-DIR FEDEX 3138 BI-DIR NET EXPRESS 3139 BI-DIR SNET 3140 BI-DIR BELL SOUTH 3142 BI-DIR BELL SOUTH 3143 BI-DIR NYNEX 3144 BI-DIR PACIFIC BELL 3145 BI-DIR SWEST BELL 3146 BI-DIR U.S. WEST 3147 BI-DIR CENTEL 3148 BI-DIR FEDEX 3150 BI-DIR U.S. VIRGIN I UDTS 3320 BI-DIR U. KINGDOM IPSS-BTI 2341 BI-DIR PSS-BT 2342 BI-DIR GNS-BT 2343 BI-DIR MERCURY 2350 BI-DIR MERCURY 2351 BI-DIR HULL 2352 BI-DIR VANUATU VIAPAC 5410 BI-DIR VENEZUELA VENEXPAQ 7342 BI-DIR YUGOSLAVIA YUGOPAC 2201 BI-DIR ZIMBABWE ZIMNET 6484 BI-DIR SYSTEM PENETRATION ================== ------------------ Ok, now that you've hopefully found some systems, you are going to need to know how to identify and, with any luck, get in these newfound delights. What follows is a list of as many common systems as i could find. The accounts listed along with it are not, per say, 'defaults'. There are very few actual defaults. These are 'common accounts', in that it is likely that many of these will be present. So, try them all, you might get lucky. The list of common accounts will never be complete, but mine is fairly close. I've hacked into an incredible amount of systems, and because of this I've been able to gather a fairly extensive list of common accounts. Where I left the password space blank, just try the username(and anything else you want), as there are no common passwords other than the username itself. And also, in the password space I never included the username as a password, as it is a given in every case that you will try it. And remember, passwords given are just guidelines, try what you want. UNIX- Unix is one of the most widespread Operating Systems in the world; if you scan a PSN, chances are you'll find a number of Unixes, doesn't matter where in the world the PSN resides. The default login prompt for a unix system is 'login', and while that cannot be changed, additional characters might be added to preface 'login', such as 'rsflogin:'. Hit <CR> a few times and it should disappear. Because UNIX is a non-proprietary software, there are many variants of it, such as Xenix, SCO, SunOS, BSD, etc.., but the OS stays pretty much the same. As a rule, usernames are in lowercase only, as are passwords, but Unix is case sensitive so you might want to experiment if you aren't getting any luck. You are generally allowed 4 attempts at a login/password, but this can be increased or decreased at the sysadmins whim. Unfortunely, UNIX does not let you know when the username you have entered is incorrect. UNIX informs the user of when the last bad login attempt was made, but nothing more. However, the sysadmin can keep logs and audit trails if he so wishes, so watch out. When inside a UNIX, type 'cat /etc/passwd'. This will give you the list of usernames, and the encrypted passwords. The command 'who' gives a list of users online. 'Learn' and 'man' bring up help facilities. Once inside, you will standardly receive the prompt $ or % for regular users, or # for superusers. The root account is the superuser, and thus the password could be anything, and is probably well protected. I left this blank, it is up to you. There won't be any common passwords for root. COMMON ACCOUNTS: Username Password -------- -------- root daemon adm admin, sysadm, sysadmin, operator, manager uucp bin sys 123 lotus, lotus123 adduser admin adm,sysadm,sysadmin,operator,manager anon anonymous anonuucp anon, uucp, nuucp anonymous anon asg device devadmin audit auth backappl backup save, tar batch bbx blast bupsched cbm cbmtest checkfsys control cron csr support, custsup dbcat database, catalog default user, guest demo tour, guest dev devel devshp diag sysdiag, sysdiags, diags, test diags diag, sysdiag, sysdiags dialup dos fax field fld, service, support, test filepro finger fms friend guest, visitor games general gp gsa guest visitor, demo, friend, tour help host hpdb info informix database ingres database inquiry install journal journals kcml learn lib library, syslib link listen lp print spooler lpadmin lpadmin lp, adm, admin lpd ls mail maint sysmaint, service makefsys man manager mgr, man, sysmgr, sysman, operator mdf menu mountfsys ncrm ncr net network netinst inst, install, net, network netman net, man, manager, mgr, netmgr, network netmgr net, man, manager, mgr, netmgr, network network net newconv news nobody anon nuucp anon oasys oa odt opendesktop online openmail mail oper operator,manager,adm,admin,sysadmin,mgr operator sysop, oper, manager opp oracle database oraclev5 oracle, database oradev oracle pcs pcsloc pctest postmaster mail powerdown shutdown priv private prod pub public public pub reboot remote report rha rje rsm rsmadm rsm, adm, admin rusr sales sas save backup savep service field, support setup shutdown smtp mail softwork space startup su sundiag sysdiag, diag, diags, sysdiags suoper su, oper, operator super supervisor, manager, operator support field, service sync sysadm adm, admin, operator, manager sysdiag diag, diags, sysdiags sysinfo info sysmaint maint, service sysman manager,mgr,man,admin,operator,sysadmin sysmgr manager,mgr,man,admin,operator,sysadmin system sys, unix, shell, syslib, lib, operator systest test, tester, testuser, user test tester, testuser, systest, user tester test, user, testuser testuser test, tester, user, systest tftp tour demo, guest, user, visitor transfer tty tutor tutorial umountfsys unix unixmail mail, unix user guest, demo userp user usr user usrlimit utest uucpadm adm, admin, uucp uuadm uucp, adm uuadmin uucp, admin uuhost uucp, host uulog uucp, log uunx uucp uupick uucp, pick uustat uucp, stat uuto uucp, to uux uucp va vashell vax visitor guest, friend, demo, tour vlsi vmsys vm, face vsifax who wp wp51 x25 pad x25test test x400 VMS- DEC's Virtual Memory System commonly runs on VAX computers. It is another very widespread system, with many users world wide. VMS will have a 'Username:' prompt, and to be sure just type in a ',' for a username. A VMS will throw back an error message on special delimeters. You will standardly get 3 and only three login attempts, and VMS is not kind enough to let you know when you have entered an incorrect username. Once inside you will find yourself at a $ prompt. COMMON ACCOUNTS: Username Password -------- -------- backup batch dcl dec decmail mail decnet default default, user dialup demo guest dsmmanager dsm, manager dsmuser dsm, user field field, service, support, test, digital games guest visitor, demo help helpdesk help_desk helpdesk host info ingres database interactive link local mail mailer mail mbmanager mb, manager, mgr, man mbwatch watch, mb mpdbadmin mpdb, admin netcon net, network netmgr net, manager, mgr, operator netpriv network, private, priv, net netserver network net newingres ingres news operations operations operator oper, manager, mgr, admin, opervax operator, vax ops oracle pcsdba pfmuser pfm, user postmaster mail priv private remote report rje remote, job, entry student suggest suggest sys sysmaint sysmaint, maint, service, digital system manager,operator,sys,syslib systest uetp,test systest_clig systest, test tapelib teledemo demo test testuser, tester uetp user test, guest, demo userp user vax vms visitor guest, demo wpusers HP3000- HP3000 mainframes run the MPE series of operating systems, such as MPE, V, ix, X, and XL. The default login prompt is ':', but this can be prefaced with characters(ie: 'mentor:') and in some cases the ':' may be taken completely away (ie: 'mentor'). To check for a HP3000, hit a <CR>, you will get an error message such as this; EXPECTED HELLO, :JOB, :DATA, OR (CMD) AS LOGON. (CIERR 1402) To login type 'hello', followed by the login information, which is in this format: USER.ACCOUNT,GROUP. The group is optional, but may be needed in some cases, and can give you different file sets and the sort. A great thing about HP3000's is they tell you exactly what is incorrect about the login name you've supplied them, be it the account is valid but the username is wrong, or the other way around. But unfortunely, if the system operators choose, they may password ALL of the login name segments; username, account and group. The internal prompt for MPE's is, again, :. 'Help' will give you help when inside a HP3000. When entering accounts, i'd suggest not to use a group at first. If you receive the error message 'not in home group', then try the group PUB, then if even that fails, move on to the common group list. I didn't list passwords along with the accounts, as it would be a bit of an awkward format, because of MPE's awkward format. The only manufacturer default passwords I am aware of are 'hponly', for mgr.telesup, 'lotus', for mgr.sys, and 'hpword' for field.support. Just remember to try the various parts of the account as a password, and anything else along those lines. If you need a password for the following user.accounts & groups, try the various parts of the name plus any combinations of it or names with obvious links to it(ie: field=service). COMMON ACCOUNTS: Username.Account ---------------- mgr.3000devs mgr.acct mgr.backup manager.blast manager.blast1 mgr.ccc spool.ccc mgr.cnas manager.cognos mgr.cognos operator.cognos mgr.common mgr.company mgr.conv mgr.corp mgr.cslxl mgr.demo operator.disc mgr.easy mgr.easydev mgr.extend mgr.hpdesk mgr.hplanmgr field.hpncs mgr.hpncs advmail.hpoffice deskmon.hpoffice mail.hpoffice mailman.hpoffice mailroom.hpoffice mailtrck.hpoffice manager.hpoffice mgr.hpoffice openmail.hpoffice pcuser.hpoffice spoolman.hpoffice x400fer.hpoffice x400xfer.hpoffice wp.hpoffice mgr.hponly mgr.hpoptmgt field.hpp187 mgr.hpp187 mgr.hpp189 mgr.hpp196 mgr.hppl85 mgr.hppl87 mgr.hppl89 mgr.hppl96 mgr.hpskts mgr.hpspool mgr.hpword mgr.hpx11 dpcont.hq mgr.hq mgr.indhpe mgr.infosys mgr.intx3 manager.itf3000 mail.mail mgr.netbase mgr.netware operator.netware mgr.orbit mgr.prod mgr.rego mgr.remacct mgr.rje manager.security mgr.security mgr.sldemo mgr.snads mgr.softrep mgr.speedwre mgr.spool manager.starbase field.support mgr.support operator.support exploit.sys manager.sys mgr.sys operator.sys pcuser.sys rsbcmon.sys operator.syslib sysrpt.syslib mgr.sysmgr operator.system mgr.tech mgr.techxl mgr.telamon field.hpword mgr.opt manager.tch field.telesup mgr.telesup sys.telesup mgr.tellx monitor.tellx mgr.utility