TUCoPS :: Phreaking Voice Mail :: audexvp.txt

Hack AUDEX Voice Power VMB Systems

DEX-                                                                    DEX-
EX-A                        HACKING GUIDE TO THE                        EX-A
X-AU                                                                    X-AU
-AUD                         AUDEX VOICE POWER                          -AUD
AUDE                                                                    AUDE
UDEX                             WRITTEN BY                             UDEX
DEX-                                                                    DEX-
EX-A                      --==>> CRAZYBYTE <<==--                       EX-A
X-AU                                                                    X-AU
UDEX                                                                    UDEX
DEX-                    CALL SIN CITY: +32-3-8252274                    DEX-
EX-A                                                                    EX-A

/\/--> DISCLAIMER <--\/\
Ohooh... I'm scared as shit so I accept no responsibility for any actions
taken by readers... blahblah NOOOOOOO...
This text is written with the intention that readers of this text hack
Audex Voice Power vmb's, and I sure as hell hope that as from now on every
fucking Audex Voice Power in the galaxy gets abused by hackers.

/\/--> INTRODUCTION <--\/\
The Audex Voice Power is the predecessor of the Audex we all know just under
the name Audex today. There aren't that much of this older system around,
but the few I found were fucking easy to hack. And again: vmb's are fun to
have, you can trade them for xxx (fill this in), they lower your phone
bill,... (you've heard this shit before).
Anyway, lets get down to business...

Well, you can't recognize them from the first greeting, but the greeting
will probably contain the usual 'press the ext. of the person you want to
reach' and the (special for Audex Voice Power) 'if you want to transfer
using names instead, press the pound (#) key'.
To REALLY be sure it's an Audex Voice Power: press *7, if it responds with:
'Welcome to Audex Voice Power, please enter extension and # sign' you've
got yourself an easy-to-hack Audex Voice Power vmb.

/\/--> LOGGING IN <--\/\
Press *7, you are asked to enter your box number, these are can be 3 or 4
digits, but I haven't found a mixture of the two on one system so far.
After you've entered the box number, press #, enter your password and press
# again. If you entered and incorrect box number or password, it will say
'Login incorrect, please try again,...'. On the systems I found you could
try 4 times to login before you get disconnected. When you get disconnected
it will say: 'Contact administrator for help, please disconnect... goodbye'.

The boxes are grouped, and they will usually be in 2XX or 2XXX. The default
password is the same as the box number, just like on allmost all other VMB

There are two easy ways to find boxes (and one difficult, and another one
if you really want a box but had extremely bad luck):

1. On the two systems I'm using right now, the attendant-extension (0)
   has 0 as password, and on one of those two, the options at the login-menu
   have also got the same password as their extension number (1 for xxx, 2
   for yyy,...). So first thing to do is trying 0 -> 9, if you can't get in
   with these, read 2.

2. So you couldn't get in by trying extensions 0 -> 9.
   Most systems have a directory where you can transfer to people's
   extensions by entering the first letters of their last name.
   To find the directory, just listen to the first greeting you hear when
   you call the VMB. (you know, 'welcome to xxx... if you need assistance
   press 0, otherwise press the extension of...'). Usually you have to
   press # at the login menu. Now, when you enter the directory option,
   the system will respond with: 'Please enter the last name of the person
   you want to reach'. Don't enter a complete name, just press 5 or somtehing
   and the # sign. By the way: lots of VMB systems have some sort of
   directory, and allmost every VMB system I found had users with last names
   'Smith' or 'Jones' (some popular names in the US, and characters from a
   stupid TV series). Well, lets continue with Audex Voice Power. After you've
   pressed #, the system will say 'to select blahblah press x' and will
   start saying names. Now a lot of users also say their box number, so
   a lot of these names will be like 'John Doe, extension xxxx'. Just
   write these down. If you found how many digits the box numbers are,
   and where they are grouped, hang up and call again.
   Now start trying the box numbers you just found, you probably will get
   in using the box number as password the 2nd or 3rd time you call, since
   a lot of people don't use their VMB's, or don't know shit about it, so
   haven't changed their password.

3. Couldn't get in with one of the above methods ? Never happened to me,
   but I guess it's possible. Here's what I would do in such a situation.
   Don't use the login (*7) options to scan for boxes because then you don't
   even know if it's a valid box. Just transfer to them from the main menu,
   so you know how much digits the boxes are, and where they're located
   (since they 'live' in groups). There's a 90% chance the boxes are located
   in 2xx(x). If you entered an invalid box number, it will first try to
   transfer you, and then it will say something like 'your transfer couldn't
   be completed'. Since you don't have to press # after entering an extension
   to transfer to, it's possible that f.e. after pressing only one digit you
   will get transfered (read point 1 of this paragraph). When you've located
   an area that contains lots of valid extensions, try to hack a box in that
   area with the login (*7) option.

