textfiles/phreak/ucn0017.txt

[ Notice : Typed On 02/15/92 Before Distribution ]

   Hello, everyone!  If anyone remembers me, yes, I am Hackmaster, the ex-
leader of Phreak Out!, The Midnight Society, and The Underground Crime 
Network.  Unfortunately, I was busted in early 1991, and am unable to 
continue UCN.  As I was going through old files, I found this : One of our 
member-only files.  I don't think I had finished it, but I'm sure it can help
you guys out, since it is a very big text file on VMB hacking.  I would finsh
it, but times have changed, and I dont remember much about that anymore.
Looking through, I'm not close to finishing. 
   Now for the good news.  I AM still out here, and will help you as much as I
can.  If you need to contact me, call one GREGDoor BBS @ (708) 904-2149.  If 
it's down for some reason, try these boards.

I dont check these as often, but I do check them.  Later, and good luck!
BTW, If I find more files, I'll shoot them out.  I still do 'other stuff'.

IF YOU NEED HELP OR INFORMATION, DON'T HESITATE TO ASK!

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  UCN Member Only File # 017 : Most Complete VMB Hacking Guide Ever Published
  By : Hackmaster  -  Thank you for supporting the Underground Crime Network
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

   Hi!  What's up?  This is Hackmaster, the leader, bringing you another
member only file.  I noticed upon looking at about 10-15 articles I could find
on VMB hacking that NONE of them were complete enough to be helpful at all.
In this guide, I will tell you how to identify a system, and how to get into
that particular system.  Dont forget (as with all member files) the
information within is for members only.  Do not give this file or the
information in this file to any non-member, or you could be expelled from UCN.

AVR - Known for it's "Message Center", it is usually mistakenly called a
message center system.  During the greeting, you can hit "*", and it will say
"Hello, (name), Please enter your passcode".  If you hit "*" again, and a
lockout is not active, it will either say "Welcome to the message center", or
the system administrator will have put a personal message that says something
like "Please enter the 4 digit extension you wish to reach"  This system is a
great system, since it is hard to narc on, considering these systems rearely
have an operator, and are often very hard to narc on.  A lot of times, you
will find a box with all 9's on the system, but the system administrator box
ends with an "8".  As an example, a 3 digit system would be "998", and a 4
digit system would be "9998".  If you happen to stumble into the system
administrators box, hit "8" for User Options, then "8", and it should take you
into the system administrator menu.  A default box on many of these systems is
"1111", which (when there), will usually be empty.  This system usually has 4
digit box numbers, but also semi-frequently has 3 digit, and 7/10 digit (phone
numbers) box numbers.  If you find a direct dial system of this type, most
of the time hitting "*" after it asks for your passcode, it will not do
anything, taking the "*" as a digit of the passcode.  That is because the
system is "locked out", preventing you from accessing the message center.. If
you want to find an empty box, you must hang up, and call 1 up or down from
that number, and keep doing so until you have found one.  On direct dial
systems, if you have an invalid number, but the number you dialed is still
with in the range allocated for the AVR system, it will say something in
it's computerized voice.  Depending on what the administrator picks, it will
be "The number you have dialed is not in service.  Please try your call
again", "Please try your call again", or "Call again".  When you get this
recording, it is a standard error recording, and you will not be billed for it
on toll calls, and the sys admin will not be billed for the call on 800 calls.

(-*-) Name              :  AVR  -  aka Message Center
(-*-) Example System    :  3 digit - 800-950-4826
(-*-) Default Passcodes :  User set - 1111,1212,1234,5555,9999,NONE,BOX,2580*
(-*-) SysAdmin Box      :  Usually all 9's + 8  (Eg. 998 or 9998)
(-*-) SysAdmin Default  :  * 2580 is a system administrator default passcode.
(-*-) Other Features    :  Pager Service (but rarely)
(-*-) Notes             :  The AVR system has a replacement message center
                           welcome greeting for another company which says
                           something like "Welcome to the Voice-Tel MC."