mgr.vecsl manager.vesoft mgr.vesoft mgr.word field.xlserver mgr.xlserver mgr.xpress COMMON GROUPS: admin advmail ask brwexec brwonlne brwspec bspadmin bspdata bspinstx bsptools catbin1 catbin2 catlib classes config console convert creator curator currarc current dat data database delivery deskmon devices diadb diag diafile diaipc doc docxl document dsg easy ems emskit etdaemon example examples ezchart galpics graphics hold hpaccss hpadvlk hpadvml hpdesk hpdraw hpecm hpemm hpenv hpgal hphpbkp hplibry hplist hplt123 hpmail hpmap hpmenu hpprofs hpsw hptelex ibmpam idl idlc idpxl include infoxl instx internal itpxl job lib libipc library mailconf maildb mailhelp mailjob maillib mailserv mailstat mailtell mailxeq mediamgr memo memory mgr mmgrdata mmgrxfer mmordata mmorxfer monitor mpexl ndfiles ndports net network nwoconf office oldmail oper operator out pascalc patchxl pcbkp ppcdict ppcsave ppcutil prntmate prog prvxl pub pubxl qedit ref request restore sample sbase sfiles signal sleeper snax25 sql sruntime subfile suprvisr sx sys sysmgr sysvol tdpdata telex telexjob text tfm ti tools transmit user users validate viewlib visicalc wp wp3 x400data x400db x400fer x400file xspool VM/CMS- The VM/CMS Operating System is found on IBM mainframes, and while there are quite a few out there, they are commonly left alone by hackers who prefer Unix or VMS. VM/CMS systems are commonly found gated off Sim3278 VTAMs and ISM systems as well. The login prompt for CMS is '.', but additional information might be given before the prompt, such as; Virtual Machine/System Product ! . or; VM/370 ! . and frequently over to the side; LOGON userid DIAL userid MSG userid message LOGOFF but they all represent a VM/CMS system. To logon, type 'logon' followed by the username, which is usually 1 to 8 characters in length. To be sure it is a CMS, type 'logon' followed by some random garbage. If it is a VM/CMS, it will reply; Userid not in CP directory This is one of the great things about CMS, it tells you if the login ID you entered is incorrect, thus making the finding of valid ones fairly easy. One thing to watch out for.. if you attempt brute forcing some systems will simply shut the account or even the login facility for some time. If that is the case, find out the limit and stay just underneath it.. drop carrier or clear the circuit if necessary, but if you continually shut down the login facilities you will raise a few eyebrows before you even make it inside. Once inside, typing 'help' will get you a moderate online manual. COMMON ACCOUNTS Username Password -------- -------- $aloc$ admin operator, manager, adm, sysadmin, sysadm alertvm alert ap2svp apl2pp autolog1 autolog autolog2 autolog batch batch1 batch batch2 batch botinstl ccc cms cmsbatch cms, batch, batch1 cmsuser cms, user cpms cpnuc cprm cspuser user, csp cview datamove demo1 demo demo2 demo direct dirmaint dirmaint1 diskcnt entty erep formplus fsfadmin fsf, adm, sysadmin, sysadm, admin, fsfadm fsftask1 fsftask2 gcs gcsrecon idms idmsse iips infm-mgr infm, man, manager, mgr inoutmgr mgr, manager ipfappl ipfserv ispvm ivpm1 ivpm2 maildel mailman maint service moeserv netview network, view, net, monitor oltsep op1 opbackup backup operatns op, operator, manager, admin operator op, operatns, manager, admin opserver pdm470 pdmremi peng presdbm dbm procal prodbm prod promail psfmaint maint pssnews news pvm router rscs rscsv2 savsys sfcm1 sfcm sfcntrl sim3278 smart sna sqldba database sqluser user, sql syncrony sysadmin admin, adm, sysadm, manager, operator sysckp sysdump1 sysdump syserr syswrm tdisk disk, temp temp tsafvm vastest test vm3812 vmarch vmasmon vmassys vmbackup backup vmbsysad vmmap map vmtape tape vmtest test, testuser vmtlibr vmutil util, utils vseipo vsemaint maint vseman vsm vtam vtamuser user, vtam x400x25 PRIMOS- Run on the Prime company's mainframes, the Primos Operating System is in fairly wide use, and is commonly found on Packet-Switched Networks worldwide. Upon connect you will get a header somewhat like PRIMENET 23.3.0 INTENG This informs you that it is indeed a Primos computer, the version number, and the system identifier the owner picked, which is usually the company name or the city the Primos is located in. If you find a Primos on a network, you will receive the Primenet header, but if it is outside of a network, the header may be different(ie:Primecon). Hit a number of <CR>'s, and Primos will throw you the login prompt 'ER!'. At this point, type 'login' followed by your username. If hitting <CR>'s did not provoke an 'ER!', then type 'login' followed by your username. If you are blessed and you find some stone age company running 18.0.0 or below, you are guaranteed access. Just find a username and there will be no password prompt. If for some reason passwording exists, a a few control-C's should drop you in. Unfortunely, Primos almost always allows one and one attempt only at a username/password combination before it kicks you off, and Primos will not tell you if the ID you've entered is invalid. Once you are inside, you will find yourself at the prompt 'OK'. 'help' brings up a so-so online help guide. COMMON ACCOUNTS Username Password -------- -------- backup backup_terminal batch_service batch bootrun cmdnc0 demo diag dos dsmsr dsm dsm_logger dsm fam games guest guest1 guest lib libraries login_server mail mailer netlink net, primenet netman manager, man, mgr, netmgr network_mgt netmgt network_server server prime primos, system primenet net, netlink primos prime, system primos_cs primos, prime, system regist rje spool spoolbin spool syscol sysovl system prime, primos, sys1, operator system_debug system_manager tcpip_manager tele test timer_progress tools TOPS-10/20- An older and somewhat rare operating system, TOPS-10 ran on the DEC-10/20 machines. You can usually recognize a TOPS-10 by its' prompt, a lone period '.', while a TOPS-20 will have a '@' in its place. Most systems allow you to enter the commands 'SYSTAT' or 'FINGER' from the login prompt, before logging in. This command will let you see the users online, a valuable aide in hacking. To login, type 'login xxx,yyy', where the x and y's are digits. TOPS-10 does let you know when your username is incorrect. COMMON ACCOUNTS User ID Code Password ------------ -------- 1,2 OPERATOR, MANAGER, ADMIN, SYSLIB, LIB 2,7 MAINT, MAINTAIN, SYSMAINT 5,30 GAMES IRIS- Unfortunely, i have no experience with IRIS whatsoever. To this day i haven't even seen one. So with regret i must present old material, the following info comes entirely from the LOD/H Technical Journal #3. Hopefully it will still be applicable. The IRIS Operating System used to run soley on PDP systems, but now runs on many various machines. IRIS will commonly present itself with a herald such as; "Welcome to IRIS R9.1.4 timesharing" And then an "ACCOUNT ID?" prompt. IRIS is kind enough to tell you when you enter an incorrect ID, it won't kick you off after too many attempts, and no logs are kept. And strangely enough, passwords are not used! So if you can find yourself an IRIS OS, try the following defaults and you should drop in.. COMMON ACCOUNTS Username -------- accounting boss demo manager noname pdp8 pdp11 software tcl NOS- The NOS(Network Operating System) is found on Cyber mainframes made by CDC(the Control Data Corporation). Cyber machines are commonly run by institutions such as universities and atomic research facilities. Cybers will usually give a herald of some sort, such as Sheridan Park Cyber 180-830 Computer System or Sacremento Cyber 180-830 CSUS NOS Software System The first login prompt will be 'FAMILY:', just hit <CR>. The next prompt is 'USER NAME:'. This is more difficult, usually 7 characters. The password is even worse, commonly 7 random letters. Sound bad? It is. Brute forcing an account is next to impossible. I've never seen these defaults work, but they are better than nothing. I got them out of the LOD/H Novice's Guide to Hacking, written by the Mentor. There are no known passwords for these usernames. COMMON ACCOUNTS Username -------- $SYSTEM SYSTEMV DECSERVER- The Decserver, is as the name implies, a server made by the Digital Equipment Corporation, the same company that makes the VAX machines. It is possible the owner of the server put a password on it, if this is the case you will hit a # prompt. If the server has PADs or outdials on it, you can bet this is the case. You don't need a username, just the password. You will commonly get 3 tries, but it can be modified. The default password is 'access', but other good things to try are ; server, dec, network, net, system (and whatever else goes along with that). If you get past the #, or there isn't one, you will hit the prompt 'Enter Username>'. What you put really doesn't matter, it is just an identifier. Put something normal sounding, and not your hacker alias. It is actually interesting to look at the users online at a Decserver, as commonly there will be a few users with the username C or CCC or the like, usually meaning they are probably a fellow hacker. Also, at the Enter Username> prompt you are able to ask for help with the 'help' command, which spews out fairly lengthly logon help file. If all went well you should end up at a 'Local>' prompt. Decservers have a fairly nice set of help files, simply type 'help' and read all you want. It is a good idea to do a 'show users' when you first logon, and next do a 'show services' and 'show nodes'. The services are computers hooked up to the Decserver, which you can access. For obvious reasons you will often find many VAX/VMS systems on Decservers, but pretty much anything can be found Look for services titled Dial, Modem, PAD, X25, Network, or anthing like that. Try pretty much everything you see. Remember to try the usernames you see when you do a 'show users' as users for the systems online. Also, you will sometimes find your Decserver has Internet (Telnet, SLIP or FTP) access, make sure you make full use of this. To connect to the services you see, use 'c XXXX', where the X's represent the service name. Once inside, the manufacturer's default for privs is 'system' and it is rarely changed. The maintenance password changes from version to version. With the Decserver 