The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / phrack2 / phrack41.006 < prev next >

Wrap

Text File | 2003-06-11 | 19.5 KB | 407 lines

==Phrack Inc.== Volume Four, Issue Forty-One, File 6 of 13 A Brief Guide to Definity G Series Systems a.k.a System 75 - 85 Written by Scott Simpson Greets to Jim Anderson, The Missing Link, Randy Hacker, Dark Druid, Nickodemus, Mercury, Renegade, Infinity (enjoy the army!), Weirdo, TomCat, GarbageHeap, Phrack Inc. Basic History ~~~~~~~~~~~~~ Definity model systems came into existent in the later part of the 1970s. In 1983, AT&T came out with a revised model called 75. This system was built to hold more incoming lines and did not have as many errors as the earlier version did. The 1983 version was replaced with a version re-written in 1986. Today, the systems are referred to as G models. System 75 is now called G1 and 85 is called G2. A new model is currently available and is called the Definity G3I which is Generic 3 with an Intel chip, and Definity G3R which is Generic 3 with a Risk chip. There are 3 different versions to each model. Version one is the most common and it is an XE Single Carrier Unit. The other two systems are 2 carriers. A system will usually cost somewhere around 50 to 80 thousand dollars. You MIGHT come across a smaller version and it is called "Merlin Legend." This system will hold about 50-100 lines. System 75 & 85 will hold around 1000 lines. System 75/85 are used by companies to house all of their incoming lines, as well as to send their incoming lines to destinations set up by the owners, whether it be Audix or any other setup. There are many uses for the system besides VMBs and PBXes. System 75/85 has three main functions that hackers are interested in. They are the capabilities of VMB, bridging, and of course PBX exchanges. Discovering the System ~~~~~~~~~~~~~~~~~~~~~~ When you find a System 75, you will make a 1200/NONE connection (if HST used), as most setups have a built in 1200 baud modem. Normally, the controller number will not be in the same prefix as the business or the PBX and the line is actually owned by AT&T. Try CNAing a System 75 line and it will tell you that it is owned by AT&T. Once you find a carrier, you will need to be able to display ANSI or some equivalent type of terminal graphics. Most are set to N81, but some may be E71. My suggestion is to use ToneLoc which is produced by Mucho Maas and Minor Threat. As you know, this program will scan for carriers as well as tones. This program can be found on just about every ELEET H/P BBS. Getting into the System ~~~~~~~~~~~~~~~~~~~~~~~ Getting into the system is the easy part if you have the defaults. You must find them on your own and you will find out that a lot of people are not willing to trade for them. There is one default that will enable you to snoop around and tell whether or not they have a PBX, provided that they have not changed the password or restricted the account. This one default is usually a fully operational account without the privileges of altering any data but I have come across a couple of systems where it wouldn't do anything. Using this default account is a good way to start if you can find it. It is also good to use any time you call and don't plan on changing anything. All actions by this account are not kept in the system history file. Now on to the good stuff!! Abusing System 75 ~~~~~~~~~~~~~~~~~ After logging into a 75, there are several commands available depending on the default you are using. This part will be for the basics. I will explain more later for the more advanced people. When you log in, you will have the commands LIST, DISPLAY, and a couple others that don't matter. These are the only ones that you will need with the aforementioned default. First type "DIS REM" (display remote access). If there is a PBX set up on the system, it will be shown on the extension line. The barrier code is the code to the PBX. If "none" appears, there is no code and it's just 9+1. The extension line can either be 3 or 4 digits. Usually, if it's 3 digits, it is run off of AUDIX (AUDio Information eXchange) or they are smart and are hiding the one digit! Look at the dialplan and see if the extensions are 3 or 4 digits. If it tells you that the extensions are three digits, chances are that it is somewhere in the AUDIX system. If it's run off of an AUDIX, look through all of the extensions by either list or display 'extensions' until you find one that says something like "remote extension" or something that looks different. If the one digit is hidden, use ToneLoc and scan for the digit needed. Next, display the trunk groups. This will tell you the actual dial-up. If you don't find it here, don't panic. As you go through the trunk groups, also look at the incoming destination as well as the night destination. If any of these show the remote extension here, there is your PBX. If not, keep looking through all of the trunk groups. Write down all of the phone numbers it gives you and try them. They can usually be found on page three or so. A LOT of the time, places call forward a back line or so to the actual PBX. If there is no remote access extension when you display the remote access, you are shit out of luck unless you have a higher default and read the rest of this text. Setting Up Your Own PBX ~~~~~~~~~~~~~~~~~~~~~~~ If you have a higher default, you will notice that if you type help, you have more commands that are available to you, such as change, download, etc. Remember, the company can change the privileges of the defaults so if you cannot see these commands, use another default. The first thing you want to do is to display the dialplan. This will tell you the amount of digits and the first digit of all of the sequences. Here is an example of a dialplan. There are several ways the dialplan may look. Number of Digits -------1----2----3----4----5----6----7----8----9 -- F 1 I 2 Tac R 3 S 4 Fac T 5 6 Extension D 7 Extension I 8 Tac G 9 I 