==Phrack Inc.==

                   Volume Four, Issue Forty-One, File 6 of 13

                   A Brief Guide to Definity G Series Systems
                                     a.k.a
                                 System 75 - 85

                            Written by Scott Simpson


          Greets to Jim Anderson, The Missing Link, Randy Hacker, Dark Druid,
Nickodemus, Mercury, Renegade, Infinity (enjoy the army!), Weirdo, TomCat,
GarbageHeap, Phrack Inc.


Basic History
~~~~~~~~~~~~~
Definity model systems came into existent in the later part of the 1970s.  In
1983, AT&T came out with a revised model called 75.  This system was built to
hold more incoming lines and did not have as many errors as the earlier version
did.  The 1983 version was replaced with a version re-written in 1986.  Today,
the systems are referred to as G models.  System 75 is now called G1 and 85 is
called G2.  A new model is currently available and is called the Definity G3I
which is Generic 3 with an Intel chip, and Definity G3R which is Generic 3 with
a Risk chip.  There are 3 different versions to each model.  Version one is the
most common and it is an XE Single Carrier Unit.  The other two systems are 2
carriers.  A system will usually cost somewhere around 50 to 80 thousand
dollars.  You MIGHT come across a smaller version and it is called "Merlin
Legend."  This system will hold about 50-100 lines.  System 75 & 85 will hold
around 1000 lines.  System 75/85 are used by companies to house all of their
incoming lines, as well as to send their incoming lines to destinations set up
by the owners, whether it be Audix or any other setup.  There are many uses for
the system besides VMBs and PBXes.  System 75/85 has three main functions that
hackers are interested in. They are the capabilities of VMB, bridging, and of
course PBX exchanges.


Discovering the System
~~~~~~~~~~~~~~~~~~~~~~
When you find a System 75, you will make a 1200/NONE connection (if HST used),
as most setups have a built in 1200 baud modem.  Normally, the controller
number will not be in the same prefix as the business or the PBX and the line
is actually owned by AT&T.  Try CNAing a System 75 line and it will tell you
that it is owned by AT&T.  Once you find a carrier, you will need to be able to
display ANSI or some equivalent type of terminal graphics.  Most are set to
N81, but some may be E71.  My suggestion is to use ToneLoc which is produced by
Mucho Maas and Minor Threat.  As you know, this program will scan for carriers
as well as tones.  This program can be found on just about every ELEET H/P BBS.


Getting into the System
~~~~~~~~~~~~~~~~~~~~~~~
Getting into the system is the easy part if you have the defaults.  You must
find them on your own and you will find out that a lot of people are not
willing to trade for them.  There is one default that will enable you to snoop
around and tell whether or not they have a PBX, provided that they have not
changed the password or restricted the account.  This one default is usually a
fully operational account without the privileges of altering any data but I
have come across a couple of systems where it wouldn't do anything.  Using this
default account is a good way to start if you can find it.  It is also good to
use any time you call and don't plan on changing anything.  All actions by this
account are not kept in the system history file.  Now on to the good stuff!!


Abusing System 75
~~~~~~~~~~~~~~~~~
After logging into a 75, there are several commands available depending on the
default you are using.  This part will be for the basics.  I will explain more
later for the more advanced people.

When you log in, you will have the commands LIST, DISPLAY, and a couple others
that don't matter.  These are the only ones that you will need with the
aforementioned default.  First type "DIS REM" (display remote access).  If
there is a PBX set up on the system, it will be shown on the extension line.
The barrier code is the code to the PBX. If "none" appears, there is no code
and it's just 9+1.  The extension line can either be 3 or 4 digits.  Usually,
if it's 3 digits, it is run off of AUDIX (AUDio Information eXchange) or they
are smart and are hiding the one digit!  Look at the dialplan and see if the
extensions are 3 or 4 digits.  If it tells you that the extensions are three
digits, chances are that it is somewhere in the AUDIX system.  If it's run off
of an AUDIX, look through all of the extensions by either list or display
'extensions' until you find one that says something like "remote extension" or
something that looks different.  If the one digit is hidden, use ToneLoc and
scan for the digit needed.  Next, display the trunk groups.  This will tell you
the actual dial-up.  If you don't find it here, don't panic.  As you go through
the trunk groups, also look at the incoming destination as well as the night
destination.  If any of these show the remote extension here, there is your
PBX.  If not, keep looking through all of the trunk groups.  Write down all of
the phone numbers it gives you and try them.  They can usually be found on page
three or so.