200 & 500 it is 0000000000000000 (16 0's), but with 300 it is simply 0. GS/1- GS/1's are another server type system, but they are less common than the Decservers. The default prompt is 'GS/1>', but this can be changed to the sysadmins liking. To check for a GS/1, do a 'sh d', which will print out some statistics. To find what systems are available from the server, type 'sh n' or a 'sh c', and a 'sh m' for the system macros. XMUX- The XMUX is a multiplexing system that provides remote access, made by Gandalf Technologies, Inc., Gandalf of Canada Ltd. in Canada. As far as I can tell, the XMUX is used only on Packet-Switched Networks, Datapac in particular but with usage on PSNs world wide. The XMUX is not usually thought of as a stand alone system, but as a supportive system for multi-user networked systems, having a bit to do with system monitoring, channel control, and some of the features of multiplexing. Thus, you'll commonly find a XMUX on a mnemonic or a subaddress of another system, although you will find them alone on their own NUA frequently as well. To find the systems on a subaddress or a mnemonic, your best bet is to go with mnemonics, as the LOGGER mnemonic cannot be removed, while subaddressing is optional. You won't always want to check every single system, so i'll give a guideline of where to check; (REMINDER: this is only for systems on PSNs, and may not apply to your PSN) - PACX/ : The PACX/Starmaster is also made by Starmaster Gandalf, and the two are tightly Systems interwoven. If mnemonics don't work, be sure to try LCNs, as the CONSOLE on a PACX/Starmaster is an entirely different thing, and frequently using the mnemonic CONSOLE will bring you to the PACX console, not the XMUX console. - BBS Systems : BBS Systems on PSNs frequently need some help, and XMUXs are fairly commonly found with them. - Other misc. : Many of the other operating systems, systems such as Unix, AOS/VS, Pick and HP3000 have the occasional XMUX along with it. - Networked : A good portion of networked systems have systems XMUXs. If a system does have a XMUX also, you can reach it almost always by the mnemonic CONSOLE, and if not, the node name of the XMUX. If that doesn't work, try LCNs up to and including 15. Occasionally the console of the XMUX will be unpassworded, in which case you will drop straight into the console. The XMUX console is self-explanatory and menued, so i will leave you to explore it. However, in all likeliness you will find yourself at the password prompt, 'Password >'. This can not be modified, but a one-line herald may be put above it. To check for a XMUX, simply hit <CR>. It will tell you that the password was invalid, and it must be 1 to 8 alphanumeric characters. As you can see, you do not need a username for the remote console of a XMUX. UIDs are used, but internally within the workstation. As it says, the password format is 1 to 8 alphanumeric characters. There is no default password, the console is left unprotected unless the owner decides to password it. However, there are common passwords. They are; console, gandalf, xmux, system, password, sys, mux xmux1 I'll repeat them in the common passwords again later. But these will not always work, as it is up to the owner to pick the password(although they do like those). Your next best bet is to find out the node name of the XMUX (XMUXs are polling systems as well, usually hooked up somehow to one of the regional hubs). To do this, you must understand the parts of the XMUX. The XMUX has 4 default parts; the CONSOLE, the FOX, the LOGGER, and the MACHINE. I'll try and define the usage of them a bit more; CONSOLE- the main remote part of the XMUX, which performs all the maintenance functions and system maintenance. the actual system. reachable usually on the LCN(subaddress) of 0 or 4/5, and the default mnemonic CONSOLE, which can be changed. FOX - a test system, which runs through never ending lines of the alphabet and digits 0-9. reachable on the LCN of 1, mnemonic FOX. LOGGER - a device which displays log information, usually one or two lines, including the node name. reachable on the LCN of 2, mnemonic LOGGER. MACHINE- a system which i do not yet understand fully. performs some interesting functions. the prompt is '#'. type 'S' and you will(always) receive a short/long (depending on how much the system is used) system status report, containing among other things the system node name. if active, typing 'L' will bring up a more complete system log. This is VERY useful. It contains the NUAs of the systems which called the XMUX, and it contains the UIDs if used. As you can see, the XMUX is rather complicated upon first look, but it is actually fairly simple. The easiest way to grab the node name is to call the LOGGER. The logger MUST be present, always. It is a non-removable default. The LCN may be removed, but the mnemonic must stay. I explained mnemonics earlier, but i'll refresh your memory. To use the mnemonic, simply type the NUA, followed by a comma and then the mnemonic, ie; 12300456,LOGGER The very first thing in the data string you see is the node name. If it is a blank space, you have run across a rarity, a XMUX without a node name. The node name is THE most popular thing other than the other common passwords. Try combinations of it, and combinations of it along with the words XMUX and MUX. And of course, if a herald is used, use whatever you can find in the herald. But again, if it is a company, they love to use the company name or acronym as a password, and that acronym or name will often be the node name. Ok, have fun.. COMMON ACCOUNTS Console Passwords ----------------- CONSOLE XMUX GANDALF SYSTEM PASSWORD MUX XMUX1 SYS (node name) One other thing. I did not include the profile or remote profile names, or the UIDs, as they are as far as i know inapplicable from remote. And a final comment. XMUXs are powerful and potentially extremely harmful to a network. DO NOT DELETE ANYTHING. The only submenus you will have reason to access are 'DEFINE' and 'DISPLAY'. Don't boot people off channels or add console passwording or remove profiles..you will end up with your ass in jail. Taking down a network is less than funny to the people that run it. Explore, don't harm. STARMASTER- The Starmaster/PACX 2000 is still a somewhat mysterious /PACX system, but i have now explored all the security barriers as well as the network and the internal functions, so i feel this is fairly complete. The Starmaster/PACX system is a networking/server system made by, again, Gandalf Technologies Inc., Gandalf of Canada Ltd., in Canada, and is also known informally (and some what incorrectly) as the 'Gandalf Access Server.' The Access is similar, but different, as described later. It is a fairly popular system on Datapac, and has some usage in other regions of the world. Again, it is used mainly on Packet-Switched Networks, although, thanks to the dialing directory of a Sam24V outdial on a Starmaster, I have discovered that Starmasters do indeed have dialin access. The first possible security barrier is the dialin password, which is rarely used, but you should know about. The prompt is usually ; DIALIN PASSWORD? But can be changed, although it should remain similar. Dialin passwords are 1 to 8 characters, and are usually one of the following defaults; GANDALF SERVER PACX NET NETWORK STARMAST DIALIN PASSWORD ACCESS If the Starmaster has a XMUX resident(explained in previous system definition; XMUXs), find out the node name and try it. The next possible security barrier is that the sysadmin desires the users to enter a username/password before entering the server. You will find yourself at a prompt such as; USERNAME? This is the most common prompt. Usernames are 1 to 8 characters, and the Starmaster will let you know if it is wrong or not with an error message such as; INCORRECT USERNAME or INVALID RESPONSE This, like the username prompt, can be changed, but it will usually be in all-caps. You are allowed between 1 and 10 attempts at either a valid username or a valid password, depending on the owners preference. This means(if it is set to ten tries) you can enter 9 invalid usernames, and on the tenth enter a valid username, then have 10 attempts at a valid password. The defaults for this(which i will list later also) prompt are; TEST, TESTUSER, TESTER, GANDALF, SYSTEM, GUEST USER, HP, CONSOLE, and finally OPERATOR. Also, first names will work usually. The next prompt you will face, or the first one if usernames are not implemented, is the server prompt. This is the main user prompt for a Starmaster, all major user commands are used from here. But as you can guess, commands aren't used really, it is service names you desire. Sometimes you will get a list upon entering the server, but other times you will just hit the server prompt, which usually looks something like; SERVICE? or CLASS? or even service? or class? or service Or whatever the sysadmin feels like. 