[ Notice : Typed On 02/15/92 Before Distribution ] Hello, everyone! If anyone remembers me, yes, I am Hackmaster, the ex- leader of Phreak Out!, The Midnight Society, and The Underground Crime Network. Unfortunately, I was busted in early 1991, and am unable to continue UCN. As I was going through old files, I found this : One of our member-only files. I don't think I had finished it, but I'm sure it can help you guys out, since it is a very big text file on VMB hacking. I would finsh it, but times have changed, and I dont remember much about that anymore. Looking through, I'm not close to finishing. Now for the good news. I AM still out here, and will help you as much as I can. If you need to contact me, call one GREGDoor BBS @ (708) 904-2149. If it's down for some reason, try these boards. I dont check these as often, but I do check them. Later, and good luck! BTW, If I find more files, I'll shoot them out. I still do 'other stuff'. IF YOU NEED HELP OR INFORMATION, DON'T HESITATE TO ASK! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= UCN Member Only File # 017 : Most Complete VMB Hacking Guide Ever Published By : Hackmaster - Thank you for supporting the Underground Crime Network -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Hi! What's up? This is Hackmaster, the leader, bringing you another member only file. I noticed upon looking at about 10-15 articles I could find on VMB hacking that NONE of them were complete enough to be helpful at all. In this guide, I will tell you how to identify a system, and how to get into that particular system. Dont forget (as with all member files) the information within is for members only. Do not give this file or the information in this file to any non-member, or you could be expelled from UCN. AVR - Known for it's "Message Center", it is usually mistakenly called a message center system. During the greeting, you can hit "*", and it will say "Hello, (name), Please enter your passcode". If you hit "*" again, and a lockout is not active, it will either say "Welcome to the message center", or the system administrator will have put a personal message that says something like "Please enter the 4 digit extension you wish to reach" This system is a great system, since it is hard to narc on, considering these systems rearely have an operator, and are often very hard to narc on. A lot of times, you will find a box with all 9's on the system, but the system administrator box ends with an "8". As an example, a 3 digit system would be "998", and a 4 digit system would be "9998". If you happen to stumble into the system administrators box, hit "8" for User Options, then "8", and it should take you into the system administrator menu. A default box on many of these systems is "1111", which (when there), will usually be empty. This system usually has 4 digit box numbers, but also semi-frequently has 3 digit, and 7/10 digit (phone numbers) box numbers. If you find a direct dial system of this type, most of the time hitting "*" after it asks for your passcode, it will not do anything, taking the "*" as a digit of the passcode. That is because the system is "locked out", preventing you from accessing the message center.. If you want to find an empty box, you must hang up, and call 1 up or down from that number, and keep doing so until you have found one. On direct dial systems, if you have an invalid number, but the number you dialed is still with in the range allocated for the AVR system, it will say something in it's computerized voice. Depending on what the administrator picks, it will be "The number you have dialed is not in service. Please try your call again", "Please try your call again", or "Call again". When you get this recording, it is a standard error recording, and you will not be billed for it on toll calls, and the sys admin will not be billed for the call on 800 calls. (-*-) Name : AVR - aka Message Center (-*-) Example System : 3 digit - 800-950-4826 (-*-) Default Passcodes : User set - 1111,1212,1234,5555,9999,NONE,BOX,2580* (-*-) SysAdmin Box : Usually all 9's + 8 (Eg. 998 or 9998) (-*-) SysAdmin Default : * 2580 is a system administrator default passcode. (-*-) Other Features : Pager Service (but rarely) (-*-) Notes : The AVR system has a replacement message center welcome greeting for another company which says something like "Welcome to the Voice-Tel MC." VIX - The VIX system is basically a terrible system, but is fairly common and easy to get into. On a standard system such as the one below, upon calling if you hit "*" it will say "Thank you for calling." and hang up on you. This is because the "*" in a VIX system is for aborting or returning to previous menu. In the original main menu, if you try to go back a menu, you are, of course, disconnecting the call. If you hit "#", it will say "Please enter your mailbox number". You then enter a mailbox # which is usually 3 digits, but can sometimes be 2 or 4, then it states "Please enter your passcode." There is only one default passcode for this system, which is all 0's, and it will instantly stop you upon entering the correct number of digits for the passcode, which is always 3 or 4, depending on how the system is configured. The system administrator box is usually all "9's", but can be any box. To access options inside this, you must use "3" for personal options, or "4" for administrator options (only if you have the administrative box). Please note : The administrator box will allow you to change a mail box name, or the greeting you hear when you first call, menu prompts, etc, but will not let you create mailboxes. Also, most of these systems will transfer you before giving you the voice mail service. On some systems, you can simply hit a key before the mailbox number. For example to access mailbox 314 from one system, you may hit "7+314" or "9+314" when first calling. Most systems do not have this, but there is a gateway, however. You must hit "#" and it will ask for your mailbox number. You then enter the correct one, and it will say "Please enter the mailbox number of the person you want to leave a message to." This mailbox is usually all 5's, but I have seen "100", "055", and some that I never was able to find. Usually, mailboxes on these systems will start at 200 or 300, but can be anywhere in the range. Most systems will hang up on you after 4 invalid passcode attempts (upto 2 mailboxes and 2 passcodes for each), but some will only allow 1 mailbox, and some will go on forever. System