7 ms·

Reproducing the printer hack of Windows 95

89 points by dpola 2y ago

tombert 2y ago
Computers have kind of "converged on boring". This isn't a bad thing, obviously; a computer is a tool and you generally want your tools to work as expected without surprises. Basically any computer with any operating system you would use in the last fifteen or so years works basically "as-expected", more or less. The security models work alright, they don't really crash, and do their job. This is boring though! I remember when I had an early Windows 95 machine, I genuinely kind of had fun figuring how to break things. I mean, hell, when I discovered you could click "cancel" on the login screen and get a default user so I didn't need to get my parents to unlock it, it felt like I was accessing forbidden knowledge. I think even at the time I knew that was a bit janky. That was kind of the 90's computing experience though; everything was kind of held together with ducktape and prayers, and it kind of worked. It's probably weird to have nostalgia for a time when everything was a little broken, but what can I say?
- theamk 2y ago
  It's still there, it's just Windows that became boring. Take the most plain Ubuntu system and looking for "window manager" - there are dozens of hits! Install "wmaker" for that classical look and spend a few hours picking up the set of dockapps you like. Try a dynamic tiling manager and a static one.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
14 2y ago
Security just wasn’t huge back then. I remember once not having log in credentials so I was able to create a new admin account at the start up and then delete the old password on the original account. It was rather trivial to break into a pc back then.
- sumtechguy 2y ago
  Depending on the version you could just hit cancel and it would still log you in.
xenadu02 2y ago
The "login" dialog on Windows 95 was just providing network credentials. Windows 95 is a single-user OS. There is no actual login or security.
- phire 2y ago
  Technically True. But there was an optional registry key that prevents the user from doing anything until after you were logged into the network. So practically, it was a login dialog. But still no security.
- nubinetwork 2y ago
  This, you could literally press escape to login.
  - valleyer 2y ago
    The herein linked article discusses disabling that option, and the animated GIF linked at the beginning shows it not working.
- Kwpolska 2y ago
  Windows 9x does let users have separate profiles with their own files and settings, even if they aren’t super secure.
PebblesHD 2y ago
In a similar flavour, on older versions of Mac OSX, you could touch an initial setup file and reboot which would start the out of box experience and let you make a new admin user if you ever found yourself locked out of one for some reason. Modern disk encryption put an obvious stop to that…
- TheNewsIsHere 2y ago
  The old /var/db/.AppleSetupDone trick. At least as of 2-3 years ago this still worked. I _think_ they've renamed the file since; I haven't used this in a long time. If I recall correctly that file became SIP protected so had to disable SIP to delete/create it. Even with FileVault2/FDE, it was still possible as long as you could unlock the drive. Now being able to authenticate as an administrator privileged user is (in some scenarios) a direct proxy for demonstrating ownership to recoveryOS, blocking access to the Utilities menu. It's a clever strategy from a security perspective. Mixed, mostly past, tense because I'm not sure if this still works in 2024.
Lammy 2y ago
I always thought that GIF was of NT 4, not Win95, because the Logon box has a Domain field. Question mark ?
- LeoPanthera 2y ago
  Windows 95 "login" boxes are provided by the network driver, which can ask for any fields it likes. In this example it's definitely Windows 95, because "Setup MSN" is on the desktop at the end. This was never bundled with NT.
- ale42 2y ago
  Win9x could login to a domain-based network... The NT4 login dialog looks like those of NT3.51 or Windows 2000 (and XP Pro if you switch do a domain-based login). See e.g. the one of Windows 2000 (on a machine visible not jointed to a domain) here: https://old.reddit.com/r/Windows10/comments/uyau0h/is_it_somehow_possible_to_get_the_old_windows/ https://old.reddit.com/r/Windows10/comments/uyau0h/is_it_som.... And AFAIK there's no way to bypass NT login dialog.
hax96 2y ago
One other trick when the administrator had locked down the Registry Editor was to use the EDIT.COM program to modify REGEDIT.EXE and corrupt the "DisableRegistryTools" string, and save it in some directory you have write access to. Then it wouldn't read the value keyed by that string in the registry. If I remember correctly you'd have to open EDIT with a command line parameter that enabled binary mode, something like "/78". Sometimes the Run box and the Command Prompt were locked down too, to get around that you could navigate to C:\WINDOWS\SYSTEM32 in Explorer and run FTP.EXE, then use the "!" command to run whatever other commands you needed. If Microsoft Office was installed, another easy way to run whatever you wanted despite lockdown settings was to open Excel or Word and go to the VBA (Visual Basic for Applications) window with Alt+F11, and use the Shell() function from the Immediate pane.
- ale42 2y ago
  Exactly, EDIT.COM from Win9x had an incredibly useful binary mode (EDIT /xx filename), where xx is the number of columns to display. I'm really missing it in modern windows... it's very useful to sometimes quickly binary patch a file from a terminal.
mavhc 2y ago
