Jump to content


Photo
- - - - -

Anything interesting to scan on a Ramada Hotel phone system?


  • Please log in to reply
4 replies to this topic

#1 nyphonejacks

nyphonejacks

    Dangerous free thinker

  • Members
  • 793 posts
  • Gender:Male
  • Location:718

Posted 03 May 2014 - 05:16 PM

overnight in a Ramada hotel.. 

 

they have an Inn Phone D520-ap on the night stand.. 

have to dial 9 to get an outside line 

room to room is just dialing the room number.. only has 2 floors.. 

phone says i can dial 0 for an emergency.. 

 

they also have open WiFi 

the public IP that I am getting is 208.125.100.179

There are only 5 devices connected to the network, 3 are mine, one is a Officejet 6500 E710n-z, and the other one is a  HP 

MSM760
 
 
The printer is wide open, no password protection at all.. not sure that is a good thing... the other device is password protected.. 
I really do not want to mess on their network.. guess there are no other guests using the WiFi at the moment... 
 
would prefer to explore the phone system in the room if there is anywhere someone thinks would be interesting... 
 
EDIT:
OK there is nothing else on the network because there are not many guests here... its a pretty shit town... 

Edited by nyphonejacks, 03 May 2014 - 07:00 PM.


#2 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 03 May 2014 - 10:16 PM

The way I usually poke at hotel PBXes is pretty simple. First, figure out how they want you to dial rooms. For example, if they're all three digits and they want you to dial the room numbers, just avoid 1xx and 2xx. There's also usually a dedicated hundred block for hotel staff and attendants. There's always the chance there might be something interesting in there, but I usually look at everything else first. The great thing about PBXes is the dialplan is so plainly laid out. If a block of numbers is vacant, you can figure that out right away.

 

As for identifying what it is, the most straightforward way is to just head down to the lobby and look at the attendant's phone. More often then not, it's some proprietary set from the PBX manufacturer instead of some generic phone. The rest is just kind of an educated guess based on how the PBX behaves. Avaya, Nortel, and NEC are pretty popular for hotel stuff.

 

Most of the PBXes with hospitality features will have feature codes specific to maids. Nothing too complicated, just codes to let everyone know they've cleaned the room. If you scan *xx codes, just be prepared for a dirty room :p .

 

EDIT: One other thing I forgot to mention - you might be tempted to try dialing 9+1167 onto an outbound trunk to fool the PBX. That would be a good idea, but it's a pretty popular idea to translate 9+11anything as 9+911. So, well, don't. There's easier ways to do this.

 

For example, the cause code 866-202-9985 sends back will have about a 50-50 chance of making a DMS-100 reset back to dialtone depending on some difference between switch hardware. It seems to change between whatever the DMS-100 equivalent to a register sender is, so try it at least five or so times if you're just getting a reorder. If it does work, you're in the clear for pretty much anything, even Millenniums; the switch won't make a battery drop happen when it resets.


Edited by ThoughtPhreaker, 03 May 2014 - 10:30 PM.


#3 nyphonejacks

nyphonejacks

    Dangerous free thinker

  • Members
  • 793 posts
  • Gender:Male
  • Location:718

Posted 04 May 2014 - 07:53 AM

check voicemail is 400 so i guess the 400 range is where to start looking.. from the book they left in the room it appears that all of their internal stuff is on 100 extensions i guess since that is all on the first floor... pool is 200 for some reason, guess there is no room 200 on the 2nd floor... 

 

but dont think i will have much time to test much of this this time around... 

 

in the 400 range you can only dial 40x they all go to the voice messaging system

all everything else 41x-49x gets reorder

 

 64x 65x 66x 68x are dialable everything else gives reorder

 

i will have to poke around more next time.. 


Edited by nyphonejacks, 04 May 2014 - 07:58 AM.


#4 ic0n

ic0n

    Fear teh phone!

  • Agents of the Revolution
  • 1,212 posts
  • Gender:Male
  • Location:NPA 216/440

Posted 04 May 2014 - 09:12 PM

I just happen to be staying at a hotel myself tonight..

 

I guess I will post what I found with the little time I've had to poke around..

 

Candlewood Suites

 

Room to Room 7+ 3 digit room number

Outside Line 9 (Local +Area code + Phone number) (Long + 1 + Area Code + Phone Number)

 

1 - Reorder

200-201 Greeting (Main outgoing recording)

202-209 Reorder

2100-2101 Reorder

2102 After ringing for quite sometime someone picked up and hung up.

 

 

 

22-31 Reorder

321-324 Voicemail

325-33 Reorder

340 Rang out

341-39 Reorder

4000-4010 Voicemail

4011-4012 Wakeup call recording

4013-4019 Reorder

 

4100 Wakeup call recording

4101-4109 Reorder

411-443 Reorder

440000-440059 Dial tone

 

45-54 Reorder

5500 Rang Out

5501-59 Reorder

60-6999 Reorder (Odd nothing valid, doesn't jump right to reorder)

7 = Room to Room

8 Reorder

9 Outside Line



#5 smpl

smpl

    DDP Fan club member

  • Members
  • 53 posts
  • Country:
  • Gender:Male

Posted 05 May 2014 - 08:23 AM

EDIT: One other thing I forgot to mention - you might be tempted to try dialing 9+1167 onto an outbound trunk to fool the PBX. That would be a good idea, but it's a pretty popular idea to translate 9+11anything as 9+911. So, well, don't. There's easier ways to do this.


Learned this one the hard way. Police be knocking at the hotel room door. Would not reccomend.

I've also seen *91 go to front desk emergency. Just beware to act completely confused when the front desk thinks there's a fire in your room.

Larger hotels often omit the thirteenth floor. There's usually goodies there.

Sketchy motels are the best. See my bates motel thread from march. Usually you can get away with some very basic things... 10-10 codes, real dialtones.

Lastly, take occasional breaks from the phone. I once had the front desk calling me, "is there anything wrong with your phone?"




BinRev is hosted by the great people at Lunarpages!