An article I wrote on the subject:
Liberating
Advants Terminals
You may have seen these floating around in your
hometown. They are relatively new
Internet kiosks called "
Advants Terminals" (Http://www.advants.com). With a price like $1 for 5 minutes it's almost a
crime to even use these things. So the following is my ordeal with liberating one of these terminals that resides in a
coffee shop in my hometown.
One day I walked into my local hangout to get a
coffee and when I went to sit down with my beverage I noticed a
computer looking thing on a low table in the corner. Almost immediately I went into hack mode. Many a question ran through my
head such as: what
OS is it running, what kind of
connection does it have, what are the systems specs, can I run
quake and most importantly how can I use it for
free. Well here's the low down people.
All of the
Advants terminals I've come across have been
Wintel boxes. *
gig HD, 500mhz
Celeron, 48
megs or ram and a
ATI Rage 128 video card. To keep the
kiosk "
secure" instead of running the normal
windows explorer shell it runs a program called "
Netshift" (http://www.netshift.com). As long as it is running this, pretty much all
useful operations are impossible. So to get started the first thing I did was pull the plug. When I tried this I found that the plug was somehow attached to the wall. They did this by having a screw go into the ground plug at a diagonal and putting pressure on the inside of the ground plug hole. To get past this all you have to do is reach under and
unscrew until the plug comes out of the wall. Now, since the
beginning of my experiments with this
kiosk they have upped the
security a bit by encasing most of the
computer in a larger cabinet (sort of like a
stand up arcade game) and putting in a relatively useless
UPS (Unlimited Power Supply). If the machine doesn't turn off when you pull the plug you should hear a
beeping in the lower part of the cabinet. If you are using one of the smaller "
desktop" terminals it should just go off immediately.
When you plug the
box back in it will
power up. Now this is where it may be different from box to box. The screen may or may not be
scrambled while this happens. The box I play with started out not being scrambled then was and now isn't. So you may have to do the rest of this without being able to clearly see the screen (don't worry, it isn't that hard.). You will get your normal boot
thingy (yes that's a technical term).
CMOS is ALWAYS passworded in my experience but if you want to screw with it that's your
prerogative, to get to it just hit delete as usual. I won't go into that because I haven't messed with it (yet). Just after it is finished with the
RAM and
HD check is your chance to get into
DOS, hit
Ctrl-Esc (not
F8) and you should get the
windows "
safe mode"
boot prompt letting you choose Safe-mode, Normal Boot, or
DOS and a few other little options. Now this takes a little timing and finesse but it can be done, so don't be discouraged it you see a
Windows 95 loading splash screen just hit
Ctrl-Alt-Del and go at it again. Once you get to this stage you're just about half done. For you
people with a scrambled
screen you should see a white bar sort or recognizable across your scrambled screen that means you've got it. Now hit
6 and
enter, this will get you the
DOS prompt for you people with scrambled screens type "
cls" and enter to see if it clears the screen. If so, you've got it. From here it defaults to
C:/ so your going to have to go to the
Windows directory (
cd Windows). Now here is the tricky part for you people that are doing this blind. Type "
edit system.ini" and you should get a blue screen that is the familiar DOS
edit program. Now we are going to change the shell from Netshift to explorer. Ok, now hit the down arrow 2 times and enter a "
//" this will
comment out the "shell=netshift/
naska.exe" line. Then hold down the "
fn" key and that will turn one of the arrow key, I think the right one (look on the side of the key facing you to see), into the end key so basically "shift-end" and it will move your cursor to the end of the line. Now hit enter and type "
shell=explorer.exe" don't mess up cause this could cost you the box if you
botch it. It should look something like this:
oemfonts.fon=vgaoem.fon
//shell=netshift/naska.exe
shell=explorer.exe
system.drv=system.drv
drivers=mmsystem.dll power.drv
"
Alt-F" followed by and "X" and "enter" will save and exit you back to the
DOS prompt. Now type "
Win" and hit "enter" and you're on your way to a free net box. The power supply is
ATX and if it boots into
windows and you typed the shell wrong it'll try to shut down, shutting down means you either have to get inside the locked case to turn it back on or you have to call
Advants and wait for them to come back out and fix it (I've had to do this 3 times =). If it says something about it a bad shell or something
PULL THE PLUG and go again.
Now if that sounds like a real bummer to do blind you're in luck there is another way, but I felt like explaining the way I did it my first time. The way I just explained is the most fun and the most
hackish. It's also the quickest and has the least potential for
destruction of the box especially if the screen isn't scrambled. The box, when it is running
netshift runs
War_FTP and most of the boxes allow anonymous access. There are two ways you can take advantage of this. They both involve getting the boxes
IP, to do this click the free C-NET button, and use C-nets web search. Search for "your IP". About the fourth option down it should come up with "http://rtd.com/~jak/index.html - Your IP Address is: 209.67.252.215" That's what I use, it'll show you your
IP when you click it. Now that you have that you can do one of two things. One, you can go home,
FTP to the box, download the
system.ini, edit it and re-upload it, then go back to the box and
reboot. Or 2 you can get something called
VNC (http://www.uk.research.att.com/vnc/). With this prog you can log into your own
box from the net and see your desktop in real time. So once you have
VNC on your box at home, all you have to do is put a
dollar into the Advants box, type your home IP into the "goto" form and you get your home desktop. From there you can use that even after your time runs out to do whatever you want on your home box because the page address never changes so it won't kick you off. This is helpful because you can now upload things from your home box to the Advants box, such as a new
system.ini.
If
everything worked out right you should be in
windows and can have all the fun you want exploring around. Just remember, when your done put it back to
NetShift so some "
K-Rad Elyte H4x0r" doesn't come along and
destroy the box or shut it down and you can have fun later the next time you want to use the box. Don't forget to share your
free net access while your supervising. People will appreciate it more than you know and your bound to make a few
friends that way.
I personally have put
GLQuake on the box that I use and it runs pretty well. The connection is most likely a crappy
DSL shared on a LAN modem somewhere so it's not really
suited for much. I've seen it get 15k a sec but it usually gets 5-7. The IP range from what I've seen is 38.28.129.* and 38.28.130.* if you'd like to scan for the boxes. I've yet to have any luck that way though. And that's it, it says on the
Advants web site that they will soon be switching to the
Linux OS to bring down the cost of the box and thus lowering Internet prices. When they do that I'll get on top of it and write up a follow up article on
liberating the new OS.
I'd also like to give
props to my man
Agile for being there for moral support,
free drinks, and more than one time preventing me from doing stupid crap (and hitting me when I did do something
stupid.)