_ \|                 |
                          __/  \   _|-_)  _` | | /(_-<
                         _| _| _|_|\___|\__,_|_\_\___/

                                               |
                                 _` |   \   _` |
                               \__,_|_| _|\__,_|

                              __|           |
                             (_ |  -_)  -_) | /(_-<
                            \___|\___|\___|_\_\___/
                          http://www.phreaksandgeeks.com

                           Hacking Meridian Mail Boxes
                                   By ic0n
                          e-mail ic0n@phreaksandgeeks.com


Now this vms is one of the harder systes to hack. for the simple fact that it always things the box you enterd is a working
box. thus making getting a box harder. 


Finding A Meridian VMS:

When doing some scanning you will most likly come acrossed at lease one system per scan. You can identify these systems by:

1. 'Meridian Mail' when you dial in (this is the login promit) 
2. Some Recording When you press *81 you will hear 'meridian mail'

Finding a Box:

On the system I've seen Boxes where anywhere from 4 to 6 digit boxes. No matter what you enter for a box number it will ask
you for a passcode. So you will never know if the box is working or not.

Getting in the box:

Okay now you should have a few boxes that do work on that given system that your 'playing' with. Here's some of the defult
passcodes that i've seen work before.

Box Number
1234
1plus the box number

Now if none of these passcodes work try other defult passcodes. Like i said 'there's really no way to know if the box is 
valid or not. I also found out this little bit of info. Awhile agome and a few friedns found out a little info about the 
admin staus. There is no admin box they got like a fax/carrier and you have to 'play' with and change shit to system. I 
only messed with one of they before but there something to play with.

Commands for the system:
MAILBOX OPTIONS
---------------
 * : get info about what you're doing, and all available options.

 2 : play message
 4 : goto previous message
 6 : goto next message
 9 : call the sender of the message

70 : message options
71 : reply to the message you've just listened to
72 : play envelope : hear all info about the message
73 : forward the message to another box
74 : record one reply for all messages
75 : record a message (5 to start, # to stop recording)
76 : delete the actual message
79 : send message

80 : mailbox options.
     1 : change operator assistance number
         This will change the number that is called when you enter 0
         for operator assistance. These numbers are usually other box
	 numbers, but I found a systems which will connect me to some
         local prefixes too.... might be interesting.
81 : logon to another mailbox
82 : change the internal and external greeting of your box
     1 : change internal greeting
     2 : change external greeting
     Don't do this, or you'll lose your box very fast...	
83 : logoff
84 : change password (enter new pw + #)
85 : create a distribution list
     !!! This option can be used to scan for other unused/valid boxes.
     Just enter 5 to compose a new distribution list, and then enter the
     box number followed by #. Note down boxes that respond with
     'mailbox xxxx' because they're unused, and I still have to find such
     an unused box that hasn't got the box number as password. When you
     found enough unused boxes, press ## to stop your distribution list,
     and then 76 to delete it.
86 : goto message #. This option will ask for the number from a message,
     end then go to that message (like you could by using 4 and 6).
89 : personal verification (will say name of owner)
     5 : record name
     4 : exix