Do you want to crack some SIP phones?
It is really easy, all you got to do is to do a forged DHCP redirect, making the phone believe that the MAC-address of the server have changed. I tried this on some Grandstream phones the other day, found that it triggered something in the Grandstream OS. The result: Dead phones that had to be rebooted to get in order.