==Phrack Inc.== Volume Three, Issue Thirty-one, Phile #1 of 9 Issue XXXI Index ________________ P H R A C K 3 1 05/28\90 ________________ Welcome to a new begining of Phrack Inc. Yes, Phrack is not dead. On the contrary, Phrack will and can't ever die. Phrack is more than just a technical newsletter that comes out every now and then, it's a symbol of our hacking history. Whether, it's called Phrack or some other name, it will always be published for the same reasons: 1. Inform it's readers of current events and other related items of hacker interest. 2. Educate it's readers on all topics of shared common interests that may benefit the hacker at his hobby. 3. Remain an authority in the hacking world and an observer in the ever growing technical community. 4. Be open to anyone who wishes to submit an article for publication that will further the hacker's education. Many things have happened since the last publication of Phrack. We at Phrack inc. will try to "shed some light" on the matters that have occured. And as for all these ridiculous rumors that have been spreading, let us speak the truth and be heard. Hah. No my friends, Phrack is not dead.. --DH (Editor) Note: If you wish to contact Phrack inc. to submit a file, ask around for a Phrack inc. distribution site -- Then Email "Phrack inc." and be very very patient. Note: Special thanks to The Conflict, Pain Hertz, and others for wide area distribution. _______________________________________________________________________________ Phrack XXXI Table of Contents ============================= 31-1. Introduction to Phrack 31 by Doc Holiday (2K) 31-2. Phrack Pro-Phile of Markus Hess by PHz (6K) 31-3. Hacking Rolm's CBXII by Doc Holiday (15K) 31-4. TAMS & Telenet Security by Phreak_Accident (7K) 31-5. The history of The Legion Of Doom (10K) 31-6. Cosmos Overview by Erik Bloodaxe (52k) 31-7. Tymnet Security Memo by Anonymous (9K) 31-8. PWN/Part01 by Phreak_Accident (13K) 31-9. PWN/Part02 by Phreak_Accident (17K) 31-10. PWN/Part03 by Phreak_Accident (40K) ===Phrack Inc.=== Volume Three, Issue Thirty-one, Phile #3 of 10 /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ / * * \ \ / / Hacking Rolm's CBXII/9000 \ \ by Doc Holiday / / 05/24/90 \ \ * * / \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Introduction ------------ IBM Rolm's CBXII/9000 is a very powerful machine. Powerful in the aspect that one has the switch(s) at his control. Controling switches means you can control the entire PBX environment (And it's users). This file will not get technical. Basically, I'm writing this file on the HOW-TO's of the internal works of CBXII and the basics of obtaining the dialups and account information need to access the machines. For further information on CBX's in general, read Epsilon's Phrack Phile on them, or consult Evil Jay's phile on OSL's. Obtaining Dialups --------- ------- Obtaining dialups unfortunately is the hardest part of hacking CBXII's. (Yes, even harder than hacking them). There are several ways to obtain the dialups. I would say a good bit of CBX's are at universities and hospitals where they own their own switches. Most of the time you can determine if they have one by calling the Telecommunications Department of the target location. Or, another way is to check with ROLM. If you *KNOW* that a target location has a CBXxx machine, you can call ROLM's 800 wats line and say your with the Telecommunications Department and your looking for the DIALUP. Rolm has files on all their CBXxx's and the Dialups also. They might ask you for a NODE # for the dialup, and you should usually respond with what node you want (Since different nodes handle different areas of the PBX). Basically, nodes start at ONE and usually goto THREE or FOUR, depending on the size of the PBX. CBXxx's are greatly compatible of IBM Rolm's Phone-Mail system (Which is a highly used and common voice mail system). This of course doesn't mean that every PHM (Phone-Mail) system has a CBXxx attached. But it is generally a good start. The following is a checklist to determine if the target location could have a CBXxx for controlling their switch. By no means however, if your target location has all of the following it could have a CBXxx. 1) Does the location handle it's own switch? If so, what kind, and who services it. 2) Does IBM Rolm handle any aspect of their telecommunications department? If so, this is a possible CBXxx location. 