0 Attendant T * # Using the above chart, all extensions will start with either a 6 or 7 and will be four digits long. The Tac is two digits, and will start with a 2 or an 8. Don't worry about FAC or any others at this time. After you make note of this, type "ch rem" (change remote access), go to the extension line, and put in an extension. Next, find the trunk group that you want to use and type "ch tru #". Go to the line for night service and put the extension in there. If there is already an extension for night service on all of the trunks, don't worry. If not, add it, and then save it. If it says invalid extension, you misread the dialplan. If you pick an extension already in use, it will tell you so when you try to install it in the remote extension line in the remote address. Once all of this is completed, you may go back to the remote access and add a code if you like, or you may just enter "none" and that will be accepted. THE NEXT PART IS VERY IMPORTANT! Look at the trunk that you installed and write down the COR number. Cancel that command and type "dis cor #". Make sure that the Facilities Restriction Level (FRL) at the top is set to 7 (7 is the least restricted level & 0 is the most) and that under calling party restrictions & called party restrictions, the word "none" (lower case) is there! If they are not, type "ch cor #" and make the changes. Last, type "dis feature". This will display the feature access codes for the system. There will be a line that says something like "SMDR Access Code." This will be the code that you enter after the barrier code if there is one. I have seen some be like *6, etc. Also, there will be, on page 2 I believe, something to the like of outside call. usually it is set to 9 but check to be sure. That's about it for this segment. All should be fine at this point. For those that want a 24 hour PBX, this next section is for you. For those of you that are greedy, and want a 24 hour PBX, most of the steps above are the same. The only difference is that you will look through all of the trunks until you come across one that has several incoming rotary lines in it. Simply write down the port number and the phone number for future reference and delete it by using the "ch" command. From the main prompt, type "add tru #". For the TAC, enter a correct TAC number. Keep going until you get to the COR. Enter a valid one and remember that the FRL should be set to 7, etc. Keep going...the next line that is vacant and needs something is the incoming destination. Set it to the remote extension that you have created. The next vacant line I think is type (towards the middle of the page). Enter ground and it should print out "ground-start." If there is a mistake, it will not save and it will send you to the line that needs to have something on it. After all is done, it will save. After this segment, there is a copy of a trunk and what it should look like for the use of a PBX. Next, go to page 3 and enter the port and phone number that you wrote down earlier. Save all of the changes that you have made. This should be all you need. One more way! If you scan through all of the extensions on the system, you may find an "open" extension. This extension may be like the phone outside in the waiting room or an empty office or whatever. This extension must be a valid phone number on their network or must be reachable on their AUDIX for this method to work. If you know how to add ports to Audix, this method will be best for you since setting up a trunk is not needed. If you find something like this, it's usually better to use this as your 24 hour PBX rather than taking away a line for several reasons: 1) there are less changes that you must make so there will be less data saved in the history file; 2) other people that have legal uses for the line won't trip out when they get a dial tone; and 3) the company will not notice for some time that they've lost an extension that is hardly used! To set it up this way, you must delete the old info on that extension by typing "remove extension #". It will then show you the station in detail. Save it at that point and it will be deleted. Next go to the remote access and enter the extension that you deleted on the remote extension line. Next enter a barrier code or "none" if you don't want one. Save it! Doing it this way USUALLY does not require a new trunk to be added since the port is already in the system but if you run into problems, go back and add it through the use of a trunk. You will still have to assign it a "cor" in the remote access menu, and remember to make sure that the FRL and the restrictions are set correctly as stated as above. In part 2, if there is a demand, I will tell how to make a bridge off of a 75. It is a lot more difficult, and requires a lot more reading of the manuals. If anyone can obtain the manuals, I would strongly urge them to do so. Also potentially in part 2, I will show how to create a VMB. If they have AUDIX voice mail, chances are they have a 75! So happy hunting and see ya soon! If you need to get a hold of me to ask a question, you may catch me on the nets or on IRC. Enjoy! Scott Simpson ------------------------------------------------------------------------------- APPENDIX A : Example of a Trunk For PBXs Trunk Group Page 1 of 5 ----------- Group Number # Group Type: co Smdr Reports: n Group name: Whatever ya want Cor: # Tac: # Mis Measured? n Dial access: y Busy Threshold: 60 Night Service: What will answer after hours Queue length: 0 Abandoned call Search: n Incoming Dest: What will answer any time the # is called unless NS has an extension. Comm Type: voice Auth Code: n Digit Absorption List: Prefix-1? n Restriction: code Allowed Calls List: n Trunk-Type: Ground-start Outgoing Dial type: tone Trunk Termination: whatever it is Disconnect Timing: Whatever it is to. set to. ACA Assignments: n [Page 2 is not all that important. It's usually used for all of the [maintenance to the trunk etc. so leave it