203 lines
7.0 KiB
Plaintext
203 lines
7.0 KiB
Plaintext
|
||
|
||
File: PBX'S & EXTENDERS
|
||
Read 31 times
|
||
|
||
PBX's (Private Branch Exchanges) and WATS
|
||
|
||
By Steve Dahl
|
||
|
||
Because of the danger of using a
|
||
blue box, many phreakers have turned
|
||
to MCI, sprint, and other SCC's in
|
||
order to get free calls. However, these
|
||
services are getting more and more
|
||
dangerous, and even the relatively
|
||
safe ones like metrofone and all-net
|
||
are beginning to trace and bust people
|
||
who fraudulantly use their services.
|
||
However, (luckily), there is another,
|
||
safer way. This is the local and WATS
|
||
PBX. If you have a modem or inte around with the menus for
|
||
other options.
|
||
|
||
--------------------------------------------------
|
||
|
||
Dunn and Bradstreet:
|
||
Do they know something that we don't?
|
||
|
||
by Tuc TucBBS & BIOC Agent 003
|
||
|
||
In issue #90, we explained how to use the
|
||
Dunn and Bradstreet system (Which is now known
|
||
as DunSprint). As usual, our information was
|
||
totally correct. A week after the issue was
|
||
mailed, a phellow phreak found out that a copy of
|
||
the issue had fell into the (lots of
|
||
PHUN!) There will at least 1 line
|
||
going out of the PBX to the telco set
|
||
up for outgoing calls only, and there
|
||
will also be at least one incoming line
|
||
to the switchboard. This is what we are
|
||
interested in. Some of the incoming
|
||
lines are always answered by the
|
||
switchboard operator, but some will be
|
||
answered by the PBX equipmemt. It will
|
||
usually answer with a dialtone, the
|
||
tone will sound different for different
|
||
systems. Some even answer with a
|
||
synthesized voice! (These are very hard
|
||
to find, though.) The ones which answer
|
||
with a dialtone are easy to find if
|
||
you have a modem or hardware device
|
||
which can "hear" what's going on on
|
||
the phone line.
|
||
To find these fun thingies, you
|
||
will have to write a scanner program
|
||
which will dial each number in a pre-
|
||
fix, either sequentially or in a random
|
||
order, it really doesn't matter, and
|
||
"listen" on the line for a constant
|
||
sound longer than the normal length of
|
||
a ring. This could be done manually
|
||
but it would take a hell of a long
|
||
time. Whenever the program finds a
|
||
number that makes a constant tone
|
||
longer than a ring, it should record
|
||
the number in an array or something.
|
||
Now, this number can be one of a few
|
||
things. A noisy answering machine, a
|
||
sprint, MCI, etc access node, a person
|
||
who yells in the fone, the tone side of
|
||
a loop (nice), possibly a carrier if
|
||
your modem can "hear" tones that high,
|
||
or, hopefully, a PBX line. All your
|
||
scanning should be done between 6 PM
|
||
and 7 AM because between 7 AM and 6 PM,
|
||
many of these numbers will be answered
|
||
by the switchboard operator. When you
|
||
are checking out your results the next
|
||
day and come accross a dialtone, enter
|
||
some touch-tone (TM) digits. Depending
|
||
on which type of PBX equipment and the
|
||
length of the codes, after 3-8 digits
|
||
it should either give a busy signal,
|
||
a "reeler tone" (high-low tone), or
|
||
hang up on you, or possibly tell you
|
||
you entered a bad code. Now it is time
|
||
to write a hacker for this PBX. If the
|
||
codes are 3 or 4 digits, there will
|
||
most likely only be one code, but if
|
||
they are 5 or more digits there may
|
||
be more than one. If there are 3 or 4,
|
||
your hacker should dial the access
|
||
number, wait for a dialtone, then dial
|
||
the digits and wait for a second,
|
||
then dial a "1" (the reason for this
|
||
will be explained shortly), and then
|
||
"listen" for a dialtone. This would
|
||
be a hacker for a system that gives
|
||
a reeler tone, listening for the dial-
|
||
tone and hearing it would really mean
|
||
the presence of the reeler tone and
|
||
mean that a bad code had been entered.