'SERVICE?' is the default, and the most common. Keep in mind that the services CAN be passworded, but rarely are. In the case of passwording, use your imagination. Another thing; from the PACX console, where the services are defined, there is an option which decides whether the service is allowed for remote users. If this is set to NO, then you are out of luck, you have to be in the workstation to use the command. This is common for the CONSOLE and the MAIL, and occasionally modems and PADs. You will get an error message something like 'SERVICE NOT ALLOWED'. I will give a more complete list of common services, but I will list the defaults and the major ones now. PAD, X25, X28- Will commonly take you to a Gandalf PAD, (or name of for which the default prompt is '*'. your PSN) 'HELP' will bring up a list of commands. MAIL - A non-removable default, but i've never seen it with the remote access flag in the ON position. CONNECT - Another non-removable default which i have never seen with the remote access flag in the on position. MODEM, DIAL - And variations therof. The common outdial is the Gandalf made Sam24V, which comes with a great set of help files. CONSOLE - The motherlode. The system controller, maintenance computer, test machine, and all of that. DON'T confuse the PACX console with the XMUX console, they are two very different things. The console should be protected by the sysadmin with his/her life, as every faction of the Starmaster is controlled from within the Console. The CONSOLE is a non-removable service from the server, BUT remote access can be removed thus cutting off our means of getting to it. Try it first, if it works the screen will scroll down a number of lines and give this herald/prompt; GANDALF TECHNOLOGIES INCORPORATED, COPYRIGHT 1990 OPERATOR NAME? This is not changable, it will remain the same except for possibly the copyright date. There can be 8 operators at the most, and they will have 1 to 8 characters in their name and password. And again, the PACX will tell you if your operator name is incorrect. You will be allowed 1 to 10 attempts at the login name and then it resets to 0 for the password attempt when you've found an operator name, but same limit. The same defaults for the usernames work here, if you are lucky, with the exception of HP. I'll list them again at the end. Once you get in, it is all menued and explanatory. DON'T FUCK THINGS UP. By that I mean deleting or modifying. Look. There is MUCH to see. The PACX console is incredibly powerful, and you will have much more fun exploring it. Besides, once you are in the console, the game is over. You have control over all the services, users, and all security barriers. If you get a high level console account, you are the God of the PACX, no joke. COMMON ACCOUNTS Usernames Passwords --------- --------- CONSOLE CONSOLE, PACX, GANDALF, OPERATOR, SYSTEM GAND GAND GANDALF GANDALF, SYSTEM, PACX, STARMAST, SYS GUEST GUEST, VISITOR, USER HP HP OPERATOR OPERATOR, SYSTEM, SYSLIB, LIB, GANDALF SYSTEM SYSTEM, SYS, OPERATOR, PACX, SYS, GANDALF TEST TEST, TESTUSER, USER, TESTER TESTUSER TEST, TESTUSER, USER, TESTER TESTER TEST, TESTUSER, USER, TESTER USER USER, GUEST, TEST, VISITOR, GANDALF (i've never seen an account such as MAINT, but i would guess one exists, along with standard system defaults. Try anything outside these lines) Services -------- 1 (if it works; higher) A (through Z) 10 (if it works; higher in sequence of tens) BBS CLUSTER CONNECT CONSOLE DATABASE DATAPAC DEC DIAL DIALOUT FILES FTP GATEWAY GEAC HELP HP INTERNET LIB LIBRARY LOOP MAIL MENU MODEM MUX NET NETWORK OUT OUTDIAL PACX12 PACX24 PACX96 PAD PRIME PRIMOS PROD SALES SERVER SUN SUNOS SYS SYSTEM TELNET TYMNET UNIX VAX VMS X25 X28 XCON XGATE XMUX And anything else you can think of. First names are also fairly common. Operator Name Password ------------- -------- TEST TEST, TESTUSER, USER, TESTER TESTUSER TEST, TESTUSER, USER, TESTER TESTER TEST, TESTUSER, USER, TESTER GANDALF GANDALF, SYSTEM, PACX, CONSOLE, SYS GUEST GUEST, VISITOR, USER SYSTEM SYSTEM, SYS, OPERATOR, PACX, SYS, GANDALF CONSOLE USER USER, GUEST, TEST, VISITOR, GANDALF OPERATOR OPERATOR, SYSTEM, CONSOLE, GANDALF CONSOLE CONSOLE, PACX, GANDALF, OPERATOR, SYSTEM SYS SYS, SYSTEM, GANDALF, PACX, CONSOLE And again, try first names and ANYTHING you can think of. Getting into the console should be your main objective. ACCESS2590- The Access2590 is another Gandalf creation. While it is a server system, it is different in some respects to a PACX. The Starmaster generally only connects computers on a local or wide area network(they do connect to X.25 & IP addresses, but they *usually* don't), while the Access 2590 connects to local & wide area network services, X.25 address, and IP addresses with suprising versatility. The PACX is, however, in much wider distribution. It will usually have an initial herald screen, often letting you know that it is indeed an Access server made by Gandalf. If the operator wishes he can include a menu of services with their respective descriptions in this provided space. Then you will find yourself at a prompt, the default being "Access 2590 >". I haven't seen any sort of initial protection before you hit that prompt, but i'm betting it does exist, and it probably goes along the lines of the PACX. Follow the trend I set with the PACX and you should do fine. Anyways, the one thing I like so much more about the Access 2590 compared to the Starmaster is the command "show symbols" . That was one of the big problems from a hacking point of view with the PACX; it doesn't have a command available to show you the services. If you get console access on the PACX you can get a listing of services that way, but you simply cannot hack a console account everytime, and besides that often the owner will have turned the remote console access flag off. If the operator wanted to give you help with services he had to take the initiative himself and design a herald screen or implement a help service, and few do. But the "show symbols" on an Access will give you a listing of all the available "symbols", which is Gandalf's term for services. Connect to them with "c xxx" where "xxx" is of course the service. And yes, to you eager folks who have tasted the PACX console's power, the Access does have a console. Type "c console" to get to it. Follow the PACX's guidelines, and you'll do fine. PICK- The PICK system was created by Dick Pick(no joke), and is a fairly widespread system, there are a few of them out there on the major PSNs. I really dislike PICK, but for those of you wishing to try it yourself, it is a fairly easy hack. A normal PICK login prompt looks somewhat like; 07 JUN 1993 04:00:21 Logon please: Additional data can be entered in that line, and a header may be used above that. However, PICKs are usually recognizable by that logon prompt which will normally contain the date and time, as well as the 'Logon please:'. If you aren't sure, enter the username 'SYSPROG', in ALL CAPS , as PICK is case sensitive and SYSPROG will be in capitals. SYSPROG is the superuser(or as PICK calls it the 'Ultimate User') and is similar to root on a Unix; it must be present. PICK lets you know when you've entered an invalid Username, which is helpful when finding valid accounts. Experiment with the upper and lower case if you wish, but upper case is the norm. The people who make PICK like to think of PICK as more a DBMS than an OS, and it is often sold just as that. Because of that, you may find it on Unix, MPE, and Primos based systems among others. One last note, internal passwording is possible on the PICK, so don't be too suprised if you think you've found an unpassworded system only to be hit by a password before the internal prompt. COMMON ACCOUNTS Usernames Passwords --------- --------- 1 ACC ACCT ACCTNAME ACCUMATH ACCUPLOT ACCUPLOT-DEMO ACCUPLOT, DEMO ARCHIVE AUDITOR AUDITORS BACKUP BATCH BLOCK-CONVERT BLOCK-PRINT COLDSTART COMBINATION COMM COMTEST CPA CPA.DOC CPA, DOC CPA.PROD CPA, PROD CTRL.GROUP CTRL, CONTROL DEMO DA DCG DEV DM DATA, MANAGER, MAN, MGR, DATAMGR, DATAMAN DOS ERRMSG EXCEPTIONAL EXECUTE-CONTROL EXPRESS.BATCH EXPRESS, BATCH FILE-SAVE FILESAVE, SAVE FILE-TRANSFER FINANCE FLUSHER FMS FMS.PROD FMS, PROD GAMES GAMES.DOS GAMES GENERAL INSTANT INSTANT.DOS INSTANT JOB KILL LEARN LEARN.DLR LEARN, DLR, LEARNDLR LOGON LOTUS LOTUS.DOS LOTUS MAIL.BOX MAIL MINDER MODEM-SECURITY MOTD.DATA MOTD NETCOM NET.OFF NETOFF NETUSER NETWORK NEWAC NOLOG OLD.USER ON-LINE-DIAGS DIAGS PERFECT-BKGRND POINTER-FILE PRICE.DOS PRICE PRICES.DOS PRICES PROCLIB PROC, LIBRARY, LIB PROD PROMCOR PROMIS-ARCHIVE PROMIS, ARCHIVE PROMIS-BKGRND PROMIS, BKGRND PROMO PWP QA QUALITY, CONTROL SCC.SYSPROG SCC, SYSPROG SCREENLIB SECURITY SET.PLF SET, PLF, PLFSET SL SPSYM STUDENT SUPPORT SYM.DOS SYM SYS SYS.DOC SYS SYSLIB SYSTEM, LIBRARY, SYS, LIB SYSPROG SYSTEM, PROGRAM, SYS, PROG, OPERATOR, DM SYSPROG-PL SYSPROG, PL SYSTEM-ERRORS TCL TEMP TEMP-SYSPROG TEMP, SYSPROG TEST TEST-BKGRND TEST TRAINING TRY.DOS TRY ULTICALC ULTILINK ULTIMATION UNIMAX WORDS WP WP.DOS WP WP42.DOS WP, WP42 WP50.DOS WP, WP50 WP51 WP, WP51 WP51.DOS WP, WP51 XES AOS/VS- AOS/VS is made by Data General Corporation(DGC), and is in my opinion the worst operating system i've seen yet. But, in the quest of knowledge, and to broaden your computer horizons, i suggest that you try to hack even this system, for what it's worth. The AOS/VS will usually readily identify itself with a banner such as; (yes, i'm overstepping my margin, i apologize) **** AOS/VS Rev 7.62.00.00 / Press NEW-LINE to begin logging on **** AOS/VS 7.62.00.00 / EXEC-32 7.62.00.00 11-Jun-93 0:27:31 @VCON1 Username: The username prompt looks deceivingly like a VMS, but it is not, and you can be sure by entering garbage for the username and password. The AOS/VS will reply; Invalid username - password pair AOS/VS will not let you know when you've entered an incorrect username. And a standard system will let you have 5 tries at a username/ password combination, but after that it gives this annoying message; Too many attempts, console locking for 10 seconds Having the system lock for 10 seconds does really nothing to the hacker, except slow brute forcing down a small bit(10 seconds). Anyways, once inside 'HELP' will give you a set of help files which i didn't enjoy too much, and 'WHO' will list the users online. COMMON ACCOUNTS Username Password -------- -------- guest op operator, op sysmgt sys, mgt, system, man, mgr, manager test user RSTS- Probably the oldest OS that is still out there is RSTS. RSTS was a very common OS a decade or so ago, but is now nearing extinction. However, there are still a few out there on PSNs, and thus you might want to attempt to hack in. The RSTS will usually identify itself like; RSTS V9.7-08 93.06.10 02:36 User: Before attempting to hack, try the SYSTAT command. It is likely it will be disabled, but it is worth a try. RSTS will tell you if the ID you've entered is incorrect with the error message; ?Invalid entry - try again The UIDs are in the format xxx,yyy , where x and y are digits. Just guess at UIDs until you hit one with a password. Also, the IDs will generally not go above 255 in both the x and y spots(ie: 255,255 is generally the highest ID). COMMON ACCOUNTS User ID Password ------- -------- 1,2 SYSLIB WNT- I really don't know much about Windows NT, mostly having to do with the fact that it was just released a little while ago and I have not seen it in action to this date. I don't know at what time