Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Phreaking General Information :: pbxchn.txt

ROLM Sorceror XII PBX System Remote Control

33 CHiNA                                                       CHiNA 33
33          R.O.L.M. Sorcerer XII  PBX Remote System Control         33
33                                                                   33
33                         By: The Conflict                          33

 INTRO :  I know right off you people are thinking, "How in the Hell
          do I know if I am calling a R.O.L.M. Sorcerer XII PBX?".
          Well, that will be covered here, along with all system
          commands available on that PBX.**Of course, this file is
          meant for educational purposes only.  We at CHiNA hereby
          waive any legal reprimand due to misuse of the information
          contained in this file  (so there!).**

 HOW   :  A  R.O.L.M. Sorcerer XII PBX has a unique answer; thus, it
 IT       is quite distinguishable from most other PBX's.  I will list
 SOUNDS   some PBX's with similar answer devices at the end of this
          section.   The Sorcerer XII's answer consists of:  A.) No
          ring, B.) A short diverting tone of 2600 Hz, and C.) A
          standard, no interrupt AT&T 4.2c dial tone.  Unfortunately,
          there are four known PBX's that have a similar answer device,
          but not exact.  These four are as follows:  A.) R.O.L.M.
          Sorcerer III, B.) SouthWestern Bell WizSys I, C.) Northern
          Telecom SL-Net V, and D.) Siemans WebLink v.Ia.  The slight
          differences between these systems answer devices are the
          dial tones.  The dial differ either in tone, volume, or
          interrupt/no interrupt.  With practice, you will find the
          Sorcerer XII easy to distinguish.

 WHAT  :  Now, most often Sorcerer XII requires a four digit code, but
 TO DO    this can be altered at the source, so it is not entirely
          consistent.  To be able to utilize the Remote System Control
          (RSC from here out) commands, you must obtain the System
          Command Code.  The System Command Code consists of the
          original number of digits plus a two digit authorization
          check.  Thus, if we were dealing with a four digit Sorcerer
          XII system, we would find the four digit System Command Code
          followed by two more digits. *How do you know if you have the
          first set of the SCC?*  A four tone confirmation, similar to
          the one given by ASPEN VMNetworks, is given when you have the
          first digit set of the SCC; then, you must discover the two
          digit confirmation code.  The confirmation code is updated
          every week.  Finding the SCC is not going to be easy, as you
          can not utilize a cutesy code hacker on your computer.
          Essentially, the process will take dedicated hand hacking,
          and scanning for that matter.

 SYSTEM:  Since this is a PBX, there are no voice instructions; thus,
 COMMAND  you must know what the hell you're doing!  After you have
 LEVEL    obtained the correct confirmation code, two short beeps are
          transmitted.  This is your cue; you're in!  The commands are
          two digits followed by the asterisk (*) key.  Since there are
          many commands, I will list only those which are essential to
          your life and needs.  You can experiment with the other ones.

          07* - input 1, 2, or 3; alters error transmission.  1 is fake
                carrier, 2 is fast-busy, 3 is sweep-siren.

          19* - allows removal of codes from the programed code array.
                You must enter the code to be removed, followed by the
                pound key (#).

          20* - allows insertion of codes.  You must input the code,
                followed by the pound key (#).  Be careful, as a
                precise log of all code insertions is kept.

          43* - enables calls to toll numbers, such as 0700, 1900, and

          44* - disables calls to toll numbers.  Be sure to disable
                the function immediately after you are done with it.
                If it is left on, the administrator knows what's going
                on and will investigate.

          73* - enables making log of all calls placed through Sorcerer
                XII lines.

          74* - disables making log of all calls placed through
                Sorcerer XII lines.  Once again, disable 73 if you use
                it, as it is obvious to the administrator what's going

          99* - disconnect from the system command level.  Make sure
                to do this before hanging up, as it will hang the PBX,
                and things will definantly be switched around.

 Have fun, be careful, and take it easy.  All the information included
 should be enough to provide hours of safe enjoyment.  If you have any
 questions for CHiNA concerning anything, give us a call at one of the
 below-listed CHiNA Nodes.  Spread this around!!!

                         The Conflict

 Thanks go out to Maxwell Smart for acquiring a partial R.O.L.M.
 manual; Count Zero for being a swell guy; The Viper for giving us a
 'home'; Monalisa Overdrive for anti-procrastination support; and last
 but not least, NAP/PA for instilling in us a realization that we do
 not want to do nothing!

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH