1994 << Back To The X Files nº 15

__ \ / |_ / \ e n o n | o u n d a t i o n presents: \ / *------ the \ / / \ files ------* / \ Spring/1994 Issue: 15 "Stealth in Diverting - PBX Style" By: Erik Turbo Disclaimer: The information provided below is solely for the purpose of diverting yourself from possible traces, ANI, and Caller ID. It is *not* to be used for long distance toll fraud, including abusing 900 services, using illicit calling cards, or other forms of credit card fraud. Introduction ~~~~~~~~~~~~ A PBX, or Private Branch eXchange, is an on-premise facility, owned or leased by an organization, which interconnects the telephones within the facility and provides access to the public telephone system. Basically, it is a mini-switching station, and allows a telephone user on the premises to dial a three to four digit number (extension) to call another telephone on the premises, and dials one digit (usually 8 or 9) to get a dial tone for an "outside line," which allows the caller to dial out to the rest of the public telephone user. This is the most important feature for a hacker that desires the stealth that is necessary to continue his explorations. In short, you can remain well-hidded if you use a PBX's outside lines to connect to the computer you are hacking. That way, any Caller ID, ANI, or trace will reach the PBX number - not your home telephone. When you have mastered the art of PBX hacking, you should make a habit of diverting with 3 or 4 "well spaced" PBX's before hitting your target destination. For the advanced hacker, diverting with PBX's is just the beginning of his actual diversion; it is best to bury yourself in packet-switched networks, loop in and out of Internet hosts, bounce yourself off of satellites with International calling, and utilize all of the data-based outdials that you have. Remember, abusing these PBX's for un-necessary long distance calling is NOT condoned by me, or any members of the Xenon Foundation; it will kill the PBX quicker, and place you at risk of serious fraudulant charges. Definity G Model System 75 ~~~~~~~~~~~~~~~~~~~~~~~~~~ Definity model System 75 systems control a large number of medium-sized (approx. 1000 lines) PBX's. It is owned by AT&T, and was developed in the late 1970's, with modifications in 1983, and 1986. The actual System 75 machine has one or more incoming 1200bps data lines, which connect at 7E1. It is through this remote port that you may begin your actual hacking of the PBX. Since all of the changes you may via modem affect the entire telephone network on the PBX, this is a power that you will have to learn how to abstain from abusing. It is possible to turn the once smoothly operating phone system into a chaotic mass of busy signals, re-routes, Voice Mail Box's, tones, and bridges, effectively shutting down the victim for hours, if not days. For this reason, I will only inform readers on how to create a remote extension for diverting purposes. Connection ~~~~~~~~~~ The best way to find a System 75 is to scan ("wargame dial") your local telephone exchanges. There are still dozens of them around, and you are bound to hit at least one in a few days of scanning. Upon connection you will see the System 75 login and authorization prompts: Login: xxx Password: xxx INCORRECT LOGIN You will be given three chances to guess authorization password before the system will drop carrier. On telephone systems that provide Caller ID services, I would be weary; it is quite possible the System 75 dialup as well as the PBX are equipt with ANI for auditing purposes. Default Accounts and Passwords ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ With every new System 75 package, AT&T includes a large number of accounts and passwords already installed and ready for usage. Usually, these passwords are never changed by the owners. Here is a listing of the known System 75 default accounts and passwords that are included in every Definity G package: Login: enquiry Password: enquirypw Login: init Password: initpw Login: browse Password: looker Login: maint Password: rwmaint Login: locate Password: locatepw Login: rcust Password: rcustpw Login: tech Password: field Login: cust Password: custpw Login: inads Password: inads Login: support Password: supportpw Login: bcim Password: bcimpw Login: bcnas Password: bcnspw Login: craft Password: craftpw Note: The browse account can *not* modify anything on the system 75. It is only useful for examining the possibility of an existing remote extension, not for the actual creation of one. Internal System 75 Commands ~~~~~~~~~~~~~~~~~~~~~~~~~~~ If those defaults did not work, the only other alternatives is social engineering, and brute force hacking. Both are not likely to work