in the future it will become widespread, but for you future hackers I did a little research and came up with the two manufacturer defaults; administrator and guest. Both come unpassworded.. administrator is the equivalent to root on a Unix, and guest is just as you'd expect .. a low level guest account. Interestingly enough, in the manuals I saw WNT sysadmins were encouraged to keep the guest account... unpassworded at that! Highly amusing.. let's see how long that lasts! Anyways.. Oh yeah.. case sensitive, too.. I'm pretty sure it is lowercase, but it is possible that the first letter is capitalized. Remember that when attempting to brute force new accounts. Oh, and keep in mind possible accounts such as "test" and "field" and the such. COMMON ACCOUNTS Username -------- administrator guest NETWARE- Novell Netware is the most common PC LAN software and is a popular among high-schools. The internal (and external for that matter) security is poor. COMMON ACCOUNTS Username Password -------- -------- admin operator, supervisor, sysadm backup guest visitor, user netware novell netware public remote server staff supervisor admin, operator, sysadm, supervis, manager system1 tape backup test testuser user visitor guest Sys75/85- AT&T's System75/85 have made a big splash in recent months despite their being around for years previous.. mostly due to codez kids discovering the PBX functions. Anyways, the hype has pretty much died down so it is probably safe to post the defaults. If you don't like my doing this, suck yourself. Anyone with access to this file probably has them by now anyways. And if not, all the better. Free information has always been one of our primary goals, and I don't intend to change that for some insecure pseudo-hackers. COMMON ACCOUNTS Username Password -------- -------- browse looker craft crftpw, craftpw cust custpw field support inads indspw, inadspw init initpw rcust rcustpw AS400- Another OS that was only really in use before my time, AS-400 is IBM made. I pulled this from the old UPT messages, thanks to anybody who contributed. It should in fact identify itself as an AS-400 at login time. I'm unsure of the case-sensativity of the characters.. i'll enter them as lowercase, but if unsuccessful use caps. COMMON ACCOUNTS Username -------- qsecofr qsysopr quser sedacm sysopr user TSO- An IBM product, TSO can be found stand alone, but is commonly found off an ISM. Upon connect you should see a login prompt that looks like: IKJ56700A ENTER USERID- Or something close. It will tell you if the username entered is incorrect: IKJ5642OI USERID xxx NOT AUTHORIZED TO USE TSO IKJ56429A REENTER- Occasionally some of the accounts will have the STC attribute and can not be used for remote login. COMMON ACCOUNTS Username Password -------- -------- admin adm, sysadm, op guest init maint systest test test1 test tso BRUTE FORCE =========== ----------- Passwords ========= Occasionally you will find yourself in a position where you wish to penetrate a system, but defaults are taken off and social engineering is not possible. The dedicated hacker then begins the tedious process of trying password after password, hoping to crowbar his way into the system. Thus the term 'Brute Force' was born, aptly describing this process. Brute force is the absolute ugliest way of obtaining an account, but is is often effective. It is ugly for a number of reasons, having to do with the fact that you will have to call the system hundreds of times if the account is not easily brute forced. However, first i will explain a modified form of brute force; intelligent brute force. In this process, the hacker tries the users first name, as that is the most common password of all, and a database of 20-100 common passwords. The difference between this and the normal brute forcing is you cut your time down considerably, but your chances of getting in go down as well. Normal brute forcing is rarely done nowadays; the greats of yesterday would spend 6 hours at a sitting trying passwords, but people nowadays seem to think 5 minutes is sufficient. Ugh. If standard brute forcing is done, it is accomplished with automation, usually. Meaning the hacker will set up a program or a script file to spew out dictionary passwords for him, then go to the movies or whatever. Obviously, any way you do it, standard brute forcing is fairly dangerous. A sysadmin is more likely to notice you trying a username/password 2000 times than 50. If you choose to do automated brute forcing, it might be a good idea to set up a hacked system to do it for you, such as a procured Unix. I would not, however, suggest wasting the powers of a Cray on such a menial task as brute force. You can only go as fast as the host system will let you. The danger in this is obvious, you will have to be connected to the remote system for a long time, leaving you wide open for a trace. It is up to you. And, of course, brute forcing requires a username. If you don't have a username, you are probably out of luck. One thing you should definetly do is make a list of first names, and make it fairly complete. Buy/steal a baby names book or look inside your phone book and copy down the more commmon names on to a piece of paper or into a file. Other than first names, husband/wife, boyfriend/girlfriend and childs names are the most common passwords. Ok, here are the basics to intelligent brute force hacking; 1. try the users first name 2. try your list of first names, male and female 2. try the users first name, with a lone digit(1 to 9) after the username 3. try the users first name, with a lone digit(1 to 9) after the username 4. try the users first name, with a letter appended to the end(A to Z) 5. try anything related to the system you are on. If you are on a VAX running VMS on the Datapac PSN, try VAX, VMS, Datapac, X25, etc 6. try anything related to the company/service the system is owned by. if the user is on a system owned by the Pepsi Cola company, try Pepsi, Cola, Pepsico, etc. 7. finally, try passwords from your list of common passwords. your list of common passwords should not be above 200 words. The most popular passwords are; password secret money sex smoke beer x25 system hello cpu aaa abc fuck shit Add on popular passwords to that as you see fit. Remember; most passwords are picked spontaneously, on whatever enters the users mind at that time(you know the feeling, i bet). Attempt to get into the users mind and environment, to think what he would think. If you can't do that, just try whatever comes to your mind, you'll get the hang of it. Brute Forcing User Names ======================== A different form of brute force is that when you need a username to hack passwords from. In order to guess a valid username, you must be on a system that informs you when your username is invalid; thus VMS and Unix are out of the question. There are two types of usernames(by my definition); user and system. The user usernames are the standard user's usernames. Examples would be John, Smith, JMS, JSmith, and JohnS. The system usernames are special usernames used by the system operators to perform various functions, such as maintenance and testing. Since these usernames are not owned by actual people(usually), they are given a name which corresponds to their function. Guessing either type is usually fairly easy. User usernames are standardly in one of 2 formats; first name or last name the more common format being first name. Less common formats are initials, first initial/last name, and first name/last initial. Occasionally the username formats will have nothing to do with names at all, and will instead be 6 or 8 digit numbers. Have fun. The users of a system will almost always have the same format as each other. When you guess one, guessing more shouldn't be too hard. For first names, again consult the list you made from the baby names book. For last names, construct a list of the most common last names, ideally out of the phone book, but if you are too lazy your mind will do fine. SMITH and JONES are the most common non-foreign names. For initials, use common sense. Guess at 3 letter combinations, and use sensible formats. Meaning don't use XYZ as a rule, go for JMS, PSJ, etc, to follow along with common first names and last names. If you are getting no luck whatsoever, try switching your case(ie: from all lower case to all upper case), the system might be case sensitive. Usually guessing system names shouldn't be necessary; I gave a default list for all the major systems. But if you run across a system not listed, you will want to discover defaults of your own. Use common sense, follow along with the name of the new OS and utilities that would fit with that name. Attempt to find out the username restrictions for that system, if usernames have to be 6 characters long, try only 6 character user names. And finally, here is a list of common defaults(they are capitalized for convienience, but as a rule use lower case); OPERATOR SYSOP OP OPER MANAGER SYSMAN SYSMGR MGR MAN ADMIN SYSADMIN ADM SYSADM BOSS MAIL SYSTEM SYS SYS1 MAINT SYSMAINT TEST TESTER TESTUSER USER USR REMOTE PUB PUBLIC GUEST VISITOR STUDENT DEMO TOUR NEWS HELP MGT SYSMGT SYSPROG PROD SALES MARKET LIB LIBRARY FILES FILEMAN NET NETWORK NETMAN NETMGR RJE DOS GAMES INFO SETUP STARTUP CONTROL CONFIG DIAG SYSDIAG STAT SYSDIAGS DIAGS BATCH SUPRVISR SYSLIB MONITOR UTILITY UTILS OFFICE CORP SUPPORT SERVICE FIELD CUST SECURITY WORD DATABASE BACKUP FRIEND DEFAULT FINANCE ACCOUNT HOST ANON SYSTEST FAX INIT INADS SETUP Brute Forcing Services ====================== There is also the time when you are on a server system, and you need places to go. You will surely be told if the service you've entered is incorrect, so just try things that come to mind, and the following list; (the server may be case sensitive..use upper or lower case as you wish) (NOTE: Try digits(1 +) and letters(A-Z) also) SERVER NETWORK NET LINK LAN WAN MAN CONNECT LOG LOGIN HELP DIAL OUT OUTDIAL DIALOUT MODEM MODEMOUT INTERNET TELNET PAD X25 X28 FTP SYSTEM SYS SYS1 SYSTEM1 UNIX VAX VMS HP CONSOLE INFO CMDS LIST SERVICES SERVICE SERVICE1 COMP COMPUTER CPU CHANNEL CHANNEL1 CH1 CH01 GO DO ? LOG ID USERS SHOW WHO PORT1 PORT NODE1 NODE LINK1 