The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / lod5_09.txt < prev next >

Wrap

Text File | 2003-06-11 | 11.4 KB | 192 lines

The LOD Technical Journal: File #9 of 12 Hacking GANDALF XMUX'S ----------------------- Written by: Deicide on 03/29/93 =========================== *NOTE: While writing this file I assumed that the reader has a working knowledge of PSNs. ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| The Gandalf XMUX is made by Gandalf Technologies Incorporated. It is one of two popular systems Gandalf makes, the other being the Starmaster/PACX. These systems are very closely knit, as you'll see later, but the focus of this g-file is on the XMUX system. I still don't have a XMUX manual, so this file will be a bit incomplete, but it will give you a good sense of the system; How to Identify it, How to Penetrate it, and How to Use it. There are a number of security flaws in the XMUX, all of which can be circumvented but frequently are not. Occasionally you will find an unpassworded console, in that case just move on to the How to Use it section. The Gandalf systems are very frequently found on all the major PSNs, as Gandalf's themselves often serve as network controllers. Most of the major companies, such as Xerox & Bell Canada, use XMUXs, so it is a good idea to become familiar with the system. How To Find Your XMUX & How To Identify It ------------------------------------------ First of all, if you find an unpassworded XMUX it will tell you by the herald "Gandalf XMUX Primary Console Menu" followed by the menu itself. Skip this part for now. But for the rest of you, you probably still need to find your XMUX, and you need to know how to identify it. Before we get further into this, a small amount of knowledge of the whole scope of the XMUX is needed. Every XMUX is made up of at least 4 parts, each present on every single XMUX. These parts are called: - Console - Fox - Logger - Machine The Console is the actual system, the part that has to be hacked, the part that contains the information we are attempting to retrieve. The Fox is a test machine, serving no other purpose except to spout "THE QUICK BROWN FOX JUMPS OVER THE LAZY DOG 1234567890 DE" over and over again. The Logger is displays a line or two of information such as the time & the LCN called, for the most part unimportant. But it does contain the node name. The Machine is basically a system information giver. I have yet to discover all of it's commands, but S gives some systems stats (including the node name) and L is an optional command that supplies the user with a system log (which contains link addresses & UID's). All of these can be useful in some way. The XMUX can be found in a number of ways: - On a standard NUA(XXXX XXXX) - On a standard NUA + extension(XXXX XXXX,XXXXXXXX) - On extensions off of Starmasters & PACXs.(XXXX XXXX,XXXXXXXX) - On LCN's (subaddressing) off any other type of system/OS. ??????????????????????????????????????????????????????????????????????????? NOTE:"Password >" is the password prompt for the XMUX Console, occasionally proceeded by an operator definable system message such as "Vancouver XMUX". To be sure that this is a XMUX prompt, hit <ENTER>. If it returns the message "Invalid Name Names must consist of 1 to 8 alphanumeric characters" Then you are dealing with the XMUX Console. ??????????????????????????????????????????????????????????????????????????? On a standard NUA it will bring you right to the "Password >" prompt, no hassles. You can then proceed to the section that deals with hacking the console. On a standard NUA + extention, it is not so easy. When you first hit the NUA, it will give you the "Remote Directive" error message, telling you that you "forgot" the extention. Now, the error message could mean you forgot the extention for a VAX, also, but we will assume that it is a XMUX on the NUA. This is true only a fraction of the time, but try this on every Remote Directive message, you'll find a good share of XMUX's. First of all, try the LCN (subaddress) of 1 on the NUA. If you come up with the Fox segment of the XMUX (explained earlier) then you have an XMUX Console on the NUA, it's just hiding. If the LCN brings up the Remote Directive message again, then try the extention of LOGGER on the NUA. If it brings up the XMUX Logger, then again, the XMUX Console is there, but with a bit of security added on. If you now know that you are on an XMUX, try the CONSOLE extention. It should bring you to the "Password >" prompt, or occasionally right inside without needing a password. Starmaster's and PACX's almost always have an XMUX attached on to it. Use the Starmaster or PACX's NUA + the extention CONSOLE. It will most likely bring you to the "Password >" prompt. If it doesn't work, try LCN's. If that fails, try "XMUX" or "XCON" from the Starmaster/PACX service prompt. The LCN's off all the other system/OS types is a bit more complicated. You can either guess, pick the likely ones, or try them all. What this is is an XMUX in coexistance with another type of system, such as AOS/VS. The most common way to find these is by adding an LCN of 1 to the NUA of the system. If it comes up with the XMUX FOX section, then you can be sure an XMUX is present. To find the XMUX Console, use LCN's of 4 and above(2 & 3 being Logger and Machine), up to the LCN of 15(maximum on XMUX). If you still haven't found the Console, and it's returning the Remote Directive error message, now's the time to use the CONSOLE extention. In