Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither has port 445, nor named pipes.

My scenario is that a file share for the whole OS disk is world writeable (empty password is set), and just by uploading/renaming/modifying files through the file share, I want to achieve instant code execution, without the need to restart the OS. So for example adding new entries to autoexec.bat is not a valid solution. I read tricks about replacing windows\rundll32.exe with a custom executable, but it did not work.

Could you please help me out, if there is any way to get instant RCE with these constraints?

share|improve this question
1  
This reminds me of the good old: \\hostname\c$\con\con In case you're looking for a way to remotely crash a Win95 machine.... –  bidifx Aug 1 at 8:15

4 Answers 4

I don't think so. You might try and see whether it's possible to exploit MS99-049 through a specially crafted SMB request, but it's a long shot, and anyway, the PC might be patched.

Other possibilities for hacking (not instant RCE) are creating an executable in the hope it will be launched on the remote system (something like StripPoker_Install.exe), or an executable containing a resource exploit against Explorer - again, someone has to open the upload folder on the remote site - or check whether some services are installed after all, e.g. DCOM.

As for the need to restart the OS, an unpatched Windows 95 will do that anyway sooner or later.

share|improve this answer
    
Although your suggestions might work, but not in my case. In my case there is no user interaction, no user sitting in front of the desktop. And about the "Windows may crash after 49.7 days" part, it is just likely (not for sure) that it will crash, but if it crashes, it won't reboot. –  user2716262 Aug 27 '13 at 14:04
    
Without user interaction or a service reading or executing those files, there is nothing to hack. –  schroeder Aug 30 '13 at 22:54

I think telnet service is loaded by default in win95/98. May be if you can exploit or bruteforce telnet with Metasploit or something similar you will gain access.

Microsoft Windows 95/98 IE5/Telnet Heap Overflow Vulnerability

share|improve this answer
    
That report isn't about a telnet service but the telnet client. (I don't think Win95 even had services, let alone a telnet service enabled by default.) –  Mat Aug 26 '13 at 18:44
    
Only ports regarding file sharing (135-139) are open by default. No telnet service is running. –  user2716262 Aug 26 '13 at 19:20
    
I have found one small step to achieve my goal. It is the ms00-072 vulnerability, and the tool "Share Password Checker" from Securityfriday. I still need something for instant RCE through the share. –  user2716262 Jan 5 at 18:43
up vote 0 down vote accepted

The solution has been posted at the following blog page: http://jumpespjump.blogspot.hu/2014/05/hacking-windows-95-part-2.html

Alltogether, two prerequisites were needed, an SMB share with write privileges for the whole disk, and Windows 95 Plus! for the scheduler.

share|improve this answer

Don't know if it will work but you can still give it a try, it works fine on windows xp though NTSD is a debugger that ships with windows,it can be used in xp as a backdoor( a bind shell) It is located in system32 directory,use this command to start server on victim machine NTSD -server tcp:port=1337 calc.exe,once you know the ip address of the server machine,you can use another machine to connect to it with full privilages,use this command on the client machine from which you hack NTSD -remote tcp:server= IP ADDRESS of SERVER,port=1337 and you get a full bind shell,then you can use at command to esclate to NT Authority system like (at 10:50 /interactive “cmd.exe”)

share|improve this answer
    
Windows 95 doesn't have that program -- it's too old. –  Mark Aug 1 at 4:31
    
I don't understand why i got -1 for that answer.This really discourages new members who are willing to help –  Mudasir Aug 1 at 12:42
    
I gave you a -1 because the answer is wrong. Presumably it works on Windows XP, but Windows 95 isn't even from the NT series of operating systems. It has neither NTSD.exe nor cmd.exe, and barely has anything in the system32 directory (most files are in the system directory instead). –  Mark Aug 1 at 19:33
    
Thanks for this enlightenment but -1 is discouraging cuz i mentioned in my post that it may work –  Mudasir Aug 2 at 4:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.