Hacking Windows 95, Part 2

In the Hacking Windows 95, part 1 blog post, we covered that through a nasty bug affecting Windows 95/98/ME, the share password can be guessed in no time. In this article, I'm going to try to use this vulnerability to achieve remote code execution (with the help of publicly available tools only).

The first thing we can do when we have read access to the Windows directory through the share, is to locate all the *.pwl files on the c:\windows directory, copy them to your machine where Cain is installed, switch to Cracker tab, pwl files, load the pwl file, add username based on the filename, and try to crack it. If you can't crack it you might still try to add a .pwl file where you already know the password in the remote windows directory. Although this is a fun post-exploitation task, but still, no remote code execution. These passwords are useless without physical access.

One might think that after having a share password and user password, it is easy to achieve remote code execution. The problem is:

• there is no "at" command (available since Windows 95 plus!)
• there is no admin share
• there is no RPC
• there is no named pipes
• there is no remote registry
• there is no remote service management

If you think about security best practices, disabling unnecessary services is always the first task you should do. Because Windows 95 lacks all of these services, it is pretty much secure!

During my quest for a tool to hack Windows 95, I came across some pretty cool stuff:

Internet periscope

Winfingerprint

LanSpy

But the best of the best is Fluxay, which has been written by chinese hackers. It is the metasploit from the year 2000. A screenshot is worth more than a 1000 words. 4 screenshot > 4 thousand words :)

It is pretty hard to find the installer, but it is still out there!

But at the end, no remote code execution for me.

My idea here was that if I can find a file which executes regularly (on a scheduled basis), I can change that executable to my backdoor and I'm done. Although there is no scheduler in the default Windows 95, I gave it a try. 

Let's fire up taskman.exe to get an idea what processes are running:

Looks like we need a more powerful tool here, namely Process Explorer. Let's try to download this from oldapps.com:

LOL, IE3 hangs, can't render the page. Copying files to the Win95 VM is not that simple, because there are no shared folders in Win95 VM. And you can't use pendrives either, Win95 can't handle USB (at least the retail version). After downloading the application with a newer browser from oldapps, let's start Process Explorer on the test Windows 95.

Don't try to download the Winsocks 2 patch from the official MS site, it is not there anymore, but you can download it from other sites. 

Now let's look at the processes running:

After staring it for minutes, turned out it is constant, no new processes appeared.
Looking at the next screenshot, one can notice this OS was not running a lot of background processes ...

My current Win7 has 1181 threads and 84 processes running, no wonder it is slow as hell :)

We have at least the following options:

1. You are lucky and not the plain Windows 95 is installed, but Windows 95 Plus! The main difference here is that Windows 95 Plus! has built-in scheduler, especially the "at" command. Just overwrite a file which is scheduled to execution, and wait. Mission accomplished!
2. Ping of death - you can crash the machine (no BSOD, just crash) with long (over 65535 bytes) ICMP ping commands, and wait for someone to reboot it. Just don't forget to put your backdoor on the share and add it to autoexec.bat before crashing it. 
3. If your target is a plain Windows 95, I believe you are out of luck. No at command, no named pipes, no admin share, nothing. Meybe you can try to fuzz port 137 138 139, and write an exploit for those. Might be even Ping of Death is exploitable?

Let's do the first option, and hack Windows 95 plus!

Look at the cool features we have by installing Win95 Plus!

Cool new boot splash screen!

But our main interest is the new, scheduled tasks!

Now we can replace diskalm.exe with our backdoor executable, and wait maximum one hour to be scheduled.

Instead of a boring text based tutorial, I created a YouTube video for you. Based on the feedbacks on my previous tutorialz, it turned out I'm way too old, and can't do interesting tutorials. That's why I analyzed the cool skiddie videoz, and found that I have to do the followings so my vidz won't suck anymore:

• use cool black windows theme
• put meaningless performance monitor gadgets on the sidebar
• use a cool background, something related with hacking and skullz
• do as many opsec fails as possible
• instead of captions, use notepad with spelling errorz
• there is only one rule of metal: Play it fuckin' loud!!!!