unless you are a social engineering master, or have time to waste brute force hacking. Your best bet is to move on and hope to scan a lesser protected System 75. Assuming you have passed the authorization, you will be prompted with the following: Terminal Type (513, 4410, 4425): [513] These are the basic System 75 remote usage emulation codes. I prefer to use 4410, as it appears much "cleaner" on a VT100 IBM PC. The emulation is used to remotely send System 75 key sequences, to request help, to save a session, to move forward a page, to move back a page, etc. Since the IBM keyboard has no way to emulate these keys, the System 75 provides 3 basic emulation codes. For our purposes, use 4410. The following sequences will work with emulation 4410: ESC Op - To cancel a command ESC Ot - To request Help ESC Ov - Next Page ESC Ow - Previous Page ESC Or - Save ESC Oq - Refresh Screen ESC Os - Clear Fields You can achieve the escape sequences by hitting the ESC key, and then the key combination O and the following character. Once you have choses emulation 4410, please remember (or take note) of the previous escape sequences. You will not be able to save information without knowing the proper code. ("ESC Or"). ESC Op is also very important since it is the only method of stopping the execution of a command; something you will have to do constantly when looking over certain pieces of information within the System 75. Take these down! Next you will see the AT&T banner and the command prompt: Copyright (c) 1986 - AT&T Unpublished & Not for Publication All Rights Reserved enter command: There is online help avaiable at all times by pressing "ESC Ot", as well as keying 'help' at the command prompt. Familiarize yourself with the system. It is basically cryptic, as it is usually only used by experienced AT&T technicians. Examining the PBX ~~~~~~~~~~~~~~~~~ Once you are in, you now want to get to working on your diverter. What you will obviously need is an extension dedicated explicitly for a dial tone to the outside network. To accomplish this quickly and easily, all you must do is type "change remote" at the command prompt. This will bring you to the following screen: change remote-access Page 1 of 1 REMOTE ACCESS Remote Access Extension: Barrier Code Length: BARRIER CODE ASSIGNMENTS (Enter up to 10) Barrier Code COR Barrier Code COR 1: 1 6: 1 2: 1 7: 1 3: 1 8: 1 4: 1 9: 1 5: 1 10: 1 As you can see, there is no remote access extension set up, therefor this PBX does not have any existing dialtones available. Now to create one, type in the extension you wish to direct you to your dialtone. The extension you type in should be a 4 digit number, startin with "2" or "4" as these are valid extensions under System 75 software. When you type in your extension, press enter; if it gives you an error, try a different extension until it accepts your input. If you wish to add a security code on your dialtone, you may enter it's length at the "Barrier Code Length:" prompt. Under the heading "Barrier Code", at the "1:" prompt, type in your desired security code. After you are all set, the screen should look something like this: change remote-access Page 1 of 1 REMOTE ACCESS Remote Access Extension: 2400 Barrier Code Length: 6 BARRIER CODE ASSIGNMENTS (Enter up to 10) Barrier Code COR Barrier Code COR 1: 222222 1 6: 1 2: 1 7: 1 3: 1 8: 1 4: 1 9: 1 5: 1 10: 1 Now you have a working extension that is not only available for your use in diverting, but also secure from others who do not know your barrier code. Type the key combination "ESC Or" to save your work. Finding the PBX Dialup ~~~~~~~~~~~~~~~~~~~~~~ Now that you are guarenteed a tone, you must find out the telephone number the PBX is located at. Type "list trunk-group" at the command prompt. It should give you a listing similar to this: Group No. of Outgoing Number TAC Group Type Group Name Members COR SMDR? Display? 1 801 co Incoming 12 1 y n 2 851 co Sales Room 1 1 y n 9 809 co Billing 4 1 y n 10 810 co Admin line 1 63 y n Command successfully completed CANCEL P HELP T Now that you have a listing of all the trunk groups that are present on the PBX, you can individually list them to get their corresponding telephone numbers. Type "display trunk-group 1", to display trunk group 1 (Group Number 1, Group Name "Incoming"). As you can see from the above capture, there are 4 trunks available; 1, 2, 9, and 10. Display each of them, and use the 'next page' ("ESC Ov") key combination to get to the page (usually page 2, or 3) with the telephone numbers to the trunk. Each time you display the trunks, you will get a screen similar to the following: display trunk-group 1 Page 1 of 5 TRUNK GROUP Group Number: 1 Group Type: co SMDR Reports? y Group