DISPLAY CONFIG CONTROL DIAGS SYSDIAGS DIAG SYSDIAG HELLO EMAIL MAIL SET DEFINE PARAMS PRINT PHONE PHONES SESSION SESSION1 BEGIN INIT CUST SERVICE SUPPORT BUSINESS ACCT ACCOUNT FINANCE SALES BUFFER QUEUE STAT STATS SYSINFO SYSTAT FTP ACCESS DISK LIB SYSLIB LIBRARY FILES BBS LOOP TEST SEARCH MACRO CALL COMMANDS TYPE FIND ASK QUERY JOIN ATTACH JOB REMOTE COM1 COM CALLER LOGGER MACHINE BULLITEN CLUSTER RUN HELLO PAYROLL DEC SOCIAL ENGINEERING ================== ------------------ While I am in no way going to go indepth on SE(social engineering) at this point, i will explain the premise of SE to those new to it. Social engineering can be defined any number of ways, but my definition goes along the lines of; "Misrepresentation of oneself in a verbal manner to another person in order to obtain knowledge that is otherwise unattainable." Which in itself is a nice way of putting "manipulation, lying and general bullshitting". Social engineering is almost always done over the phone. I'll give an example. The hacker needs information, such as an account, which he cannot get by simple hacking. He calls up the company that owns the system he wishes to penetrate, and tells them he is Joe Blow of the Computer Fixing Company, and he is supposed to fix their computers, or test them remotely. But gosh, somebody screwed up and he doesn't have an account. Could the nice lady give him one so he can do his job and make everybody happy? See the idea? Misrepresentation of the truth; pretending to be someone you aren't. If you are skeptical, you shouldn't be. SE is tried and true, due to the fact that any company's biggest security leak is their employees. A company can design a system with 20 passwords, but if an uncaring employee unwittingly supplies a hacker with all of these passwords, the game is over. You *must* have the voice for it. If you sound like a 12 year old, you aren't going to get shit. If you can't help it, there are telephone-voice changers(which any SE practicer should have anyways) that will do it for you. If the person wishes to contact higher authority(who will probably suspect somethings up), get mad. Don't go into a rage, but do get angry. Explain that you have a job to do, and be persuasive. I won't go more into SE, there are tons of text files out there on it already. Just remember to keep calm, have a back up plan, and it is a good idea to have the script on paper, and practice it a bit before hand. If you sound natural and authorative, you will get whatever you want. And practice makes perfect. TRASHING ======== -------- Trashing is another thing i will not go too indepth on, but i will provide a very quick overview. Trashing is the name given to the process of stealing a companies trash, then rooting through it and saving the valuable information. Trashing is practiced most often on the various RBOCs, but if you are attempting to hack a system local to you, it might be a good idea to go trashing for a few weeks, you might find a printout or a scrap of paper with a dialup or username and password written on it. ACRONYMS ======== -------- This is a basic list of H/P acronyms I've compiled from various sources.. it should be big enough to serve as an easy reference without being incredibly cumbersome ABSBH: Average Busy Season Busy Hour AC: Area code ACC: Automatic Communications Control ACC: Asynchronous Communications Center ACD: Automatic Call Distributor ACE: Automatic Calling Equipment ACF: Advanced Communications Functions ACN: Area Code + Number ADPCM: Adaptive Differential Pulse Code Modulation AIS: Automatic Intercept System ALFE: Analog Line Front End ALRU: Automatic Line Record Update AM: Account Manager AM: Access Module AM: Amplitude Modulation AMA: Automatic Message Accounting AMSAT: American Satellite AN: Associated Number ANI: Automatic Number Identification ANXUR: Analyzer for Networks with Extended Routing AOSS: Auxiliary Operator Services System AP: Attached Processor ARC: Automatic Response Control ARP: Address Resolution Protocol ARPA: Advanced Reasearch Projects Agency ARS: Automatic Response System ARSB: Automated Repair Service Bureau AT: Access Tandem ATB: All Trunks Busy ATH: Abbreviated Trouble History ATM: Automated Teller Machine ATM: Asynchronous Transfer Mode AT&T: American Telegraph and Telephone Company AVD: Alternate Voice Data BCD: Binary Coded Decimal BCUG: Bilateral CUG BELLCORE: Bell Communications Research BGP: Border Gateway Protocol BHC: Busy Hour Calls BLV: Busy Line Verification BOC: Bell Operating Company BOR: Basic Output Report BOS: Business Office Supervisor BSC: Binary Synchronous Module BSCM: Bisynchronous Communications Module BSOC: Bell Systems Operating Company CA: Cable CADV: Combined Alternate Data/Voice CAMA: Centralized Automatic Message Accounting CATLAS Centralized Automatic Trouble Locating & Analysis System CAU: Controlled Access Unit CAVD: Combined Alternated Voice/Data CBC Cipher Block Chaining CBS: Cross Bar Switching CBX: Computerized Branch Exchange CBX: Computerized Business Exchange CC: Calling Card CC: Common Control CC: Central Control CC: Country Code CCC: Central Control Complex CCC: Clear Channel Capability CCC: Central Control Computer CCIS: Common Channel Interoffice Signalling CCITT: International Telephone and Telegraph Consultative Committee CCM: Customer Control Management CCNC: Common Channel Network Controller CCNC: Computer Communications Network Center CCS: Common Channel Signalling CCSA: Common Control Switching Arrangement CCSA: Common Central Switching Arrangement CCSS: Common Channel Signalling System CCT: Central Control Terminal CCTAC: Computer Communications Trouble Analysis Center CDA: Call Data Accumulator CDA: Crash Dump Analyzer CDA: Coin Detection and Announcement CDAR: Customer Dialed Account Recording CDC: Control Data Corporation CDI: Circle Digit Identification CDO: Community Dial Office CDPR: Customer Dial Pulse Receiver CDR: Call Dial Recording CDS: Cicuit Design System CEF: Cable Entrance Facility CERT: Computer Emergency Response Team CF: Coin First CGN: Concentrator Group Number CI: Cluster Interconnect CIC: Carrier Identification Codes CICS: Customer Information Control System CID: Caller ID CII: Call Identity Index CIS: Customer Intercept Service CISC: Complex Instruction Set Computing CLASS: Custom Local Area Signalling Service CLASS: Centralized Local Area Selective Signalling CLDN: Calling Line Directory Number CLEI: Common Language Equipment Identification CLI: Calling Line Identification CLID: Calling Line Identification CLLI: Common Language Location Indentifier CLNP: Connectionless Network Protocol CMAC: Centralized Maintenance and Administration Center CMC: Construction Maintenance Center CMDF: Combined Main Distributing Frame CMDS: Centralized Message Data System CMIP: Common Management Information Protocol CMS: Call Management System CMS: Conversational Monitoring System CMS: Circuit Maintenance System CMS: Communications Management Subsystem CN/A: Customer Name/Address CNA: Communications Network Application CNAB: Customer Name Address Bureau CNCC: Customer Network Control Center CNI: Common Network Interface CNS: Complimentary Network Service CO: Central Office COC: Central Office Code COCOT: Customer Owned Coin Operated Telephone CODCF: Central Office Data Connecting Facility COE: Central Office Equipment COEES: Central Office Equipmet Engineering System COER: Centarl Office Equipment Reports COLT: Central Office Line Tester COMSAT: Communications Satellite COMSEC: Communications Security COMSTAR: Common System for Technical Analysis & Reporting CONS: Connection-Oriented Network Service CONTAC: Central Office Network Access COS: Class of Service COSMIC: Common Systems Main Inter-Connection COR: Class Of Restriction COSMOS: Computerized System For Mainframe Operations COT Central Office Terminal CP: Control Program CPBXI: Computer Private Branch Exchange Interface CPC: Circuit Provisioning Center CPD: Central Pulse Distributor CPMP: Carrier Performance Measurement Plan CRAS: Cable Repair Administrative System CRC: Customer Record Center CRC: Customer Return Center CREG: Concentrated Range Extension & Gain CRG: Central Resource Group CRIS: Customer Record Information System CRS: Centralized Results System CRSAB: Centralized Repair Service Answering Bureau CRT: Cathode Ray Tube CRTC: Canadian Radio-Television and Telecommunications Commission CSA: Carrier Servicing Area CSAR: Centralized System for Analysis and Reporting CSC: Cell Site Controller CSC: Customer Support Center CSDC: Circuit Switch Digital Capability CSP: Coin Sent Paid CSMA/CD: Carrier Sense Multiple Access/Collission Detection CSR: Customer Service Records CSS: Computer Special Systems CSS: Computer Sub-System CSU: Channel Service Unit CT: Current Transformer CTC: Channel Termination Charge CTC: Central Test Center CTM: Contac Trunk Module CTMS: Carrier Transmission Measuring System CTO: Call Transfer Outside CTSS: Compatible Time Sharing System CTSS: Cray Time Sharing System CTTN: Cable Trunk Ticket Number CTTY: Console TeleType CU: Control Unit CU: Customer Unit CUG: Closed User Group CWC: City-Wide Centrex DA: Directory Assistance DACC: Directort Assistance Call Completion DAA: Digital Access Arrangements DACS: Digital Access and Cross-connect System DACS: Directory Assistance Charging System DAIS: Distributed Automatic Intercept System DAL: Dedicated Access Line DAO: Directory Assistance Operator DAP: Data Access Protocol DARC: Division Alarm Recording Center DARPA: Department of Defense Advanced Research Projects Agency DARU: Distributed Automatic Response Unit DAS: Device Access Software DAS: Directory Assistance System DAS: Distributor And Scanner DAS: Dual Attachment Station DASD: Direct Access Storage Device DBA: Data Base Administrator DBA: Digital Business Architecture DBAC: Data Base Administration Center DBAS: Data Base Administration System DBC: Digital Business Center DBM: Database Manager DBMS: Data Base Management System DBS: Duplex Bus Selector DCA: Defense Communications Agency DCC: Data Country Code DCC: Data Collection Computer DCE: Data Circuit-Terminating Equipment DCE: Data Communicating Equipment DCL: Digital Computer Language DCLU: Digital Carrier Line Unit