4. Still didn't find a box ??? Well, the best thing you could do in this
   case is bullshit to the operator. If you couldn't find the area that
   contains the boxes, and there's no directory, ask her for the extension
   of f.e. Smith and say you don't know anything else about this Smith.
   If bullshitting the operator didn't work either, just try to transfer to
   an extension, and ask the person that picks up the phone for their
   password. You could say that you're from maintenance, and are installing
   a new option in the boxes so that people are able to use outside lines
   from within their boxes or something.

5. You still couldn't get a box ? Well, give up on this system and scan for
   another VMB system. I NEVER found a system I couldn't get a box after
   about ten minutes using the method in points 1 and 2 so you are trying to
   hack a system that has allready been badly abused by hackers or otherwise
   you are EXTREMELY dumb.

/\/--> OK, YOU'RE IN A BOX, WHAT NOW ??? <--\/\
Well, use press 2 to listen to the messages, but only listen to the dates they
were created. So press # every time to skip to the next message.
If it contains new messages from 3 months ago, then it means that the legit
user didn't use his box in 3 months. You can safely listen to the messages
and use this box without the risk of loosing it in 2 days.
If it contains no messages it could be possible that the user checks the VMB
regulary, or that it has never been used in which case you got yourself a
good box again. There's no quick way to find out if it's unused or often used
in this case, just use this box to scan for other ones (look below), or check
regulary if there are new messages and if they get deleted afterwards.

There are different ways of scanning for other boxes, but the quickest is
the following:
First choose option 5 from the main menu, then press 1 to create a
distribution list. You will be asked for an ID for the list, just press 1
or something followed by #. Now start entering box numbers, followed by #.
If the box is valid, the system will respond with the name of the owner, or
when you're lucky, the system will sa: 'Extension xxx', in which case you
should write the number down because you've got a 99% chance this is an
unused box. If the box is not valid, the system will say 'Extension xxx not
valid'. When you've collected some numbers, press *# and then *3 to delete
the list. Now hang up, call again and try what boxes have the same passwords
as their box numbers.

From the main menu you've got the following options:

1.  Record a message
2.  Listen to messages
3.  Administer name or greeting
5.  Administer password and distribution lists
6.  Change outcalling info (INTERESTING)
*8. Transfer to another extension


      You will hear a beep, record your message after the beep. When
      finished recording, press 1. Now you've got the following options:

         21: Re-record : Your message will be deleted and you can record
                         it again.

         23: Playback  : Just as it says: your just-recorded message will
                         be played back.

         *3: Delete    : Your message will be deleted

         *#: Approve   : Now enter the boxes you wish to send your message
                         to, followed by #. When finished type *#. To delete
                         the last entry (box), type *3.


      When there are no messages, you will go back to the main menu.
      Otherwise you will hear the date and time the actual message was
      delivered, and the name (if specified) of the sender.

         0 : Listen : Listen to actual message
             While listening you can use these commands:
               2 : Rewind message. If you press it again you will go to
                   the previous message.
               3 : Pause. Press 3 again to continue playing.
               5 : Rewind and play
               6 : Goto end of message

         # : Skip   : go to next message

         *3: Delete : actual message will be deleted

         1 : Respond/forward message
               1 : Reply      : Send an answer to the sender
               2 : Forward    : Record a comment before the message and send
                                it to someone else.
               4 : Record new : Record a new message. This does exactly the
                                same as option 1 from the main menu.


      This submenu will enable you to record name and greeting, and to
      specify what greeting will be used.

         1 : Greeting : The message that will be heard whenever someone
                        wants to leave a message in your box.
               1 : Record : Record after the beep the greeting that should
                            be played. Press 1 to end recording.
               2 : Listen : Listen to your greeting.
               *#: Select which greeting should answer.
                     9 : Personal greeting.
                     6 : Standard system greeting.

         2 : Name     : The message that is heard when someone sends or
                        reveices messages to/from your box.
               0 : Listen : Listen to name.
               1 : Record : Record name.


      Distribution lists are used when you regulary need to send messages to
      several people, and don't want to waste time with typing all their

         1 : Create : Creates a new distribution list. First you will be
                      asked for an ID for the list. Now enter f.e. 1 followed
                      by #. You can now enter a box number followed by #,
                      repeat this untill you inputed all the box numbers for
                      the distribution list. If you entered a wrong number,
                      just press *3 to delete the last entry. When finished
                      press *#.

         2 : Scan   : With this option all distribution lists ( If you got
                      any ) will be said, and after saying the ID of the
                      list, you've got the following options:
               *3: Delete : Delete this distribution list.
               # : Skip   : Go to the next distribution list.

