The    
                                 --=RoT=-- 
                                 Guide To  
                              GANDALF  XMUX'S   
                          -----------------------
                                Written by:
                                  Deicide
                        ===========================
*NOTE: While writing this file i assumed that the reader has a working       
knowledge of Packet-Switching Networks(Such as Sprintnet, Tymnet & Datapac).
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
      
      The Gandalf XMUX is made by Gandalf Technologies Incorporated. It is 
one of the 3 popular systems Gandalf makes, the others being the Starmaster 
and the PACX. These systems are very closely knit, as you'll see later, but 
the focus of this g-file is on the XMUX system. I still don't have a XMUX 
manual, so this file will be a bit incomplete, but it will give you a good 
sense of the system; How to Identify it, How to Penetrate it, and How to Use 
it. There are a number of security flaws in the XMUX, all of which can be 
circumvented but frequently are not. Occasionally you will find an 
unpassworded console, in that case just move on to the How to Use it section.
      The Gandalf systems are very frequently found on all the major 
packet-switching networks, as Gandalf's themselves often serve as network 
controllers. Most of the major companies, such as Xerox & Bell Canada, use 
XMUX's, so it is a good idea to become familiar with the system.

How To Find Your XMUX & How To Identify It
------------------------------------------
   First of all, if you find an unpassworded XMUX it will tell you by the 
herald "Gandalf XMUX Primary Console Menu" followed by the menu itself. Skip 
this part for now. 
   But for the rest of you, you probably still need to find your XMUX, and you
need to know how to identify it.
   Before we get further into this, a small amount of knowledge of the whole
scope of the XMUX is needed. Every XMUX is made up of at least 4 parts, 
each present on every single XMUX. These parts are called:
  -      Console
  -      Fox
  -      Logger
  -      Machine
The Console is the actual system, the part that has to be hacked, the part
that contains the information we are attempting to retrieve.
The Fox is a test machine, serving no other purpose except to spout 
"THE QUICK BROWN FOX JUMPS OVER THE LAZY DOG 1234567890 DE" over and over 
again.
The Logger is displays a line or two of information such as the time & the LCN
called, for the most part unimportant. But it does contain the node name.
The Machine is basically a system information giver. I have yet to discover
all of it's commands, but S gives some systems stats(including the node name)
and L is an optional command that supplies the user with a system log(which
contains link addresses & UID's).
All of these can be useful in some way.
   The XMUX can be found in a number of ways:
  - On a standard NUA(XXXX XXXX)
  - On a standard NUA + extention(XXXX XXXX,XXXXXXXX)
  - On extentions off of Starmasters & PACXs.(XXXX XXXX,XXXXXXXX)
  - On LCN's(subaddressing) off any other type of system/OS.
??????????????????????????????????????????????????????????????????????????????                                                         
NOTE:"Password >" is the password prompt for the XMUX Console, occasionally
proceeded by an operator definable system message such as "Vancouver XMUX".
To be sure that this is a XMUX prompt, hit <ENTER>. If it returns the message
       "Invalid Name
        Names must consist of 1 to 8 alphanumeric characters"
Then you are dealing with the XMUX Console.
??????????????????????????????????????????????????????????????????????????????
On a standard NUA it will bring you right to the "Password >" prompt, no 
hassles. You can then proceed to the section that deals with hacking the 
console.
On a standard NUA + extention, it is not so easy. When you first hit the NUA,
it will give you the "Remote Directive" error message, telling you that you
"forgot" the extention. Now, the error message could mean you forgot the 
extention for a VAX, also, but we will assume that it is a XMUX on the NUA.
This is true only a fraction of the time, but try this on every Remote 
Directive message, you'll find a good share of XMUX's. First of all, try the
LCN(subaddress) of 1 on the NUA. If you come up with the Fox segment of the
XMUX(explained earlier) then you have an XMUX Console on the NUA, it's just
hiding. If the LCN brings up the Remote Directive message again, then try
the extention of LOGGER on the NUA. If it brings up the XMUX Logger, then 
again, the XMUX Console is there, but with a bit of security added on. If you
now know that you are on an XMUX, try the CONSOLE extention. It should bring
you to the "Password >" prompt, or occasionally right inside without needing
a password.
Starmaster's and PACX's almost ALWAYS have an XMUX attached on to it. Use the
Starmaster or PACX's NUA + the extention CONSOLE. It will most likely bring
you to the "Password >" prompt.
The LCN's off all the other system/OS types is a bit more complicated. You 
can either guess,pick the likely ones, or try them all. What this is is an
XMUX in coexistance with another type of system, such as AOS/VS. The most 
common way to find these is by adding an LCN of 1 to the NUA of the system.
If it comes up with the XMUX FOX section, then you can be sure an XMUX is
present. To find the XMUX Console, use LCN's of 4 and above(2 & 3 being Logger
and Machine), up to the LCN of 15(maximum on XMUX). If you still haven't found
the Console, and it's returning the Remote Directive error message, now's the
time to use the CONSOLE extention. In most cases it'll bring up the 
"Password >" prompt, or right into the Console Menu.

