My attempts at getting the SIP *NEW*

magicJack Tips and Tricks

Moderators: Pilot, Bill Smith

Post Reply
evilvoice
MagicJack Newbie
Posts: 3
Joined: Sat Dec 29, 2007 3:09 am

My attempts at getting the SIP *NEW*

Post by evilvoice »

Ok, well, I stumbled across this site just last night and saw so many people using it with an ata device which is what I want to do (even though I have the innomedia sr set up for GP and GC). Well, I plugged the magicjack up this morning only to be greeted with an upgrade, which I did let it finish (I know, STUPID) and then decided I would try and get the information I needed now. Realized that with the upgrade came security restrictions to keep me from getting what I wanted...Anyways, I downloaded fiddler and tinkered with it for a while and came upon "911.talk4free.com" and looked in the bottom textview tab and there was some really neat info, a lot of it blank, but some neat info. Now, for what I did, maybe someone can build on it and create a working solution as I dont think mine is complete or works, but maybe.

I kept fiddler running through all the rest of this, except for turning off the capture when actually going to a site or downloading, but starting it right back after it was done (some reason I cant go anywhere on the web with capture running). Well anyways, I was reading the post by Gregg here and noticed that in the info he provided, he actually left me a link to downgrade magicjack...which is with this file which is the 9-21-07 upgrade. So I installed that and magicjack started up and mentioned it was going to do an upgrade, so I unplugged it. I decided I was going to stop the upgrade from happening, so I pinged the ip address that fiddler said magicjack was trying to do the upgrade from and resolved it to a hostname ns1.talk4free.com, so I put 127.0.0.1 and the hostname in my hosts file for windows...pinged it to make sure it was translating to 127.0.0.1. Now since I'm on vista and not everyone is, this may be a little different, but I went to Administrative Tools and Windows Firewall. I created an outbound rule to block all connections to 67.106.133.212 for all programs, all ports. Now we can continue without worrying about the upgrade running (BTW, this messes up magicjack from fully working, it still does its thing, but the program says it doesn't work and that I need to connect to the internet, just mentioning it so people don't freak)

I then went back to fiddler and saw a reg.talk4free.com entry, so I looked at session inspector and WEBFORMS and got a LOT of information from that, including a pw of 4 characters (not just numbers). Ok , so thats great, copied all that down using RAW in the upper box and copy paste in notepad then made it readable so each line of webview was a new line in notepad (left the ampersands [&] at the end of each line). Then I went and checked out 911.talk4free.com again, and this time everything was filled in, like nonce, serial, chkval, so I copied the textview to notepad (open in notepad makes it unreadable for me, so I did copy and paste). Then I decided to use cain to see what else I can find. It took me a while to figure it out, but pushed the 2nd button to setup the sniffer, then clicked the button again to start the sniffer, started magicjack, went to Sniffer -> sip and got more info. At some pojnt I allowed the upgrade to go through, but it was only when using cain, so first try cain without upgrade see if you get info, if not, then start cain sniffing and initiate the upgrade, and if that doesnt work then just start cain and have it sniff when you restart magicjack...Anyways this is what I was able to pull

from reg

Code: Select all

pw=ABq1
from 911

Code: Select all

      l_vecParam.push("version");
      l_vecParam.push("20071108000002");
      l_vecParams.push(l_vecParam.join('='));
      l_vecParam.length = 0;
      l_vecParam.push("chkval");
      l_vecParam.push("687XXXXXXXXXXXXXXXXXXXXXXXX757d7");
      l_vecParams.push(l_vecParam.join('='));
      l_vecParam.length = 0;
      l_vecParam.push("nonce");
      l_vecParam.push("119XXXX419");
from cain So, we have username (E6 info for me...its basically Emyphonenumber01)
we have the user domain 67.106.133.198 which I translated to proxy1.newark.talk4free.com which I think would be the proxy domain
Im assuming the port is gonna be 5070 and we have the pw which for me is ABq1

Please note that I have never done any of this, this is just my attempt at trying to help everyone out. I dont know if it is right, but it may be a start to get a working solution.
Last edited by evilvoice on Sun Dec 30, 2007 4:03 am, edited 1 time in total.
evilvoice
MagicJack Newbie
Posts: 3
Joined: Sat Dec 29, 2007 3:09 am

Post by evilvoice »

ok, well it doesnt work, I tried lots of configs and it just wont work...so hopefully my info can be a stepping stone for someone.
drjekyl
MagicJack Contributor
Posts: 69
Joined: Wed Dec 12, 2007 6:31 pm

Post by drjekyl »

Unless we have the same password, that one you (we) found is no good.

That is the wrong entry anyway.

The one that needs cracking is the one that used to show the full SIP credential info and is now encrypted.
Post Reply