DCM: Digital Carrier Module DCMS: Distributed Call Measurement System DCMU: Digital Concentrator Measurement Unit DCO-CS: Digital Central Office-Carrier Switch DCP: Duplex Central Processor DCS: Digital Cross-Connect System DCSS: Discontiguous Shared Segments DCSS: Digital Customized Support Services DCT: Digital Carrier Trunk DDCMP: Digital Data Communications Message Protocol DDD: Direct Distance Dialing DDN: Defense Data Network DDR: Datapac Design Request DDS: Digital Data Service DDS: Digital Data System DDS: Dataphone Digital Service DEC: Digital Equipment Corporation DES: Data Encryption Standard DF: Distributing Frame DGC: Data General Corporation DH: Distant Host DID: Direct Inward Dialing DIMA: Data Information Management Architecture DINS: Digital Information Network Service DIS: Datapac Information Service DISA: Direct Inward System Access DLC: Digital Loop Carrier DLS: Dial Line Service DM: Demultiplexer DMA: Direct Memory Access DN: Directory Numbers DNA: Datapac Network Address DNA: Digital Named Accounts DNA: Digital Network Architecture DNIC: Data Network Identifier Code DNR: Dialed Number Recorder DNS: Domain Name Service DNS: Domain Name System DOCS: Display Operator Console System DOD: Department Of Defense DOM: District Operations Manager DPSA: Datapac Serving Areas DPTX: Distributed Processing Terminal Executive DSC: Data Stream Compatibility DSI: Data Subscriber Interface DSL: Digital Subscriber Line DSN: Digital Services Network DSU: Data Service Unit DSU: Digital Service Unit DSX: Digital Signal Cross-Connect DTC: Digital Trunk Controller DTE: Data Terminal Equipment DTF: Dial Tone First DTG: Direct Trunk Group DTI: Digital Trunk Interface DTIF: Digital Tabular Interchange Format DTMF: Dual Tone Multi-Frequency DTN: Digital Telephone Network DTST: Dial Tone Speed Test DVM: Data Voice Multiplexor EAEO: Equal Access End Office EA-MF: Equal Access-Multi Frequency EBDI: Electronic Business Data Interchange EC: Exchange Carrier ECC: Enter Cable Change EDC: Engineering Data Center EDI: Electronic Data Interchange EE: End to End Signaling EEDP: Expanded Electronic Tandem Switching Dialing Plan EGP: Exterior Gateway Protocol EIES: Electronic Information Exchange System EIU: Extended Interface Unit EKTS: Electonic Key Telephone Service ELDS: Exchange Line Data Service EMA: Enterprise Management Architecture EO: End Office EOTT: End Office Toll Trunking EREP: Environmental Recording Editing and Printing ESA: Emergency Stand Alone ESB: Emergency Service Bureau ESN: Electronic Serial Number ESP: Enhanced Service Providers ESS: Electronic Switching System ESVN: Executive Secure Voice Network ETS: Electronic Tandem Switching EWS: Early Warning System FAC: Feature Access Code FAM: File Access Manager FCC: Federal Communications Commission FCO: Field Change Order FDDI: Fiber Distributed Data Interface FDM: Frequency Division Multiplexing FDP: Field Development Program FEP: Front-End Processor FEV: Far End Voice FIFO: First In First Out FIPS: Federal Information Procedure Standard FM: Frequency Modulation FMAP: Field Manufacturing Automated Process FMIC: Field Manufacturing Information Center FOA: First Office Application FOIMS: Field Office Information Management System FPB: Fast Packet Bus FRL: Facilities Restriction Level FRS: Flexible Route Selection FRU: Field Replaceable Unit FS: Field Service FSK: Frequency Shift Keying FT: Field Test FTG: Final Trunk Group FTP: File Transfer Protocol FTPD: File Transfer Protocol Daemon FX: Foreign Exchange GAB: Group Access Bridging GCS: Group Control System GECOS: General Electric Comprehensive Operating System GGP: Gateway-to-Gateway Protocol GOD: Global Out Dial GPS: Global Positioning System GRINDER: Graphical Interactive Network Designer GSA: General Services Administration GSB: General Systems Business GTE: General Telephone HCDS: High Capacity Digital Service HDLC: High Level Data Link Control HLI: High-speed LAN Interconnect HDSC: High-density Signal Carrier HPO: High Performance Option HUTG: High Usage Trunk Group HZ: Hertz IBM: International Business Machines IBN: Integrated Business Network IC: Intercity Carrier IC: InterLATA Carrier IC: Interexchange Carrier ICAN: Individual Circuit Analysis Plan ICH: International Call Handling ICM: Integrated Call Management ICMP: Internet Control Message Protocol ICN: Interconnecting Network ICPOT: Interexchange Carrier-Point of Termination ICUG: International Closed User Group ICVT: Incoming Verification Trunk IDA: Integrated Digital Access IDCI: Interim Defined Central Office Interface IDDD: International Direct Distance Dialing IDLC: Integrated Digital Loop Carrier IDN: Integrated Digital Networks IEC: Interexchange Carrier IMP: Internet Message Processor IMS: Information Management Systems IMS: Integrated Management Systems IMTS: Improved Mobile Telephone Service INAP: Intelligent Network Access Point INS: Information Network System INTT: Incoming No Test Trunks INWATS: Inward Wide Area Telecommunications Service IOC: Interoffice Channel IOC: Input/Output Controller IOCC: International Overseas Completion Center IP: Intermediate Point IP: Internet Protocol IPCF: Inter-Program Communication Facility IPCH: Initial Paging Channel IPCS: Interactive Problem Control System IPL: Initial Program Load IPLI: Internet Private Line Interface IPLS: InterLATA Private Line Services IPSS: International Packet-Switched Service IRC: Internet Relay Chat IRC: International Record Carrier ISC: Inter-Nation Switching Center ISDN: Integrated Services Digital Network ISIS: Investigative Support Information System ISO: International Standards Organization ISSN: Integrated Special Services Network ISU: Integrated Service Unit ISWS: Internal Software Services ITDM: Intelligent Time Division Multiplexer ITI: Interactive Terminal Interface ITS: Interactive Terminal Support ITS: Incompatible Time-Sharing System ITT: International Telephone and Telegraph IVP: Installation Verification Program IX: Interactive Executive IXC: Interexchange Carrier JCL: Job Control Language JES: Job Entry System KP: Key Pulse LAC: Loop Assignment Office LADS: Local Area Data Service LADT: Local Area Data Transport LAM: Lobe Access Module LAN: Local Area Network LAP: Link Access Protocol LAPB: Link Access Protocol Balanced LAPS: Link Access Procedure LASS: Local Area Signalling Service LASS: Local Area Switching Service LAST: Local Area System Transport LAT: Local Area Transport LATA: Local Access Transport Area LAVC: Local Area VAX Cluster LBS: Load Balance System LCDN: Last Call Directory Number LCM: Line Concentrating Module LCN: Logical Channel LD: Long Distance LDEV: Logical Device LDM: Limited Distance Modem LDS: Local Digital Switch LEBC: Low End Business Center LEC: Local Exchange Carrier LEN: Low End Networks LENCL: Line Equipment Number Class LGC: Line Group Controller LH: Local Host LIFO: Last In First Out LIP: Large Internet Protocol LLC: Logical Link Control LM: Line Module LMOS: Loop Maintenance and Operations System LSI: Large Scale Integration LTC: Line Trunk Controller LU: Local Use LVM: Line Verification Module MAC: Media Access Control MAC: Message Authentication MAN: Metropolitan Area Network MAP: Maintenance and Administration Position MAP: Manufacturing Automation Protocol MAT: Multi-Access Trunk MAU: Multistation Access Unit MBU: Manufacturing Business Unit MCA: Micro Channel Architecture MCI: Microwave Communications, Inc. MCP: Master Control Program MCT: Manufacturing Cycle Time MCU: Multi Chip Unit MDR: Message Detail Record MDS: Message Design Systems MDU: Marker Decoder Unit MF: Multi-Frequency MFD: Main Distributing Frame MFR: Mult-Frequency Receivers MFT: Metallic Facility Terminal MHZ: Mega-Hertz MIB: Management Information Base MIC: Management Information Center MIF: Master Item File MIS: Management Information Systems MJU: MultiPoint Junction Unit MLHG: Multiline Hunt Group MLT: Mechanized Loop Testing MNS: Message Network Basis MOP: Maintenance Operation Protocol MP: Multi-Processor MPL: Multischedule Private Line MPPD: Multi-Purpose Peripheral Device MRAA: Meter Reading Access Arrangement MSCP: Mass Storage Control Protocol MSI: Medium Scale Integration MTBF: Mean Time Between Failure MTS: Message Telecommunication Service MTS: Message Telephone Service MTS: Message Transport Service MTS: Mobile Telephone Service MTSO: Mobile Telecommunications Switching Office MTU: Maintenence Termination Unit MUX: Multiplexer MVS: Multiple Virutal Storage MWI: Message Waiting Indicator NAM: Number Assignment Module NAS: Network Application Support NC: Network Channel NCCF: Network Communications Control Facility NCI: Network Channel Interface NCIC: National Crime Information Computer NCP: Network Control Program NCS: Network Computing System NCTE: Network Channel Terminating Equipment NDA: Network Delivery Access NDC: Network Data Collection NDIS: Network Device Interface Specification NDNC: National Data Network Centre NDS: Network Data System NDU: Network Device Utility NEBS: Network Equipment Building System NECA: National Exchange Carriers Association NFS: Network File Sharing NFS: Network File System NFT: Network File Transfer NI: Network Interconnect NI: Network Interface NIC: Network Information Center NIC: Network Interface Card NJE: Network Job Entry NLM: Netware Loadable Modules NLM: Network Loadable Modules NM: Network Module NMR: Normal Mode Rejection NOS: Network Operating System NPA: Numbering Plan Area NPA: Network Performance Analyzer NSF: National Science Foundation NSP: Network Services Protocol NTE: Network Terminal Equipment NUA: Network User Address NUI: Network User Identifier OC: Operator Centralization OCC: Other Common Carrier OD: Out Dial ODA: Office Document Architecture ODDB: Office Dependent Data Base ODI: Open Data Interface OGT: Out-Going Trunk OGVT: Out-Going Verification Trunk OIS: Office Information Systems OLTP: On-Line Transaction Processing ONI: Operator Number Identification OPCR: Operator Actions Program OPM: Outside Plant Module OPM: Outage Performance Monitoring OR: Originating Register OS: Operating System OSI: Open Systems Interconnection OSL: Open System Location OSS: Operator Services System OST: Originating Station Treatment OTC: Operating Telephone