Name: Incoming COR: 1 TAC: 801 Direction: two-way Outgoing Display? n Data Restriction? n Dial Access? y Busy Threshold: 60 Night Service: Queue Length: 0 Incoming Destination: 200 Comm Type: voice Digit Absorption List: Prefix-1? n Restriction: toll Allowed Calls List? n TRUNK PARAMETERS Trunk Type: loop-start Outgoing Dial Type: tone Trunk Termination: rc Disconnect Timing(msec): 500 ACA Assignment? n Maintenance Tests? y Answer Supervision Timeout: Suppress # Outpulsing? n _____________________________________________________________________________ To get the actual dialups, you must look on the following pages. The "ESC Ov" combination will do that under emulation 4410: _____________________________________________________________________________ display trunk-group 1 Page 2 of 5 TRUNK GROUP GROUP MEMBER ASSIGNMENTS Port Name Mode Type Answer Delay 1: A0101 555-2322 2: A0102 555-2342 3: A0103 555-2343 4: A0104 555-2345 5: A0105 555-2456 6: A0106 555-2457 7: A0107 555-2458 8: A0108 555-2459 9: A0201 555-2460 10: A0202 555-2461 11: A0203 555-2462 12: A0204 555-2470 13: A0205 555-2800 14: A0206 555-2810 15: A0207 555-2811 Make a note of the telephone numbers on the trunks, and dial them up after logging off the System 75. When you dial them up voice, if one of them prompts you for an extension, type in the remote extension you created earlier. You should hear the tone to an outside line. If you created the remote extension with a barrier code, touch-tone that in now. Next, dial "9" to get an outside line (It can also be "8" on some systems), and then dial the telephone number you want to reach, just as normally as you would from your home telephone. Tricks and Hints ~~~~~~~~~~~~~~~~ The following are methods and commands that can be used in addition to the above mentioned hacking tactics. They are not necessary to the smooth creation of a remote dialtone off of a PBX, however. When you are displaying the trunk-groups individually, look under the heading "Direction: " (found on page 1). If it says "one-way", then modify that (with the "change trunk #" command) to say "two-way". Also on page 1, change the "Incoming Destination: " header to reflect your newly created remote access extension that you created earlier. On the next page, get the dialups. You have just created a large set of tones. Since they used to be "one-way", only users within the building could use them to dialout, but since you have changed it to "two-way", and changed the incoming destination extension to your remote extension, you are allowing incoming callers to use the tone service as well. If you do not want to arouse suspicion, instead of changing the "Incoming Destination: " to your extension, just change the "Night Service: " header to your remote extension. With this, however, you can only use the tone service after hours; usually after the business closes. To get an idea of how the extensions are uniformly placed on the PBX, type "display dialplan" at the command prompt. This will give you all the prefix's to the three or four digit extensions. This is valuable if you are having trouble finding a valid extension to use for your remote extension. When displaying a trunk group, mark down the COR (Class of Restriction) number. Type "display COR #" (where # is the COR number of a specific trunk). Make sure the FRL prompt is set to 7, and the calling restrictions are set to "none". If not, type "change cor (COR #)", and make the necessary modifications. Type "display feature" to get a listing of all the feature access codes on the system. This is valuable if you can not get an outside line by dialing "9", or "8". The dialout access code will be in here. Conclusion ~~~~~~~~~~~ Basically, it is extreemly simple to create a remote extension off of a PBX in your local area. If you use the PBX just to make local calls and to divert yourself further through the telephone network, it should last a rather long time. However, if you abuse it by dialing Alliance Teleconferences every night, or to call your friend in the UK three times a day, it will either die, or get slapped with ANI. I have tried to be as straight forward as possible, without having to technically explain every detail of operation. Once you get the hang of it, you should be able to create your remote extensions in under 10 minutes. However, if you are having problems, you can contact me at the following locations: Internet Mail: erikt@xf.com Void of Deception: [508]/998-2400 Additional Reading: ~~~~~~~~~~~~~~~~~~~ Hacking AT&T System 75, Scott Simpson, Phrack 41, File 6. System 75 Hacking (An Online Tutorial), Panther Modern, COTNO01.TXT, File 3. Data and Computer Communications, William Stallings, Macmillan Publishing Co.