Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither has port 445, nor named pipes.

My scenario is that a file share for the whole OS disk is world writeable (empty password is set), and just by uploading/renaming/modifying files through the file share, I want to achieve instant code execution, without the need to restart the OS. So for example adding new entries to autoexec.bat is not a valid solution. I read tricks about replacing windows\rundll32.exe with a custom executable, but it did not work.

Could you please help me out, if there is any way to get instant RCE with these constraints?

share|improve this question
This reminds me of the good old: \\hostname\c$\con\con In case you're looking for a way to remotely crash a Win95 machine.... – bidifx Aug 1 '14 at 8:15

I don't think so. You might try and see whether it's possible to exploit MS99-049 through a specially crafted SMB request, but it's a long shot, and anyway, the PC might be patched.

Other possibilities for hacking (not instant RCE) are creating an executable in the hope it will be launched on the remote system (something like StripPoker_Install.exe), or an executable containing a resource exploit against Explorer - again, someone has to open the upload folder on the remote site - or check whether some services are installed after all, e.g. DCOM.

As for the need to restart the OS, an unpatched Windows 95 will do that anyway sooner or later.

share|improve this answer
Although your suggestions might work, but not in my case. In my case there is no user interaction, no user sitting in front of the desktop. And about the "Windows may crash after 49.7 days" part, it is just likely (not for sure) that it will crash, but if it crashes, it won't reboot. – user2716262 Aug 27 '13 at 14:04
Without user interaction or a service reading or executing those files, there is nothing to hack. – schroeder Aug 30 '13 at 22:54
up vote 2 down vote accepted

The solution has been posted at the following blog page:

Alltogether, two prerequisites were needed, an SMB share with write privileges for the whole disk, and Windows 95 Plus! for the scheduler.

share|improve this answer

I think telnet is loaded by default in win95/98. May be if you can exploit or bruteforce telnet with Metasploit or something similar you will gain access.

Microsoft Windows 95/98 IE5/Telnet Heap Overflow Vulnerability

share|improve this answer
That report isn't about a telnet service but the telnet client. (I don't think Win95 even had services, let alone a telnet service enabled by default.) – Mat Aug 26 '13 at 18:44
Only ports regarding file sharing (135-139) are open by default. No telnet service is running. – user2716262 Aug 26 '13 at 19:20
I have found one small step to achieve my goal. It is the ms00-072 vulnerability, and the tool "Share Password Checker" from Securityfriday. I still need something for instant RCE through the share. – user2716262 Jan 5 '14 at 18:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.