3) Does the location have Rolm Phone-Mail? These three guidelines are not requirements. I.E. -- The location could have a non-IBM PBX but still have a CBXxx for handling the switch. So who knows.. It's up to you and your bullshitting and scans. Hacking the CBXxx's ------- --- ------- Well, once you have obtained the dial-ups, you are almost halfway there. Hacking the CBX is the easy part. 1st off, IBM Rolm ships *ALL* of their machines with a default account (Yes, and they never change it). When the destination of the CBX recieves the machine, they use the default to create other accounts for employees, PBX operators, and administration. Rolm IBM also has a field support account embedded in the machine. These are different to each location and correspond to the serial number of the machine (Rolm's accounts can be obtained from Rolm's 800 technical support line). So, now that we know that there is a default account that telecom department uses to setup the other accounts after they recieve the machine, tells us that this is a priviledge account. And it is. USERNAME: SU PASSWORD: SUPER How nice for them to give us such power. Yes, it's a basic default with SuperUser priviledge. If for some reason the account default has been changed, their are other ways of getting in: 1) Call Rolm and get the Field account information. 2) Try first names of Telecom Dept. employees, and PBX Operators. 3) Use every Hacking skills you have (If any). Some older versions of CBX don't even require logging in with an account. Those versions are less responsive to the administrators needs, but can be useful to one also. Don't be discouraged if the SU password is changed, just call Rolm and get the field account. The following is the matrix before one access the machine. *Note that it clearly identifies* *Also: Accessible at 300 baud and e,7,1* CONNECT ID banner _Release version # / / /\ Rolm CBXII RELEASE 9004.0.65 RB74UCLA11956 BIND DATE: 8/SEP/88 \ YOU HAVE ENTERED NODE 1, CPU 2 \_Name of owner, IE: UCLA 11:14:30 ON FRIDAY 2/11/1990 (System ID) USERNAME: xxx PASSWORD: xxx INVALID USERNAME-PASSWORD PAIR. Once your in ---- ---- -- Once your in, you should have no problems wondering around the machine and using the utilities in the machine's operating system. There is very specific help functions inside the machine that will guide you through with no problems. At the CBX prompt: %. HELP ? or %. ? Should produce a valid listing of options and sub-functions. Every function can be followed with a '?' to give lists of valid sub-functions under that function or how the syntax of that function should be used. The following is a listing of commands for CBXII/9000: ABORT ACTIVATE ATTR BYE CANCEL CARD CDRSM CDT CHANGE CHG CLEAR CLR CMPCT CMSTS CNCL CNFG CONVERT COPY CPEG CTMON CTRA CTRTL CXCLR COPY CXCLR CXCON CXNET DACK DADD DAEVT DANS DBDMP DCAT DCF DCOM DDMA DDQ DDT DE DEACTIVATE DEFINE DELETE DEMOUNT DESUM DEX DFACK DFCOM DFEAT DFEVT DHTQ DHWS DIAG DIQ DISABLE DIWQ DKQ DML DMNT DMS DMTST DOWN DPATR DPMR DPMS DPPRI DPTR DQQ DRCT DREGS DSBLE DSQ DSST DSTAK DTCB DTDQ DWQ DX_TR ENABLE ENB ENBLE ETIO EX EXM EXN EXP EXPAND FINIT FORMAT FREER FSD GTOD HDBST HELP INSTALL KPFA LCT LIST LOAD LOGOFF LOGON LPEG LPKT LSCT LSL LST LTCB MNT MONITOR MOUNT MTRACE NEXT NSTAT PAGE PCNFG PDIO PFA PKTS PLIST PLTT PPFA PS PSH QAT QITM QTEST RCT RECEIVE RENAME REPLY RESTART RESTORE REVERSE RM RMOFF RPFA RSC RSCLK RSTOR RSTRT SAT SCAN SEND SET SHOW SITM SOCON SOUNC SSAT START STATE STATUS STEST STOD STOP STRT STS TDCD TEST TKSTS TRTL TST TX UNLK UNLOCK UP VERIFY XDEF XMIT XPND These commands can be executed from and '% ' prompt. If the command is followed by a '?', more information will be supplied about the command. Using the ICI ----- --- --- The Interactive Configuration Interface controls immediate changes in the switch and PBX environment. The Utility is explained in great detail through the actual running of it. You can access the ICI by typing: % CNFG CBXII/9000 INTERACTIVE CONFIGURATION INTERFACE CPU 2 15:14:32 ON FRIDAY 5/02/1990 COMMAND: This is the main command prompt. From here you can exercise the '?' help list to get valid commands. There are four phases of the ICI utility: Modify, Create, List, and Delete. These can be used on Extentions, Trunks, Logon accounts, Feature Group sequences, Data_line access, Trunk Groups, ect. The following is a sample of using 'list' to list a current extention in the PBX: _Forward to EXTN 2000 COMMAND: LIST EXT 4038 / _Outside number / FORWARD ON / to forward to FORWARDING BSY RNA DND / EXTN TYPE COS TARGET1 TARGET2 I E I E I E RINGDOWN NAME ---- ---- --- ------- ------- - - - - - - -------- ---------- DS 4038 EXTN 56 2000 1 1 1 1 1 1 95551212 R.STABELL \ \ \ / / \ \ Extention / -Class of service if R Auto. Forward Owner of --Type of line BUSY I No Matter What