More information

1. Hacking Tools For Kali Linux
2. Hacking Tools 2020
3. Pentest Tools For Mac
4. Pentest Tools Github
5. Black Hat Hacker Tools
6. Install Pentest Tools Ubuntu
7. Hacking Tools Hardware
8. Pentest Tools Port Scanner
9. Hack Tools For Pc
10. Hacking Tools For Windows
11. Hacker Tools Free
12. Pentest Tools Framework
13. Pentest Tools
14. Hacking Tools Software
15. Hack Tools 2019
16. Hacking Tools Name
17. Pentest Automation Tools
18. Pentest Tools Apk
19. Hacking Tools Pc
20. Hack Tools Github
21. Easy Hack Tools
22. Hack Tool Apk
23. Hacker Tools Apk Download
24. Free Pentest Tools For Windows
25. Pentest Tools Website Vulnerability
26. Hacker Security Tools
27. How To Hack
28. Hacking Tools For Windows Free Download
29. Best Hacking Tools 2020
30. Termux Hacking Tools 2019
31. Hacking Tools Github
32. Nsa Hack Tools
33. Hacker Tools List
34. Hacker Tools 2019
35. Hacker Tools List
36. Ethical Hacker Tools
37. Hacker Tools Windows
38. Pentest Tools For Ubuntu
39. Hack Tools For Games
40. Hacking Tools Windows
41. Pentest Tools Website
42. Blackhat Hacker Tools
43. Pentest Tools Url Fuzzer
44. Hacking Tools Free Download
45. Android Hack Tools Github
46. Hacker Techniques Tools And Incident Handling
47. Hacker Tools List
48. Pentest Tools Url Fuzzer
49. Pentest Tools Download
50. Hack Tool Apk No Root
51. Hack Tools Github
52. Hack Apps
53. Hacking Tools 2020
54. Hacking Tools 2020
55. Hacking Tools Software
56. Hack Tools Pc
57. Pentest Tools For Windows
58. Hack Tool Apk
59. Pentest Tools Find Subdomains
60. Hacking Tools For Windows Free Download
61. Pentest Tools Nmap
62. Hack Rom Tools
63. Hacker Tools Apk Download
64. Hacking Tools For Windows 7
65. Hacking Tools Free Download
66. How To Install Pentest Tools In Ubuntu
67. Pentest Tools Bluekeep
68. Pentest Reporting Tools
69. Pentest Tools Port Scanner
70. Hacking Tools 2019
71. Hacker
72. Termux Hacking Tools 2019
73. Hacking Tools Windows
74. Hacking Tools Kit
75. Hack Tools For Games
76. Hacking Tools Windows
77. Hacker Hardware Tools
78. Hak5 Tools
79. Pentest Tools Linux
80. Pentest Tools Open Source
81. Hacker Tools 2020
82. Hack Tools Pc
83. Pentest Tools For Mac
84. Pentest Tools Tcp Port Scanner
85. Hacker Tools Mac
86. Hacking Tools For Windows 7
87. Pentest Tools List
88. Hacker
89. Pentest Tools Review
90. Hack Tools For Windows
91. Hacker Tools For Windows
92. Hacking App
93. Android Hack Tools Github
94. Pentest Tools Tcp Port Scanner
95. Pentest Tools Free
96. Hacker Tools Software
97. Hacker Security Tools
98. Tools 4 Hack
99. Android Hack Tools Github
100. Free Pentest Tools For Windows
101. New Hack Tools
102. Hacking Tools For Mac
103. Hacker Security Tools
104. Pentest Tools For Android
105. Pentest Tools Find Subdomains
106. Pentest Tools Subdomain
107. Hacks And Tools
108. Hacking Tools For Games
109. Nsa Hack Tools
110. Pentest Tools Apk
111. Hack Tools For Games
112. What Are Hacking Tools
113. Github Hacking Tools
114. Hacking Tools Software
115. Pentest Tools Tcp Port Scanner
116. Best Hacking Tools 2019
117. Hacker
118. Hack Tools 2019
119. Pentest Tools Apk
120. Hacking Tools For Pc
121. Best Pentesting Tools 2018