A LOT of the time, places call forward a back line or so to the actual PBX.  If
there is no remote access extension when you display the remote access, you are
shit out of luck unless you have a higher default and read the rest of this
text.


Setting Up Your Own PBX
~~~~~~~~~~~~~~~~~~~~~~~
If you have a higher default, you will notice that if you type help, you have
more commands that are available to you, such as change, download, etc.
Remember, the company can change the privileges of the defaults so if you
cannot see these commands, use another default.  The first thing you want to do
is to display the dialplan.  This will tell you the amount of digits and the
first digit of all of the sequences.  Here is an example of a dialplan.  There
are several ways the dialplan may look.

                 Number of Digits
-------1----2----3----4----5----6----7----8----9
--
F 1
I 2        Tac
R 3
S 4             Fac
T 5
  6               Extension
D 7               Extension
I 8        Tac
G 9
I 0 Attendant
T *
  #

Using the above chart, all extensions will start with either a 6 or 7 and will
be four digits long.  The Tac is two digits, and will start with a 2 or an 8.
Don't worry about FAC or any others at this time.

After you make note of this, type "ch rem" (change remote access), go to the
extension line, and put in an extension.  Next, find the trunk group that you
want to use and type "ch tru #".  Go to the line for night service and put the
extension in there.  If there is already an extension for night service on all
of the trunks, don't worry. If not, add it, and then save it.  If it says
invalid extension, you misread the dialplan.  If you pick an extension already
in use, it will tell you so when you try to install it in the remote extension
line in the remote address.  Once all of this is completed, you may go back to
the remote access and add a code if you like, or you may just enter "none" and
that will be accepted.  THE NEXT PART IS VERY IMPORTANT!  Look at the trunk
that you installed and write down the COR number.  Cancel that command and type
"dis cor #".  Make sure that the Facilities Restriction Level (FRL) at the top
is set to 7 (7 is the least restricted level & 0 is the most) and that under
calling party restrictions & called party restrictions, the word "none" (lower
case) is there!  If they are not, type "ch cor #" and make the changes.  Last,
type "dis feature".  This will display the feature access codes for the system.
There will be a line that says something like "SMDR Access Code."  This will be
the code that you enter after the barrier code if there is one.  I have seen
some be like *6, etc.  Also, there will be, on page 2 I believe, something to
the like of outside call. usually it is set to 9 but check to be sure.   That's
about it for this segment.  All should be fine at this point.  For those that
want a 24 hour PBX, this next section is for you.


For those of you that are greedy, and want a 24 hour PBX, most of the steps
above are the same.  The only difference is that you will look through all of
the trunks until you come across one that has several incoming rotary lines in
it.  Simply write down the port number and the phone number for future
reference and delete it by using the "ch" command.  From the main prompt, type
"add tru #".  For the TAC, enter a correct TAC number.  Keep going until you
get to the COR.  Enter a valid one and remember that the FRL should be set to
7, etc.  Keep going...the next line that is vacant and needs something is the
incoming destination.  Set it to the remote extension that you have created.
The next vacant line I think is type (towards the middle of the page).  Enter
ground and it should print out "ground-start."  If there is a mistake, it will
not save and it will send you to the line that needs to have something on it.
After all is done, it will save.  After this segment, there is a copy of a
trunk and what it should look like for the use of a PBX.  Next, go to page 3
and enter the port and phone number that you wrote down earlier.  Save all of
the changes that you have made.  This should be all you need.


One more way!  If you scan through all of the extensions on the system, you may
find an "open" extension.  This extension may be like the phone outside in the
waiting room or an empty office or whatever.  This extension must be a valid
phone number on their network or must be reachable on their AUDIX for this
method to work. If you know how to add ports to Audix, this method will be best
for you since setting up a trunk is not needed.  If you find something like
this, it's usually better to use this as your 24 hour PBX rather than taking
away a line for several reasons:  1) there are less changes that you must make