VIX - The VIX system is basically a terrible system, but is fairly common and
easy to get into.  On a standard system such as the one below, upon calling if
you hit "*" it will say "Thank you for calling." and hang up on you.  This is
because the "*" in a VIX system is for aborting or returning to previous menu.
In the original main menu, if you try to go back a menu, you are, of course,
disconnecting the call.  If you hit "#", it will say "Please enter your
mailbox number".  You then enter a mailbox # which is usually 3 digits, but
can sometimes be 2 or 4, then it states "Please enter your passcode."  There
is only one default passcode for this system, which is all 0's, and it will
instantly stop you upon entering the correct number of digits for the
passcode, which is always 3 or 4, depending on how the system is configured.
The system administrator box is usually all "9's", but can be any box.  To
access options inside this, you must use "3" for personal options, or "4" for
administrator options (only if you have the administrative box).  Please
note : The administrator box will allow you to change a mail box name, or the
greeting you hear when you first call, menu prompts, etc, but will not let you
create mailboxes.  Also, most of these systems will transfer you before giving
you the voice mail service.  On some systems, you can simply hit a key before
the mailbox number.  For example to access mailbox 314 from one system, you
may hit "7+314" or "9+314" when first calling.  Most systems do not have this,
but there is a gateway, however.  You must hit "#" and it will ask for your
mailbox number.  You then enter the correct one, and it will say "Please enter
the mailbox number of the person you want to leave a message to."  This
mailbox is usually all 5's, but I have seen "100", "055", and some that I
never was able to find.  Usually, mailboxes on these systems will start at 200
or 300, but can be anywhere in the range.  Most systems will hang up on you
after 4 invalid passcode attempts (upto 2 mailboxes and 2 passcodes for each),
but some will only allow 1 mailbox, and some will go on forever.

System Administrator Usage : This system has a complicated system
administrator box so I will describe it in detail.  All prompts that you hear
someone's voice on are actually a mailbox that does not accept messages.  The
only way to access these is to hit "#" then the mailbox number, and it will
take you to that menu.  To reprogram these, you first need to find them.  This
is done by simply stating at "000".  Keep going up until it stops
acknowledging the mailboxes, then go to "010", and keep going until you run
out.  Then go into the administrator box and there is an option in which you
enter the mailbox, and record the prompt for that menu.  If you find one that
is empty, you may use it for your own personal use as a non-message taking
data box for something such as a VMB directory.  Dont be stupid, or the
company will find out and take their box back.  The same thing goes for the
system greeting, which is set up from the menu.  I have played "Cant Touch
This" at the start of 2 systems' greetings.  1 company closed their 800 # down
in 2 1/2 hours (permanently), and the other totally reprogrammed their voice
mail system for 4 digit passcodes, etc, in about 2 days (This one was set up
on the weekend).  Usually, on a system that you are giving boxes on, you want
to take the system administrator box and change the passcode, but you will
usually not use it.  You can also use it as your own personal box.

(-*-) Name              : VIX (Voice Information Xchange??)
(-*-) Example Systems   : 3 digit - 800-950-1027
                        : 2 digit - 800-950-3232
(-*-) Default Passcodes : All 0's
(-*-) SysAdmin Box      : Usually all 9's
(-*-) SysAdmin Default  : All 0's
(-*-) Other Features    : Message Notification (Sometimes Long Distance)
                        : Menuning Feature (Rarely)
                        : Questionairre Feature (Rarely)
(-*-) Notes             : On a 3 digit passcode system, if you find a box you
                          would like to take over, it takes only a couple
                          hours to go through all the possible passcodes by
                          hand.  Sometimes boxes run script questions where
                          it goes from one quesiton to the other, and each
                          question is a menu-box.  All answers are logged to
                          the starting box.