most cases it'll bring up the "Password >" prompt, or right into the Console Menu. HOW TO PENETRATE THE XMUX CONSOLE "PASSWORD >" PROMPT ----------------------------------------------------- To start you off, XMUX Console Passwords MUST be within 1 to 8 alphanumeric characters. Any combination within that boundary is an acceptable password. Now, while it is true that the password could be a random letter/number combination, such as G2Z7SWJ8, and therefore extremely impractical to hack, it is almost a given that the password is a relevant word or abbreviation, with not more than one numeric character, which is usually not even included. Also, you get 4 attempts at a password before being logged off, and remember, you don't even need to find a username. When you first reach the "Password >" prompt it's a good idea to try the defaults(in order of occurance): - Gandalf - Xmux - Console - System Also, Password (no, really), Network, CPU, Switch & Network are also frequently found. Then, if the defaults don't work, it's time for a little calculated brute forcing. If the system has a herald, such as "BenDover Field Communications" then try everything you possible can thing of that is relevant to the herald, such as Bendover, Ben, Dover, BDFC, Field, Telecom, etc. Also, combine these with the defaults, particularly Xmux. As in BenXMUX, or FieldMux, etc. If there is no herald, or all the thing you can think of to do with the herald fail as passwords, then it is time to get the node name. The node name is used very frequently as a password, thus a good thing to try. But where to get the node name with out getting the password first? It is contained in two other places other than the Console, with ALWAYS at least one of the facilities open to you. The Logger (LCN 2, or extention LOGGER) always spurts out the log name first upon connect. This is always available, I have only seen one case in which the Logger information was protected, and that was achieved by wiping it out, which very few administrator's do. The other source is the Machine (LCN 3, or extention MACHINE), a very handy source of information. You will recognize the Machine by its "#" prompt. At this prompt type "S" for system stats. The first thing you see in the system stats is the Node Name. Also, with machines type "L". Occasionally it will be set to show the log, which contains the Link Addresses (usually other netted computers, frequently Gandalfs) and UID's as well. Try the Node Name by itself as a password, then in combination with all the above, such as a combo of Default & Node Name. If you follow all these above methods, 50% of the time you will find the password. If you don't get the password, don't worry, there are many more XMUX's out there with poor security, go for those. But before you move on, try the LCN's from 4-15, frequently you'll find another system, often a private PAD or an outdial. WHAT TO DO WITH THE XMUX CONSOLE ONCE INSIDE -------------------------------------------- For those itching to read other people's mail, or retrieve confidential files, etc, you will be very disappointed. Although once inside the XMUX Console you have virtual Superuser status, the commands are all maintenance related. But, often you will find other systems, quite often networks, PADs, & outdials from inside. You will first encounter the primary menu, which looks similar to this: Gandalf XMUX (date) Rev(version) Primary Console Menu (time) Node:(nodename) Primary Menu: 1. Define 2. Display 3. Maintenance 4. Supervise 5. Exit Primary selection > Now, although there are some other useful and interesting features to the XMUX console, I will only show you the 3 most useful features, those being Abbreviated Command, Service & Call Status. Abbreviated Command is an option found in the Define sub-menu. Hit 7 once inside the Define sub-menu to bring up the Abbreviated Command prompt. Type a ? to show all the abbreviated commands. If there are none, curse your luck and move on to the next feature. If there are some, type them in, one at a time. Each Abbreviated command is really a macro, and a macro of a NUA plus the subaddressing and data character extension needed to enter the system. These can be very useful, not only for the NUA & subaddress, but for the fact that the extension is included. Most times extensions are hard if not impossible to guess, and the macro throws it right in your face. The Abbreviated Command is in the format of XXXXXXXXdEXTENSION, in that the X's are where the NUA is placed, the EXTENSION is the extension characters, and the 'd' is really where the comma goes to separate the two. So if the Abbreviated Command was 55500123dabc, the NUA would actually be - 55500123,abc - Service is a menu option also from the Define sub-menu. What it enables you to do is view all the services available, plus their function & LCN. Type "11" from the define menu, then "?" for a list of the services available. Console, Fox, Logger & Machine will always be present. Anything else is a bonus, and should be capitalized upon. For example, if you see "Modem" as one of the services, then enter "Modem" from the Service sub-sub- menu to see which LCN the modem is on. Display Call Status is a handy command used from the Display sub-menu which gives a log of all the calls the system has handled. In the call log are the NUA's of the system that called, often a netted system such as another Gandalf. ---------------------------------------------------------------------------