so there will be less data saved in the history file; 2) other people that have
legal uses for the line won't trip out when they get a dial tone; and 3) the
company will not notice for some time that they've lost an extension that is
hardly used!  To set it up this way, you must delete the old info on that
extension by typing "remove extension #".  It will then show you the station in
detail.  Save it at that point and it will be deleted.  Next go to the remote
access and enter the extension that you deleted on the remote extension line.
Next enter a barrier code or "none" if you don't want one.  Save it!  Doing it
this way USUALLY does not require a new trunk to be added since the port is
already in the system but if you run into problems, go back and add it through
the use of a trunk.  You will still have to assign it a "cor" in the remote
access menu, and remember to make sure that the FRL and the restrictions are
set correctly as stated as above.


In part 2, if there is a demand, I will tell how to make a bridge off of a 75.
It is a lot more difficult, and requires a lot more reading of the manuals.  If
anyone can obtain the manuals, I would strongly urge them to do so.  Also
potentially in part 2, I will show how to create a VMB.  If they have AUDIX
voice mail, chances are they have a 75!

So happy hunting and see ya soon!

If you need to get a hold of me to ask a question, you may catch me on the nets
or on IRC.

Enjoy!

Scott Simpson

-------------------------------------------------------------------------------
APPENDIX A : Example of a Trunk For PBXs

                              Trunk Group                    Page 1 of 5
                              -----------

Group Number #               Group Type: co                Smdr Reports: n

   Group name: Whatever ya want         Cor: #            Tac: #

Mis Measured? n

   Dial access: y    Busy Threshold: 60      Night Service: What will answer
                                                            after hours

Queue length: 0  Abandoned call Search: n   Incoming Dest: What will answer
                                                           any time the # is
                                                           called unless NS
                                                           has an extension.

    Comm Type: voice       Auth Code: n     Digit Absorption List:


      Prefix-1? n    Restriction: code    Allowed Calls List: n

   Trunk-Type: Ground-start

 Outgoing Dial type: tone

  Trunk Termination: whatever it is        Disconnect Timing: Whatever it is
                     to.                                      set to.
                             ACA Assignments: n


[Page 2 is not all that important.  It's usually used for all of the
[maintenance to the trunk etc. so leave it all set to its default setting.]


                                                  page 3 of 5
       Port        Name        Mode      Type       Answer delay
1   Port number  phone number
2
3
etc.


That's all that is needed for the trunks.
-------------------------------------------------------------------------------
APPENDIX B : Basic Commands and Terms

     Basic Terminology
     -----------------
COR  - Class Of Restriction
FRL  - Facilities Restriction Level
SMDR - Station Message Detail Recording
TAC  - Trunk Access Code
FAC  - Feature Access Code


     Basic Commands for Default Emulation (513)
     ------------------------------------------
Esc Ow - Cancel
Esc [U - Next Page
Esc SB - Save
Esc Om - Help


     Commands for 4410
     -----------------
Esc Op - Cancel
Esc Ot - Help
Esc Ov - Next Page
Esc Ow - Back Page
Esc OR - Save
Esc Oq - Refresh
Esc Os - Clear Fields

Below is an explanation of all of the commands.

The following is a captured buffer of a login to System 75.  I have captured
the commands and have edited the buffer to include brief definitions of the
commands.

Display and list are basically the same command, but display shows more
detailed information on the command that you select.  For example, "list tru"
will list all of the trunk groups in the system.  "dis tru" will ask for a
trunk number, and then display all of the information on that trunk.

CH Help
Please enter one of the following action command words:

add                      duplicate                save
change                   list                     set
clear                    monitor                  status
display                  remove


Or enter 'logoff' to logoff the system
Add       - Is pretty self-explanatory
Change    - Is also self-explanatory
Clear     - will clear out the segment
Duplicate - will duplicate the process
List      - self-explanatory
Monitor   - used for testing, and monitoring the system