EXTN. (Reg. Extention) N G Note: The 1's specifies to forward to target#1 & NO ANSWER (As 2's would mean forward to #2 target) This should detail how to modify a listing like above using the 'MODIFY' command in the ICI. Once modified, all transactions are processed immediately. Using the 'Delete' command one can delete extentions, trunks, ect. So now we have the following commands in ICI: MODIFY, DELETE, LIST, CREATE. Each can be used with the following "Nouns" to modify that "Noun": BUTTON_120 BUTTON_240 CDR_EXCLUDE CNFG_ERRORS CNFG_QUEUE CNFG_STATUS CNFG_USERS COM_GROUP COS_FEAT DATA_ACCESS DATA_DEVICE DATA_GROUP DATA_LINE DATA_SUBMUX DLI ETS EXTEN FAC FAC_TYPE FAMILY FEAT_CODE FIRST_DIGIT HD_GROUP LEX LOGON_PROFILE MAP MEM_PARTS PARAM PICK POWER Q_TYPE ROUTE_LIST RP RPD RPI RPS_120S_ON RPS_240S_ON SAT_NAME SEARCH_SEQ SECTION SECURITY_GROUP SERVICE_LIST SIO_PARTS SLI SPEED T1D3 T1D3_GRP TRUNK TRUNK_GROUP VPC The FAMILY, LOGON_PROFILE, and CNFG_USER all deal with the accounts on the system. One can use MODFIY or CREATE to set them up an account with SU access. The FAMILY noun is the listing of the groups with different access, to different "nouns" available. I.E.: Not everyone can access the CHANGE LOGON_PROFILE to create an account. To create an account with SU access, type (while in ICI): % CREATE LOGON_PROFILE ENTER NAME (1-12 CHAR): TEST ENTER PASSWORD: TEST RETYPE: TEST Next it will ask you for a family. For SU access, type "SYSTEM_ADMIN". After family, the machine should prompt you for a "verb". Verbs are the actual functions or commands, so in this environment you can set the commands a user can access. So, for SU, enter "ALL" for every command access. To get a valid listing of users online, try this: % LIST CNFG_USERS NUMBER OF USERS MAX NUMBER OF USERS 3 5 PORT USER_NAME START_TIME HOW_LONG 17 SU 17:47:57 0:28:34 2 FIELD 18:16:03 0:0:28 3 MARYB 18:16:03 0:10:03 Using the Monitoring Utility ----- --- ---------- ------- This command is one of the more powerful commands in the CBXxx system. The monitor command should be invoked from within the main function command level and not in the ICI level. The monitoring command allows you to actually watch or monitor TRUNKS and EXTENTIONS. So, if I were to type: % MONITOR EXT 4038 10:02:43 ON FRIDAY MAY/02/1990 EXT# STATE DI CODE DIGITS PROCESS STATUS ---- --------------- -- ---- ------------- ------------ ------ 4038 IDLE STN FWD NUM FWD \ \ / / / \ Extention Not in use Standard \ / Forwarded Extention \ / Forwarded to a number This shows the extention to be IDLE and not in use. But, with forwarded call processes to a standard number. You would have to use ICI to look up the number it's forwarded to if you wanted. % MONITOR EXT 4038 10:03:44 ON FRIDAY MAY/11/1990 EXT# STATE DI CODE DIGITS PROCESS STATUS ---- -------------- -- ---- ------------- ----------- ------ 4038 DIAL TONE STN FWD NUM FWD 4038 DIALING Y 9 / \ \ \ 4038 DIALING Y 92 S F N \Extention 4038 DIALING Y 923 t o u Forwarded 4038 DIALING Y 9233 a N r m 4038 DIALING Y 92334 n u w b 4038 DIALING Y 923345 d m a e 4038 DIALING Y 9233456 a b r r 4038 DIALING Y 92334564 r e d 4038 CONN T025N N \ d r e / \ / \ d \ \ \_Dialing NO \_Number dialed \_Extention \ Connected to Outside trunk T025N This monitoring shows the extention actually dialing the number, and then connecting to an outside truck. Unfortunatley, one we cannot monitor without access to a bell switch. Monitoring can also be done with trunks. I will not display any trunk monitoring since it is quite simple to decypher. Manipulating the switch ------------ --- ------ There are many ways you can manipulate the CBX's to gain accounting information on data lines within the PBX environment. One sure-fire method would be to forward an actual data dial-up extention to a bridge or loop and then write an emulation to intercept the user's account information real-time as they connect to your fake dial-up. Or perhaps if an university uses the CBX, one could maybe forward the computer help desk extention to a bridge or loop and as an unsuspecting user calls up, ask him what machine and account info he has access to for a help log sheet you are taking. Who cares. Who knows. There are thousands of things you can do to use the CBX to your advantage. Hell, you have the whole switch at your command. Doc Holiday - 05/11/90 _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-one, Phile #4 of 10 / Everything you always wanted to know.. \ / about Telenet Security, But were to stupid to find out. \ By Phreak_Accident Ever since the early 80's GTE Telenet has been expanding their public packet switching system