While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither has port 445, nor named pipes.
My scenario is that a file share for the whole OS disk is world writeable (empty password is set), and just by uploading/renaming/modifying files through the file share, I want to achieve instant code execution, without the need to restart the OS. So for example adding new entries to autoexec.bat is not a valid solution. I read tricks about replacing windows\rundll32.exe with a custom executable, but it did not work.
Could you please help me out, if there is any way to get instant RCE with these constraints?