HOW TO PENETRATE THE XMUX CONSOLE "PASSWORD >" PROMPT
-----------------------------------------------------
   To start you off, XMUX Console Passwords MUST be within 1 to 8 alphanumeric
characters. Any combination within that boundary is an acceptable password.
Now, while it is true that the password could be a random letter/number
combination, such as G2Z7SWJ8, and therefore extremely impractical to hack, it
is almost a given that the password is a relevant word or abbreviation, with
not more than one numeric character, which is usually not even included.
Also, you get 4 attempts at a password before being logged off, and remember,
you don't even need to find a username.
   When you first reach the "Password >" prompt it's a good idea to try the 
defaults(in order of occurance):
        - Gandalf
        - Xmux
        - Console
        - System
Also, Password(no, really), Network, CPU, Switch & Network are also frequently     
found.
   Then, if the defaults don't work, it's time for a little calculated brute
forcing. If the system has a herald, such as "BenDover Field Communications"
then try everything you possible can thing of that is relevant to the herald,
such as Bendover, Ben, Dover, BDFC, Field, Telecom, etc. Also, combine these
with the defaults, particularly Xmux. As in BenXMUX, or FieldMux, etc.
   If there is no herald, or all the thing you can think of to do with the 
herald fail as passwords, then it is time to get the node name. The node name
is used very frequently as a password, thus a good thing to try. But where to 
get the node name with out getting the password first? It is contained in two
other places other than the Console, with ALWAYS at least one of the
facilities open to you. The Logger(LCN 2, or extention LOGGER) always spurts
out the log name first upon connect. This is always available, i have only   
seen one case in which the Logger information was protected, and that was 
achieved by wiping it out, which very few people do. The other source is the
Machine(LCN 3, or extention MACHINE), a very handy source of information. 
You will recognize the Machine by its "#" prompt. At this prompt type "S" for
system stats. The first thing you see in the system stats is the Node Name.
Also, with machines type "L". Occasionally it will be set to show the log, 
which contains the Link Addresses(usually other netted computers, frequently 
Gandalfs) and UID's as well. Try the Node Name by itself as a password, then
in combination with all the above, such as a combo of Default & Node Name.
   If you follow all these above methods, 50% of the time you will find the
password. Remember, people are stupid. An elitist attitude, but it works.
   If you don't get the password, don't worry, there are many more XMUX's out
there with poor security, go for those. But before you move on, try the LCN's
from 4-15, frequently you'll find another system, often a private PAD or an
outdial.

WHAT TO DO WITH THE XMUX CONSOLE ONCE INSIDE
--------------------------------------------
   For those itching to read other people's mail, or retrieve confidential 
files, etc, you will be very disappointed. Although once inside the XMUX 
Console you have virtual Superuser status, the commands are all maintenance
related. But, often you will find other systems, quite often networks, PADs,
& outdials from inside.
   You will first encounter the primary menu, which looks similar to this:
Gandalf                         XMUX                           (date)
Rev(version)            Primary Console Menu                   (time)
                             Node:(nodename)
Primary Menu:
 1. Define
 2. Display
 3. Maintenance
 4. Supervise
 5. Exit
Primary selection >

   Now, although there are some other useful and interesting features to the 
XMUX console, i will only show you the 3 most useful features, those being
Abbreviated Command, Service & Call Status.
   Abbreviated Command is an option found in the Define sub-menu. Hit 7 once 
inside the Define sub-menu to bring up the Abbreviated Command prompt. Type
a ? to show all the abbreviated commands. If there are none, curse your luck
and move on to the next feature. If there are some, type them in, one at a 
time. Each Abbreviated command is really a macro, and a macro of a NUA plus
the subaddressing and data character extension needed to enter the system.
These can be very useful, not only for the NUA & subaddress, but for the fact
that the extension is included. Most times extensions are hard if not 
impossible to guess, and the macro throws it right in your face. The 
Abbreviated Command is in the format of XXXXXXXXdEXTENSION, in that the X's 
are where the NUA is placed, the EXTENSION is the extension characters, and 
the 'd' is really where the comma goes to separate the two. So if the 
Abbreviated Command was 55500123dabc, the NUA would actually be 
    -  55500123,abc  -
   Service is a menu option also from the Define sub-menu. What it enables 
you to do is view all the services available, plus their function & 
LCN. Type "11" from the define menu, then "?" for a list of the services 
available. Console, Fox, Logger & Machine will always be present. Anything 
else is a bonus, and should be capitalized upon. For example, if you see
"Modem" as one of the services, then enter "Modem" from the Service 
sub-sub-menu to see which LCN the modem is on.  
   Display Call Status is a handy command used from the Display sub-menu 
which gives a log of all the calls the system has handled. In the call log
are the NUA's of the system that called, often a netted system such as another
Gandalf.
   
CONCLUSION
----------
   Well, that's all for now..if you have any questions or comments you can 
reach me at the RoT HQ's listed below, or most of the other RoT sites.
BTW, for anybody truly interested in any of the Gandalf types, contact me and
i'll supply you with the NUA's for Gandalf Technologie's BBS & 
Employee/Manager Sites..... 
        Deicide   
-=RoT=- H/P Coordinator
        
                      -=RoT=-                -=RoT=-
                        WHQ                   US HQ
                   6 ŸîîT –ïDäR             The Cellar
                  (604) 824-0317          (401) PRI-VATE