Administrator Usage : This system has a complicated system administrator box so I will describe it in detail. All prompts that you hear someone's voice on are actually a mailbox that does not accept messages. The only way to access these is to hit "#" then the mailbox number, and it will take you to that menu. To reprogram these, you first need to find them. This is done by simply stating at "000". Keep going up until it stops acknowledging the mailboxes, then go to "010", and keep going until you run out. Then go into the administrator box and there is an option in which you enter the mailbox, and record the prompt for that menu. If you find one that is empty, you may use it for your own personal use as a non-message taking data box for something such as a VMB directory. Dont be stupid, or the company will find out and take their box back. The same thing goes for the system greeting, which is set up from the menu. I have played "Cant Touch This" at the start of 2 systems' greetings. 1 company closed their 800 # down in 2 1/2 hours (permanently), and the other totally reprogrammed their voice mail system for 4 digit passcodes, etc, in about 2 days (This one was set up on the weekend). Usually, on a system that you are giving boxes on, you want to take the system administrator box and change the passcode, but you will usually not use it. You can also use it as your own personal box. (-*-) Name : VIX (Voice Information Xchange??) (-*-) Example Systems : 3 digit - 800-950-1027 : 2 digit - 800-950-3232 (-*-) Default Passcodes : All 0's (-*-) SysAdmin Box : Usually all 9's (-*-) SysAdmin Default : All 0's (-*-) Other Features : Message Notification (Sometimes Long Distance) : Menuning Feature (Rarely) : Questionairre Feature (Rarely) (-*-) Notes : On a 3 digit passcode system, if you find a box you would like to take over, it takes only a couple hours to go through all the possible passcodes by hand. Sometimes boxes run script questions where it goes from one quesiton to the other, and each question is a menu-box. All answers are logged to the starting box. BIX - This is a great system, but it is normally hard to find boxes. BIX boxes are 3 or 4 digits, and usually have unlimited greeting AND message time. There are some that dont, however, so you will want to time the greeting when you first take the box over. When you first call, you can hit "#" and it will say "Please enter your mailbox number". You can then enter a mailbox number. It will cut you off only if the mailbox number is a correct one. Otherwise, it will sometimes let you go on forever. You can hit "*" and it will say "Please enter the address for your message". On a couple systems, it says "Please dial the extension of the person you wish to reach", but you may hit "*" again for the first message. To scan on this system, you just get it to the "Enter the address for your message" prompt, and enter a mailbox. They usually begin with 200, 2000, or both. Keep going until you get to one where instead of saying "(name) Recording (beep)" it says "Recording (beep)", or "Mailbox 3232 Recording (beep)". You then hit "#", enter the mailbox number, and if it is empty, it will automatically drop you in. There is no default passcode for this system, so you have to scan for empties, which is a pain. It's only disadvantage is it saves all discarded messages until you leave the box, which is a pain in some cases. On many systems there are greeting-only boxes, which are nice to have for VMB directories, etc, but are not too useful since they do not take messages. There is no known system administrator box for this system, but if there is one it remains to be found. To find the number of digits on this system, you have to play around and find a valid box since it will not cut you off. Some systems have 3 and 4 digits that I have seen, and I have seen only 3 or 4 digits. Overall, the BIX is a very nice basic system, especially with its extended greeting and incoming messages. (-*-) Name : BIX (-*-) Example Systems : 3 and 4 digit - 800-521-0850 : 4 digit - 800-477-7691 (-*-) Default Passcodes : Empty (no passcode assigned) (-*-) SysAdmin Box : None (-*-) SysAdmin Default : None (-*-) Other Features : Generous greeting and incoming message time. : Long Distance Message Notification (-*-) Notes : None ASPEN - The ASPEN system is a hard-to-get excellent system, whether it has a 10 second or 10 minute greeting. It has many features that are not matched by its clone. To identify an aspen system, you may hit "*", and it should say something to the effect of "Please enter the number of the person you're calling". You can then enter a mailbox number, and it will take you directly to the mailbox instead of transferring. If you hit "#", it will say "Mailbox Number Please". This is how you find the number of digits of an ASPEN system. I have seen these systems range from 2,3,4,5,7, and 10 digits. Once you push "#", enter "1234 etc" until it cuts you off. You then know the maximum number of digits for that system. If you hit "1234567" and it cut you off saying that was not a valid mailbox number, you would know the maximum length of the mailbox number was 7. There could be shorter ones, but to save years of scanning you want to go with that one. System administrator mailboxes are usually 3000, 9998, or 9999, changing the length for the system size. (300,998, 999, etc). The adminsitrator boxes almost always have changed passcodes, which makes them very hard to access since on an ASPEN system, one can make their passcode from 2-17 digits long, and there is no way to tell without getting the correct one.  [ CLOSING ] UCN was in service from 1988-1991. Over the years, we had hundreds of members from all different parts of the world. During our time, we did our share of phreaking/hacking, and kept our group well-organized, even with more than 100 members at one time. I'm sure some of you out there used to be UCN members. (Or MSU or Phreak Out!) If you were, give one of the boards above a call - I'd like to talk to you. Also, if someone is interested in carrying on the UCN tradition, let me know. As another note, I'm going to let out one of our exclusive code files. Although about it's from early '91, it still has a lot of other information, such as confrencing numbers, loops, bridges, and MUCH more. From what I remember, it was about 75k. When I find it, it'll be out there. Good luck in your (il)legal ventures, and contact me to let me know what's going on in the p/h world. Later!