Remove    - remove anything from the system EXCEPT the History File!  Sorry
            guys!
Save      - saves work done
Set       - sets the time, etc.
Status    - shows current status of the system

List Help
Please enter one of the following object command words:
                      COMMANDS UNDER "LIST"
abbreviated-dialing      groups-of-extension      personal-CO-line
aca-parameters           hunt-group               pickup-group
bridged-extensions       intercom-group           station
configuration            measurements             term-ext-group
coverage                 modem-pool               trunk-group
data-module              performance

Or press CANCEL to cancel the command
Abbreviated-Dialing: Speed calling feature from their voice terminal
Aca-parameters: Automatic-Circuit-Assurance
Bridged Extensions: Used for bridging extensions together
Configuration: Overall system Configuration
Coverage: Call Coverage
Data-module: Description of the data module used
Groups Of Extensions: Lists all of the extensions available
Hunt-Group: Checks for active or idle status of extension numbers
Intercom-group: Lists the intercoms and their info
Modem-Pool: Allows switched connects between data modules and analog data
Performance: Shows the performance of the system
Personal-CO-line: Is for dedicated trunks to or from public terminals
Pickup-group: Pickup station setup
Station: Will list all of the available stations assigned
Term-ext-group: For terminating extension group
Trunk-Group: Lists ALL of the trunks; will NOT show all details like Display

Dis Help
Please enter one of the following object command words:
                    Commands Under 'Display'
abbreviated-dialing      data-module              personal-CO-line
alarms                   dialplan                 pickup-group
allowed-calls            digit-absorption         port
announcements            ds1                      psc
attendant                errors                   remote-access
button-location-aca      feature-access-codes     route-pattern
circuit-packs            hunt-group               station
code-restriction         intercom-group           synchronization
communication-interface  ixc-codes                system-parameters
console-parameters       listed-directory-numbers term-ext-group
cor                      modem-pool               time
cos                      paging                   trunk-group
coverage                 permissions


Or press CANCEL to cancel the command
Abbreviated Dialing: Covered above, but shows more information
Alarms: Will show information on the alarms (which ones are on/off)
Allowed-Calls: Will show LD carrier codes and allowed call list
Announcements:
Attendant: Allows attendant to access trunks without voice terminals
Button-location-aca: Will show the location of the aca selected
circuit-packs: Tells types of lines used.
Code-Restriction: Shows restrictions for HNPA and FNPA
Communication-Interface: Information on the communication interface
Console-Parameters: Will list the parameters of the console, etc.
Cor: Class Of Restriction (will show the cor for the # entered)
Cos: Class Of Service
Coverage: Shows the coverage of the system (voice terminals, etc.)
Data-Module: Will show information for the data channels entered
Dialplan: List the current config for extensions etc.
Digit-absorption:
Ds1: Used for tie-trunk services
Errors: Shows all of the errors on the system
Feature-Access_Codes: Lists all of the feature access codes for all of the
                      features on the entire system
Hunt-Group: As above, but will tell more information for the # you enter
Intercom Group: Lists all of the names and their intercom assignments
IXC-Codes: Inter-eXchange Carrier codes
Listed-Directory: Lists the numbers in the directory of the system
Modem-Pool: Will show info on the channel you select (exp baud, parity, etc.)
Paging: Used for the paging stations on the voice terminals
Permissions: Will show the privileges of the other accounts/defaults
Personal-CO-Line: As above but more descriptive
Pickup-Group: Shows names and extensions in the specified group number
Port: Will show the info on the port you ask about
PSC: Keeps a call between to data points connected while the system is active
Remote-Access: Will show the Remote Access that is there (if any)
Route-Pattern: The pattern of routing within the voice terminals, etc.
Station: Will show detailed information on the station # you enter
Synchronization: Will show the location of the DS1 packs
System-Parameters: List of all of the available systems parameters
Term-Ext-Group: As above but more descriptive
Time: Will show the current time and date
Trunk-Group: Will show all available information for the trunk you select