Company OTR: Operational Trouble Report OUTWATS: Outward Wide Area Telecommunications Service PABX: Private Automated Branch Exchange PACT: Prefix Access Code Translator PAD: Packet Assembler/Disassembler PADSX: Partially Automated Digital Signal Cross-Connect PAM: Pulse Amplitude Modulation PAX: Private Automatic Exchange PBU: Product Business Unit PBX: Private Branch Exchange PC: Primary Center PCM: Pulse Code Modulation PCP: PC Pursuit PFM: Pulse Frequency Modulation PGA: Pin Grid Array PIN: Personal Identification Number PLA: Programmable Logic Array PLD: Programmable Logic Device PLS: Programmable Logic Sequencer PM: Phase Modulation PM: Peripheral Module PMAC: Peripheral Module Access Controller PMR: Poor Mans Routing PNC: Primenet Node Controller POC: Point of Contact POF: Programmable Operator Facility POP: Point of Presence POS: Point Of Sale POT: Point of Termination POTS: Plain Old Telephone Service PPN: Project Program Number PPP: Point to Point Protocol PPS: Public Packet Switching PPSN: Public Packet Switched Network PSAP: Public Safety Answering Point PSDC: Public Switched Digital Capability PSDCN: Packet-Switched Data Communication Network PSDN: Packet-Switched Data Network PSDS: Public Switched Digital Service PSN: Packet-Switched Network PSS: Packet-Switched Service PSW: Program Status Word PTE: Packet Transport Equipment PTS: Position and Trunk Scanner PTT: Postal Telephone & Telegraph PVC: Permanent Virtual Call PVN: Private Virtual Network PWC: Primary Wiring Center QPSK: Quadrature Phase-Shift Keying RACF: Resource Access Control Facility RAO: Revenue Accounting Office RARP: Reverse Address Resolution Protocol RBG: Realtime Business Group RBOC: Regional Bell Operating Company RC: Rate Center RC: Regional Center RDB: Relational Database RDSN: Region Digital Switched Network RDT: Restricted Data Transmissions RDT: Remote Digital Terminal REP: Reperatory Dialing REXX: Restructured Extended Executer Language RFC: Request For Comments RIP: Routing Information Protocol RIS: Remote Installation Service RISC: Reduced Instruction Set Computer RISD: Reference Information Systems Development RJE: Remote Job Entry RLCM: Remote Line Concentrating Module RNOC: Regional Network Operations Center ROTL: Remote Office Test Line RPC: Remote Procedure Call RPE: Remote Peripheral Equipment RSA: Reference System Architecture RSB: Repair Service Bureau RSC: Remote Switching Center RSCS: Remote Spooling Communications Subsystem RSS: Remote Switching System RSU: Remote Switching Unit RTA: Remote Trunk Arrangement RTG: Routing Generator R/W: Read/Write RX: Remote Exchange SA: Storage Array SABB: Storage Array Building Block SAM: Secure Access Multiport SARTS: Switched Access Remote Test System SAS: Switched Access Services SAS: Single Attachment System SBB: System Building Block SABM: Set Asynchronous Balanced Mode SAC: Special Area Code SBS: Satellite Business Systems SC: Sectional Center SCC: Specialized Common Carrier SCC: Switching Control Center SCCP: Signaling Connection Control Part SCCS: Switching Control Center System SCF: Selective Call Forwarding SCF: Supervision Control Frequency SCM: Station Class Mark SCM: Subscriber Carrier Module SCP: Signal Conversion Point SCP: System Control Program SCP: Service Control Point SCR: Selective Call Rejection SDLC: Synchronous Data Link Control SF: Single-Frequency SFE: Secure Front End SIDH: System Identification Home SIT: Special Information Tones SLIC: Subscriber Line Interface Card SLIM: Subscriber Line Interface Module SLIP: Serial Line Internet Protocol SLS: Storage Library System SLU: Serial Line Unit SM: System Manager SMDI: Storage Module Disk Interconnect SMDR: Station Manager Detail Recording SMI: System Management Interrupt SMP: Symmetrical Multi-Processing SMS: Self-Maintenance Services SMS: Station Management System SMTP: Simple Mail Transfer Protocol SNA: Systems Network Architecture SNMP: Simple Network Management Protocol SONDS: Small Office Network Data System SOST: Special Operator Service Treatment SP: Service Processor SPC: Stored Program Control SPCS: Stored Program Control System SPCSS: Stored Program Control Switching System SPM: Software Performance Montior SQL/DS: Structured Query Language/Data System SRC: System Resource Center SS: Signaling System SSAS: Station Signaling and Announcement System SSCP: Systems Service Control Point SSCP: Subsystem Services Control Point SSP: Switching Service Points SSS: Strowger Switching System ST: Start STC: Service Termination Charge STD: Subscriber Trunk Dialing STP: Signal Transfer Point STS: Synchronous Transport Signal SVC: Switched Virtual Call SWG: Sub Working Group SxS: Step-by-Step Switching T-1: Terrestrial Digital Service TAC: Trunk Access Code TAC: Terminal Access Circuit TAC: Terminal Access Center TAS: Telephone Answering Service TASI: Time Assignment Speech Interpolation TBU: Terminals Business Unit TC: Toll Center TCAP: Transaction Capabilities ApplicationPart TCC: Technical Consulting Center TCC: Telecommunications Control Computer TCF: Transparent Connect Facility TCM: Time Compression Multiplexing TCP: Transmission Control Protocol TDAS: Traffic Data Administration System TDCC: Transport Data Coordinating Committee TDM: Time Division Multiplexer TDMS: Terminal Data Management System TDS: Terrestrial Digital Service TH: Trouble History TIDE: Traffic Information Distributor & Editor TIS: Technical Information Systems TLB: TransLAN Bridge TM: Trunk Module TMSCP: Tape Mass Storage Control Protocol TNDS: Total Network Data System TNPS: Traffic Network Planning Center TO: Toll Office TOP: Technical Office Protocol TOPS: Traffic Operator Position System TP: Transport Protocol TP: Toll Point TP: Transaction Processing TPC: Transaction Processiong Performance Council TREAT: Trouble Report Evaluation and Analysis Tool TRIB: Throughput Rate in Information Bits TRT: Tropical Radio and Telephone TSB: Time Shared Basic Environment TSG: Timing Signal Generator TSN: Terminal Switching Network TSO: Time Sharing Option TSPS: Traffice Service Position System TTL: Transistor-to-Transistor Logic TTS: Trunk Time Switch TWX: Type Writer Exchange UA: Unnumbered Acknowledgement UAE: Unrecoverable Application Error UART: Universal Asynchronous Receiver Transmitter UCS: Uniform Communication Standard UDC: Universal Digital Channel UDP: User Datagram Protocol UDVM: Universal Data Voice Multiplexer UID: User Identifier UPC: Utility Port Conditioner USC: Usage Surcharge USDN: United States Digital Network USTS: United States Transmission Systems UUCP: Unix to Unix Copy Program VAN: Value Added Networks VAX: Virtual Address Extention VCPI: Virtual Control Program Interface VDU: Visual Display Unit VF: Voice Frequency VFU: Vertical Forms Unit VFY: Verify VIA: Vax Information Architecture VLM: Virtual Loadable Module VLSI: Very Large Scale Integration VMB: Voice Mail Box VMCF: Virtual Machine Communications Facility VMS: Virtual Memory System VMS: Voice Mail System VM/SP: Virtual Machine/System Product VPA: VAX Performance Advisor VPS: Voice Processing System VSAM: Virtual Storage Access Method VSE: Virtual Storage Extended VTAM: Virtual Telecommunications Access Method VTOC: Volume Table Of Contents VUIT: Visual User Interface Tool VUP: Vax Unit of Processsing WAN: Wide Area Network WATS: Wide Area Telecommunications System WATS: Wide Area Telephone Service WC: Wiring Center WCPC: Wire Center Planning Center WDCS: Wideband Digital Cross-Connect System WDM: Wavelength Division MultiPlexing WES: Western Electronics Switching WUI: Western Union International XB: Crossbar Switching XBAR: Crossbar Switching XBT: Crossbar Tandem XNS Xerox Network Systems XSV Transfer Cost System Value XTC Extended Test Controller CONCLUSION ========== ---------- Last words ========== Well, i sincerely hope that this file was of some use to you, and i would encourage you to distribute it as far as you can. If you enjoyed it, hated it, have suggestions, or whatever, feel free to email me at my Internet address(my only permanent one for now) or at a BBS, if you can find me. Have phun... - Deicide - Recommended Reading =================== Neuromancer, Mona Lisa Overdrive, Count Zero and all the rest, by William Gibson The Hacker Crackdown, by Bruce Sterling Cyberpunk, by Katie Hafner and John Markoff The Cuckoo's Egg, by Cliff Stoll 2600: The best h/p printed zine. $21 in American funds, U.S. & Canada. 2600 Subscription Dept., P.O. Box 752, Middle Island NY 11953-0752 Office: 516-751-2600 Fax: 516-751-2608 The issues of CUD, cDc, & Phrack electronic newsletters, and the LOD/H TJs, all of which can be found on the Internet and any good h/p oriented BBS. BBSes ===== Although most boards have a lifespan equivalent to that of a fruitfly, I finally have a list which is somewhat stable.. getting on them is your problem.. just be yourself and be willing to learn. - Unphamiliar Territories - Demon Roach Underground - Temple of the Screaming Electron - Burn This Flag - Dark Side of the Moon and Phrozen Realm if it returns.. References ========== All the material used in this publication is original unless specifically stated otherwise. However, i'd like to thank Phrack and the LOD/H for their textfiles which gave me a valuable push in the right direction.. And of course all the great h/p folks who have helped me along the way.. And finally =========== Thanks to the EFF, for their continued support of all of the world's rights in this technological era. Thanks to all the folks running the FreeNets who continue to support the right to free access to information in this world of cynicism. Thanks to cDc, for not selling out after all these years... Musical inspirations: Primus, Rage Against the Machine, Jimi Hendrix, Led Zeppelin, Dead Kennedys, White Zombie, the Beastie Boys, etc, etc. "Yes I know my enemies. They're the teachers who taught me to fight me. Compromise, conformity, assimilation, submission, ignorance, hypocrisy, brutality, the elite" - /Know Your Enemy/ (c) Rage Against the Machine - Deicide - deicide@west.darkside.com DISCLAIMER ========== This file was provided for informational purposes only. The author assumes no responsibilities for any individual's actions after reading this file.