all set to its default setting.] page 3 of 5 Port Name Mode Type Answer delay 1 Port number phone number 2 3 etc. That's all that is needed for the trunks. ------------------------------------------------------------------------------- APPENDIX B : Basic Commands and Terms Basic Terminology ----------------- COR - Class Of Restriction FRL - Facilities Restriction Level SMDR - Station Message Detail Recording TAC - Trunk Access Code FAC - Feature Access Code Basic Commands for Default Emulation (513) ------------------------------------------ Esc Ow - Cancel Esc [U - Next Page Esc SB - Save Esc Om - Help Commands for 4410 ----------------- Esc Op - Cancel Esc Ot - Help Esc Ov - Next Page Esc Ow - Back Page Esc OR - Save Esc Oq - Refresh Esc Os - Clear Fields Below is an explanation of all of the commands. The following is a captured buffer of a login to System 75. I have captured the commands and have edited the buffer to include brief definitions of the commands. Display and list are basically the same command, but display shows more detailed information on the command that you select. For example, "list tru" will list all of the trunk groups in the system. "dis tru" will ask for a trunk number, and then display all of the information on that trunk. CH Help Please enter one of the following action command words: add duplicate save change list set clear monitor status display remove Or enter 'logoff' to logoff the system Add - Is pretty self-explanatory Change - Is also self-explanatory Clear - will clear out the segment Duplicate - will duplicate the process List - self-explanatory Monitor - used for testing, and monitoring the system Remove - remove anything from the system EXCEPT the History File! Sorry guys! Save - saves work done Set - sets the time, etc. Status - shows current status of the system List Help Please enter one of the following object command words: COMMANDS UNDER "LIST" abbreviated-dialing groups-of-extension personal-CO-line aca-parameters hunt-group pickup-group bridged-extensions intercom-group station configuration measurements term-ext-group coverage modem-pool trunk-group data-module performance Or press CANCEL to cancel the command Abbreviated-Dialing: Speed calling feature from their voice terminal Aca-parameters: Automatic-Circuit-Assurance Bridged Extensions: Used for bridging extensions together Configuration: Overall system Configuration Coverage: Call Coverage Data-module: Description of the data module used Groups Of Extensions: Lists all of the extensions available Hunt-Group: Checks for active or idle status of extension numbers Intercom-group: Lists the intercoms and their info Modem-Pool: Allows switched connects between data modules and analog data Performance: Shows the performance of the system Personal-CO-line: Is for dedicated trunks to or from public terminals Pickup-group: Pickup station setup Station: Will list all of the available stations assigned Term-ext-group: For terminating extension group Trunk-Group: Lists ALL of the trunks; will NOT show all details like Display Dis Help Please enter one of the following object command words: Commands Under 'Display' abbreviated-dialing data-module personal-CO-line alarms dialplan pickup-group allowed-calls digit-absorption port announcements ds1 psc attendant errors remote-access button-location-aca feature-access-codes route-pattern circuit-packs hunt-group station code-restriction intercom-group synchronization communication-interface ixc-codes system-parameters console-parameters listed-directory-numbers term-ext-group cor modem-pool time cos paging trunk-group coverage permissions Or press CANCEL to cancel the command Abbreviated Dialing: Covered above, but shows more information Alarms: Will show information on the alarms (which ones are on/off) Allowed-Calls: Will show LD carrier codes and allowed call list Announcements: Attendant: Allows attendant to access trunks without voice terminals Button-location-aca: Will show the location of the aca selected circuit-packs: Tells types of lines used. Code-Restriction: Shows restrictions for HNPA and FNPA Communication-Interface: Information on the communication interface Console-Parameters: Will list the parameters of the console, etc. Cor: Class Of Restriction (will show the cor for the # entered) Cos: Class Of Service Coverage: Shows the coverage of the system (voice terminals, etc.) Data-Module: Will show information for the data channels entered Dialplan: List the current config for extensions etc. Digit-absorption: Ds1: Used for tie-trunk services Errors: Shows all of the errors on the system Feature-Access_Codes: Lists all of the feature access codes for all of the features on the entire system Hunt-Group: As above, but will tell more information for the # you enter Intercom Group: Lists all of the names and their intercom assignments IXC-Codes: Inter-eXchange Carrier codes Listed-Directory: Lists the numbers in the directory of the system Modem-Pool: Will show info on the channel you select (exp baud, parity, etc.) Paging: Used for the paging stations on the voice terminals Permissions: Will show the privileges of the other accounts/defaults Personal-CO-Line: As above but more descriptive Pickup-Group: Shows names and extensions in the specified group number Port: Will show the info on the port you ask about PSC: Keeps a call between to data points connected while the system is active Remote-Access: Will show the Remote Access that is there (if any) Route-Pattern: The pattern of routing within the voice terminals, etc. Station: Will show detailed information on the station # you enter Synchronization: Will show the location of the DS1 packs System-Parameters: List of all of the available systems parameters Term-Ext-Group: As above but more descriptive Time: Will show the current time and date Trunk-Group: Will show all available information for the trunk you select _______________________________________________________________________________ ^L