         3 : Review : This option will allow you to change other users' or
                      your own distribution lists. First enter the box number
                      followed by #, or for your own box, just press #.
                      Now enter the ID of the distribution list followed
                      by #. The system will say how much entries there are in
                      the list, and name them one by one, giving you the
                      following options after naming each entry:
               # : Skip   : Go to the next box.
               *3: Delete : Delete this box.
               1 : Add    : Add a box.
               *#: Quit   : Stop review of the entries in the list.

         4 : Change PW : Enter your new password followed by #. After
                         entering it, you have to enter it again followed
                         by # to check if you didn't enter it wrong the
                         first time. The password can be 1 till 9 digits.
                         If you just press # when you're asked to enter it,
                         no passwords will be assigned to your box.


      The outcalling option is quite fun. Not everyone is allowed to do it,
      but if you find boxes allowing outcalling, you can use them to call
      friends, boards or even alliance... I wouldn't suggest putting your
      own number there, but it would be quite fun that when someone calls
      you up using the VMB (on a tollfree number ???), and you don't answer,
      he can leave a message and stuff...


         1 : Change  : Enter the number your calls should be transfered to,
                       followed by #. To exit press *#.

         3 : Info    : Will give you instructions on how to enter the number
                       with option 1. If you want to insert a pause in the
                       dial string, use * to pause for 4 seconds. If your
                       number needs to be ended with a #, start your dialing
                       string with ##. Normally you can't end with a #
                       because if you do that, the system thinks that it's
                       the end of the dialing string. This is usefull for
                       pagers and other stuff (use your imagination).

         6 : Disable : Turn outcalling off.

         9 : Period  : Specify the outcalling period.
               1 : Outcalling allowed during the system administration hours.
                   F.e.: Only between 8 AM and 6 PM.
               2 : Outcalling allowed 24 hours a day.

/\/--> GREETINGS <--\/\
And last but not least some greetings to:
(A-Z to avoid 'why did ya put X before me ?')

Analog:        Forget that I told you to kick off Flaming Chaos as a CO.
               Making a new BBS proggy ?

Apollo:        Hope your exams are better than mine... nice talking to ya
               over the VMB.

A.R.U.P.:      For having such a nice and virgin Audex Voice Power VMB.

               COPS IF I HAD THE CHANCE (same goes for all kind of security
               personnel and the endless amount of lamers on this planet).

Donald Duck:   Where R you ? Is your girlfriend SO interesting ? We miss
               your expertise...

Einstein:      You're lame and you know it. Hah, I puke on guys like you.
               I'm not a violent guy, but I swear I'll smash your head when
               I ever meet you.

Flaming Chaos: Sorry I offended you dude, but I didn't know about that '|',
               so I thought the message was specifically written for me.

Invalid Media: Quite nice board... too bad you had to make it codefree.

Jules:         Your board is OK, but why is it down so much ?

Larry:         You're a lamer and your problem is that you won't admit it.

Oink:          Hmmm... so you agree that HP3000's are Boooring... Unixes are
               1000 times more phun...

Ralph:         Been fucking around on the nets lately ???

Sintax:        Happy now that I put some greets in ? Don't you ever get bored
               of CIS ?

Slycath:       Nice texts, continue your good work...
               btw: I LUV Robbie Robot... (and his frog puppet)

Predat0r:      Your board is the living proof that a board doesn't need an
               HST to be one of the best.

Thor:          How is army ? Why don't you do something usefull while you're
               there and look for their computer dialups (if they're using
               any (hehe)).

Trap Zer0:     Nice texts about the VMB's. Getting active again ?

Vinny:         You probably won't read this, hehe... your handle is with 'V'
               so you're last... anyways, THANKS for everything you 'teached'
               me, THANKS for the job you can get me, GOOD LUCK with the PC.

???:           To all guys who call me when I'm sleeping: FUCK OFF.

And... to all guys I forgot and also the few cool guys I know among all the
lamers in the lame Amiga scene. Only greets here to guys I know involved
in HPA, this will be the first and the last time I put up such a greetings

 - All texts about Night Ranger, he's the VMB expert.
 - Texts about Aspen and Cindi systems written by Slycath.
 - Texts about the IADS and Message Centers by Trap Zer0.
 - Ofcourse all texts written by me (hehe).

 - Unix command overview
 - Hacking Meridian Mail
 - HP3000 quick command reference

/\/--> TEXTS TO WATCH OUT FOR <--\/\
 - Maybe a text about the IADS coz I think it's the best VMB ever made.
 - Text about Audex (the new Audex Voice Power system).
 - Probably some texts about hacking Unix or the MPE XL or V OS on HP3000's.


User CRAZYBYTE ending interactive session at 17:02.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH