41 replies to this topic

[Captain B]

Like many things in phreaking, depending on who you ask, you can get 2 different stories. I've heard those say it can be done, others say it can't. My questions on this are: Which is in fact the case, and how do you go about dialing into a switch? Where on an exchange is this remote access (if any) usually kept? Down low, near the bottom of an exchange? (Such as: nxx-nxx-00xx). Or, near the top of an exchange (Like nxx-nxx-99xx). And, what are all the functions you get access to when dialing into a switch? Is there a proprietary type software you need to be running via a PC when dialing in, or is it more of a voice-menu prompt driven kind of deal? Since, I've done my part to try to answer a few questions, I figured it was about time I asked 1 or 2 by now.

[Spaz101]

i was wondering the same thing but i neglected to ask
a while back well not that far i was talking to some one and he always said scan the highter number 99xx but the thing is i never found anything but alls i did was about 100 numbers i still have plenty more off of that

[screamer]

I won't say it's impossible, but I will say this...if they still have dial in lines, wow they're dumber than I thought.

[unity]

I was under the impression, at least from conversations with my friendly neighbourhood Telus tech that switches in my area, at least, do not have dial-in lines. The local tech says that switches im 780 are only accessable from the console. Who knows, though? Could be pure bull.

[Spaz101]

yo if you ever get the info unity share it with me and the forum...

[BriskAttivo]

I guarantee you it's possible. Where to begin for finding the numbers? Well usually, at least within an RBOC, the internal numbers are kept within one exchange or one subexchange. To begin with try and find the toll, frame, and/or switch numbers for your central office, or one nearby at least, from RCMAC, CORAC, or whoever you know how to call (you can get it from business customer service sometimes even if you pretend to be a field tech). Those are just numbers to the actual departments, not the systems, but once you have those numbers you should be able to figure out what exchange/subexchange they're in. Say the numbers are all in 321-1XXX; well you probably should start by scanning that exchange. Hand exchanging is safer, because even though your CO doesn't usually care so much or even notice if you're exchanging some random residential exchange, they're going to notice when all the phones in the central office start ringing. Anyway, you'll probably be able to find some internal carriers that way. They could be all kinds of different OSS systems or various gateways into COSMOS (yes COSMOS as a concept still exists and is applied, but it's called all kinds of things), just depends really, but here they're all relatively the same. Pay attention to the login prompts. What you do with the numbers is up to you. Post your results if you find anything, and good luck.

-Brisk Attivo

[unity]

Thanks BriskAttivo. That makes sense.

[ic0n]

a while ago xenocide reaver and myself tryed cracking the code on a atnt switch... with no luck

[phreakblaze]

I once knew of such a number (needed a passcode) that worked in any NPA, a lineman I know says that it is used when the Verizon guys in my area have to climb the polls and can't bring that laptop with them. They can control the system from their little test-sets.

[BriskAttivo]

Who's your telco phreakblaze? The way you describe it makes me think it was one of these: Voice Response Systems. Unless of course you're talking about a system other than a voice response system.

-Brisk Attivo

[phreakblaze]

I'm in the Verizon teretory. I think its a voice responce system. All I know is the linemen use it when they are up on the poll and can't bring their laptop.

[BriskAttivo]

Well if it's the formerly Bell Atlantic area of Verizon, aka Verizon East, then I'd almost bet on it that it's a DATU-RT made by Harris, since DATUs are very common in Verizon territory. If it's formerly GTE there's the possibility that it may also be a 4TEL (link) or maybe even 4Tel II, but either way it's probably DATU that you're talking about. The default passcode on most DATUs is 2222222. Check it out, if you even still have the number, and report the results. And if not, well at least you learned something.

-Brisk Attivo

[ragweed]

<sarcasam>
2222222 what a 31337 pasword oh my gosh
</sarcasam>

[BriskAttivo]

Speaking of that, did you know there's a backdoor password on all AT&T Easy Reach 800 numbers of 1337? I wonder if that's more than a coincidence. These numbers are all over the place, doesn't take many WATS numbers to scan to find one.

-Brisk Attivo

[ragweed]

AWESOME!

[phreakblaze]

Well BriskAttivo, I'm in former bell atlantic. All I remember about this number is it worked in olmost any exchange in my 732 area. I could do 732-920-xxxx (xxxx being the numbers I forgot), 477, 262, ect. I'm so pissed off that i forgot it !!! I thought it was fake when I herd of it but when it worked mulpitle places, and I asked a former linman what it was, I knew I had something, why did I forget it Oh well if i can get it back, i'll give ya a yell. it wont be to hard to find, I just have to get off my lazy ass and scan. I probably forgot it because i couldn't guesse the passcode. Oh well I'm confident i'll find it!!!

[BriskAttivo]

477-9935, that's what should fill the XXXX. Actually this number seems to serve all the exchanges at WOVLNJWO: 255, 262, 279, 451, 477, 864, and 920. Forget what I said about 2222222. Do this: when you hear the tone hit 1111 (another default code), another tone should come up, enter the telephone number you want to test in any of those exchanges. Here's an article more specifically about the DATU-RT and how to use it: Guide to DATU by ChaoticPhreak Just remember... ALWAYS ALWAYS ALWAYS press ## when you're done with the DATU, this is so if you're running a test it doesn't busy up the DATU for the next technician that calls or the next time that you call. Wait for the DATU to hang up on you, don't hang up on it. Don't just disconnect. Anyway, I don't know as much about your exchange as you do, so I'll leave it up to you to explore it more and share. I'm probably going to hell for telling all of you this, but who cares? You could have figured it out on your own eventually. I trust that you're just curious and aren't on some destruction fix or something. Good luck, be careful, and as always... report your results!

-Brisk Attivo

[phreakblaze]

Not look'n for destruction, only information for the mind to chew on. I'll test and keep scanning for it and post results!

[phreakblaze]

I would call it a success ! 732-477-9935 worked like a charm, the correct passcode was 1111, after that it gave me another tone where I was forced to enter it again or it hung up!!! The automated voice was grain like and hard to hear, but i put my mind to it, plus that text DATU Whatever it washelped a lot The system did exactly what the text said. It didn't work for my exchange, 920, but what the diff, I have friends to any in the 477 exchange to anoy(HA HA HA ). it doesn't help me much exept that i know when my friends without call waiting are useing thier fone ( i know there is a easy way, calling them, but thats not fun). I made sure to double # at the end and wait for it to hang up!!! don't want to mess nothing up !!! I can't say there is much I myself can do with this info, but its good to have it. If anyone has any questions, i can dial back in and see what i missed.

oh well it was fun, I'm glad it had some help from BriskAttivo (thanks ) Hope to find more fun things. Good luck to all you!!!

[phreakblaze]

I forgot to add, the automated voice asks what number you want to use and takes a few seconds to come on. I know I already mentioned the voice sounds like finger nails down a chalk board , but i'm rewriting it in for good measure !!!