BIX - This is a great system, but it is normally hard to find boxes.  BIX
boxes are 3 or 4 digits, and usually have unlimited greeting AND message time.
There are some that dont, however, so you will want to time the greeting when
you first take the box over.  When you first call, you can hit "#" and it will
say "Please enter your mailbox number".  You can then enter a mailbox number.
It will cut you off only if the mailbox number is a correct one.  Otherwise,
it will sometimes let you go on forever.  You can hit "*" and it will say
"Please enter the address for your message".  On a couple systems, it says
"Please dial the extension of the person you wish to reach", but you may hit
"*" again for the first message.  To scan on this system, you just get it to
the "Enter the address for your message" prompt, and enter a mailbox.  They
usually begin with 200, 2000, or both.  Keep going until you get to one where
instead of saying "(name) Recording (beep)" it says "Recording (beep)", or
"Mailbox 3232 Recording (beep)".  You then hit "#", enter the mailbox number,
and if it is empty, it will automatically drop you in.  There is no default
passcode for this system, so you have to scan for empties, which is a pain.
It's only disadvantage is it saves all discarded messages until you leave the
box, which is a pain in some cases.  On many systems there are greeting-only
boxes, which are nice to have for VMB directories, etc, but are not too useful
since they do not take messages.  There is no known system administrator box
for this system, but if there is one it remains to be found.  To find the
number of digits on this system, you have to play around and find a valid box
since it will not cut you off.  Some systems have 3 and 4 digits that I have
seen, and I have seen only 3 or 4 digits.  Overall, the BIX is a very nice
basic system, especially with its extended greeting and incoming messages.

(-*-) Name              : BIX
(-*-) Example Systems   : 3 and 4 digit - 800-521-0850
                        : 4 digit       - 800-477-7691
(-*-) Default Passcodes : Empty (no passcode assigned)
(-*-) SysAdmin Box      : None
(-*-) SysAdmin Default  : None
(-*-) Other Features    : Generous greeting and incoming message time.
                        : Long Distance Message Notification
(-*-) Notes             : None

ASPEN - The ASPEN system is a hard-to-get excellent system, whether it has a
10 second or 10 minute greeting.  It has many features that are not matched by
its clone.  To identify an aspen system, you may hit "*", and it should say
something to the effect of "Please enter the number of the person you're
calling".  You can then enter a mailbox number, and it will take you directly
to the mailbox instead of transferring.  If you hit "#", it will say "Mailbox
Number Please".  This is how you find the number of digits of an ASPEN system.
I have seen these systems range from 2,3,4,5,7, and 10 digits.  Once you push
"#", enter "1234 etc" until it cuts you off.  You then know the maximum number
of digits for that system.  If you hit "1234567" and it cut you off saying
that was not a valid mailbox number, you would know the maximum length of the
mailbox number was 7.  There could be shorter ones, but to save years of
scanning you want to go with that one.  System administrator mailboxes are
usually 3000, 9998, or 9999, changing the length for the system size.
(300,998, 999, etc).  The adminsitrator boxes almost always have changed
passcodes, which makes them very hard to access since on an ASPEN system, one
can make their passcode from 2-17 digits long, and there is no way to tell
without getting the correct one.
 















[ CLOSING ]

   UCN was in service from 1988-1991.  Over the years, we had hundreds of 
members from all different parts of the world.  During our time, we did our
share of phreaking/hacking, and kept our group well-organized, even with more 
than 100 members at one time.  

   I'm sure some of you out there used to be UCN members.  (Or MSU or Phreak
Out!)  If you were, give one of the boards above a call - I'd like to talk to
you.  Also, if someone is interested in carrying on the UCN tradition, let me 
know.

   As another note, I'm going to let out one of our exclusive code files.  
Although about it's from early '91, it still has a lot of other information,
such as confrencing numbers, loops, bridges, and MUCH more.  From what I 
remember, it was about 75k.  When I find it, it'll be out there.

   Good luck in your (il)legal ventures, and contact me to let me know what's
going on in the p/h world.  Later!