|
||
The reason 1 is entered is to "quiet"
|
||
the dialtone" If it was a good code,
|
||
1XX or 1XXX will be valid extentions
|
||
on practically all PBX's. If your
|
||
system gives a re-order or hangs up
|
||
after a bad code, forget the one and
|
||
just listen for a dialtone, this will
|
||
be a good code. If there are 3 or 4
|
||
digits, they should be tried sequen-
|
||
tiallly (becuase there will probably
|
||
only be one good one), if there are
|
||
more, take your pick between random and
|
||
sequental. Now, when you (finally!!)
|
||
get a good code, you will call the
|
||
number and enter the code and be
|
||
confronted with a second dialtone. THIS
|
||
IS THE EXACT SAME DIALTONE THAT ANYONE
|
||
WHO PICKS UP A PHONE IN THAT PBX SYSTEM
|
||
GETS. The reason this is important is
|
||
because if they want to make an out-
|
||
going call, they will usually pick up
|
||
the fone and dial 8, 9, or sometimes 7,
|
||
and get another dialtone and then make
|
||
their call, local or long distance. And
|
||
you can do the same thing right now!
|
||
These numbers also make a good tool to
|
||
avoid being traced on telenet, etc, it
|
||
will just be traced back to the
|
||
company which owns the PBX.
|
||
Now for some phun with the PBX you
|
||
have just broken into to. You can dial
|
||
all extentions directly on it (which
|
||
is what local PBX'S are primarially
|
||
used for legitimately, unless the com-
|
||
pany has OUTWATS lines.) The most
|
||
phun extention of all is the PA system.
|
||
On some of these, you can get on the
|
||
PA (intercom) and actutually talk over
|
||
it from your house! It can be on almost
|
||
any extention though, so you may have
|
||
to hunt for it. On some, 797 or 1234
|
||
used to work, but those have mostly
|
||
been eliminated, not due to phreakers
|
||
but because people inside the company
|
||
were figuring them out and using them!
|
||
Some PBX's don't even have security
|
||
codes, you can just call up and dial
|
||
9 and call wherever you want. On a few
|
||
that I know of you enter the number
|
||
and then the code. If you want to know
|
||
what these systems "sound" like, there
|
||
are files on this and other systems
|
||
with long lists of WATS PBX numbers.
|
||
The local ones are much safer to hack
|
||
though because you are not making a
|
||
whole bunch of 800 calls which tends
|
||
to get bell very pissed. Also, I have
|
||
actually found modems and other wierd
|
||
things on some exchanges of PBX's, it
|
||
might be worthwhile to scan the numbers
|
||
inside the PBX once to see what you
|
||
find.
|
||
An important safety note: if you
|
||
heavily abuse a TBX and make many
|
||
outgoing calls on it, after a few
|
||
weeks (or whenever their fone bIll
|
||
shows up!) it is a good idea to lay off
|
||
of it for a couple of months or so
|
||
because they could get a trace on it
|
||
easilly, just like 800's. They will
|
||
usually just change the code, though.
|
||
One more interesing note, I once
|
||
found a PBX which had a direct link-
|
||
up to sprint! So by dialing 8 I got
|
||
a line to sprint, no access codes,
|
||
just area code and number. It's phun
|
||
to phuck up sprint and have them not
|
||
know who the hell you are or where the
|
||
hell you are!!
|
||
|
||
If you have any comments, sug-
|
||
gestions, corrections, or questions,
|
||
leave e-mail to Steve Dahl on any major
|
||
phreak board, I will be happy to reply.
|
||
|
||
|
||
Steve Dahl
|
||
5/1/84
|
||
|
||
This phile is copyrighted 1984 by
|
||
Steve Dahl and is not to be re-posted
|
||
without the author's consent! And I'm
|
||
not kidding!!
|
||
|
||
[Courtesy of Sherwood Forest ][ - (914) 359-1517]
|
||
|
||
|
||
|
||
[1-34, Last=34, Quit=Q] Read File #
|
||
|