to hold enormous amounts of users. Currently GTE SprintNet (Yes, Telenet is out, SprintNet is in.) has over 300 nodes in the United States and over 70 other nodes abroad. SprintNet provides private X.25 networks for larger companies that may have the need. These private networks are all based on SprintNet's 3270 Dedicated Access Facility which is currently operating for public use, Hence for the major security Sprint- Net has aquired. SprintNet's security department is a common idea of what any large public packet network should be. With their home office located in Virgina (703), most Hacker's who run into trouble with them would wind up talking to Steve Mathews (Not the head of security but a prime force against the major attacks Sprintnet recieves from Hackers anually.), who is a very intelligable security analysist that deals with this type of problem daily. Because of Steve's awarness on Hackers invading "His" system (As most security personnel refer to the system's they work for as their own.), He often does log into Bulletin Boards accross the country looking for Sprint- Net related contraband. At the time of this article, Steve is running an investigation on "Dr. Dissector's" NUAA program. (NUA attacker is a Sprint- Net NUA scanner.) Besides this investigation, he currently stays in contact with many Hackers in the United States and Abroad. It seems Steve recieves many calls a month from selected Hackers that have interests in the Security of SprintNet. Wow. Who the Hell would want to call this guy. From many observations of Steve Mathews, I find him to in deed be the type to feel a bit scared of Hackers. Of course, his fright is really quite common amoung security personnel since most fear for their systems as well as themselves. (Past experiences have showed them not to take Hackers lightly, Hence they have more contacts then 60 rolodex's put together.) For now, let's forget Steve Mathews. He's not important an important influence in this article. Trying to pin a one-person in a security depart- ment that handles security is like finding a someone on a pirate board that doesn't use the word "C0DE" in their daily vocabulary. Telenet's main form of security lies in their security software called TAMS (Telenet Access Manager System). The TAMS computers are located in Res- tin, Virginia but are accessable throughout the network. Mostly, the main functions of TAMS are to: * Check to see if the NUI/Password entered is a valid one. * Check to see if the Host has list of NUI's that can access that host. If another NUI is used, a Rejection occurs. * Processes SprintNet's CDR (Call Detail Recording), which includes Source and Destination, Time of call, Volumes of data recieved, and the Total time of the call. * Can be used by host to add an optional "ALPHA" NUA for "easy" access. * Can secure Hosts further by adding an NUA security password. * Restricts calls without an NUI for billing (I.E. No collect calls to be processed). * Accepts all calls to host as a prepaid call (I.E. Accepts all calls). TAMS is really for the handling of NUI and corresponding NUA's, therefore being a security concept. TAMS holds all the data of NUI's and restricting NUAS for the ENTIRE network. If one could gain the access to TAMS, one could have the entire network at his/her disposal. This of course if highly impossible to SprintNet's security department, but not for a couple of hackers I have ran into. Yes, TAMS is quite interesting. In other aspects of SprintNet security, lets focus on the actual X.25 software that they use. Anybody who tells you that Telenet can monitor the sessions currently taking place on THEIR network is WRONG (And probably very stupid as well). Monitoring is a basic feature of all X.25 networks, whether it's a little PeeShooter network or not, they can and do monitor sessions. Of course their are far to many calls being placed on SprintNet to be monitored, but a scared host can always request a full CDR to be put on their address to record all sessions comming in on that NUA. Such as the many re- corded sessions of the ALTOS chat(s) in Germany that was a hot-spot for many Hackers across the United States and Abroad. After the detection of ALTOS, through the hundereds of illegally used NUIs, CDR's and direct host monitoring were used on the ALTOS hosts. As far as prosecutions concern, I doubt their were any. Now, as far as other security software on SprintNet, they have a call tracking service that is called AUTOTRAIL. Basically, AUTOTRAIL traces the connections through the DNIC's and back to the orginating NUI and/or NODE loca- tion that placed the ca