There's a similar hack for some Android tablets that get stuck at the sign up screen, open keyboard, keyboard settings, help, now you have a web browser, open android settings from there and configure things
realusername 2y ago
I remember a similar thing with the Novell login at school on Windows XP. If you just unplugged the ethernet cable at the right time, you would login straight away and even with a higher permission account compared to a normal login. Nobody really cared about computer security back then.
- joshuaissac 2y ago
  At my school, you would get different levels of permissions depending on when you unplugged the cable and plugged it back in. Unplug it too early, and you get kicked out of the session. Too late and all the restrictions get applied. In the middle were two sweet spots, one that disabled the Internet filter and another that allowed running arbitrary applications instead of just the ones from the whitelist. Once the other students found out about this, there were many damaged Ethernet ports as they yanked the cables out of the ports violently. The school administrators eventually fixed the Internet filter vulnerability but the application one remained because not many people cared about it.
prmoustache 2y ago
The rant about qemu/kvm at the bottom is weird. Has the author never heard of virt-manager or gnome-boxes?
- tetris11 2y ago
  # create disk image qemu-img create -f qcow2 win95.img 10G # install win95 from iso qemu-system-x86_64 -m 256 -hda win95.img -cdrom windows95.iso -boot d # boot the disk qemu-system-x86_64 -m 256 -hda win95.img
  - InfamousRece 2y ago
    Now configure the network card on that thing
    - a1xndr 2y ago
      On most builds of QEMU, that command will start a VM with an e1000 card networked through SLIRP. It's the equivalent of something like: -netdev user,id=net0 -device e1000,netdev=net0
- tomrod 2y ago
  virt-manager/gnome-boxes haven't achieved the same mindshare as, say, virtualbox, so it is entirely possible. I know when I took a break from VMs for awhile and came back, I found virt-manager about 3 days after I started trying to crack the nut of qemu/kvm from only the command line.
  - sumtechguy 2y ago
    I as a CLI guy, usually have 2 or 3 open somewhere, I still find some CLI programs to be quite inscrutable. Pop it in a GUI though and suddenly the thing is dead easy to use. Have not quite figured out what triggers this response in me though.
    - 2y ago
jchw 2y ago
Cool. No substantial comment but found this quite entertaining to read. > * I prefer to use VirtualBox because I am unable to make QEMU/KVM work, since I am not a rocket scientist. I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer? Seriously, why this needs to be another Wine-like experience is beyond me. Not sure what this means to be honest: "I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer?" Nor this: "Seriously, why this needs to be another Wine-like experience is beyond me." Of course, Virtualbox is substantially fine for this sort of thing, but Qemu/KVM isn't that absurd. Qemu is just an ordinary CLI program. Admittedly, forging a proper Qemu command for running a VM is an exercise in frustration because the CLI arguments have changed over time and some of them are now quite complicated to set up, but this is more FFMPEG-like than Wine-like. That said, if you want to use Qemu/KVM more like a desktop virtualization solution, try libvirt with virt-manager. That will give you a GUI with wizards. It's a little weird, but very powerful. Virtualbox may still be better for Windows 95. Honestly, 86Box may be best for Windows 95, being an emulator of older hardware rather than a VM.
- znpy 2y ago
  The very sad thing is that VirtManager (a gtk app) used to be able to handle pretty much everything qemu. But it's getting deprecated, iirc ?
  - jchw 2y ago
    It's still being updated. I don't see anything on the virt-manager homepage or GitHub that would suggest it is deprecated. https://virt-manager.org/ https://virt-manager.org/ https://github.com/virt-manager/virt-manager https://github.com/virt-manager/virt-manager It can't do literally everything Qemu/libvirt can do using only the UI, but given that it has escape hatches to directly edit libvirt configurations, and libvirt has escape hatches to directly pass arguments to Qemu, there's very little you can't do with it.
    - 2y ago
qingcharles 2y ago
There's other fun hacks using print dialogs. When I was in jail the computers only ran one piece of legal software (on Windows Vista). But it would let you print. And the printer drivers from HP had a button to "Order more ink" which if you pressed it opened IE and tried to navigate to hp.com. From there you could just use IE as File Explorer and browse the hard drive and run explorer.exe.
dpola 2y ago
I would like to thank all of you for reading my blog. It means a lot to me! I think I need to address the many comments about my qemu/kvm rant... I think my experience could be best described by the user asciimov in his comment. I don't know what I do wrong, but I always get some error messages and barely make the virtualization work. Never even get to network the VMs.
garaetjjte 2y ago
In the same vein, navigating through help and accessibility menus could be used to bypass Android FRP lock.
dpola 2y ago
With .net ported back to 95, one should get his security ready too.
- kevinyew 2y ago
  Love this reference, that MattKC video is so good. For the uninitiated, I present this masterpiece: https://youtu.be/CTUMNtKQLl8 https://youtu.be/CTUMNtKQLl8

89 points by dpola 2y ago

Computers have kind of "converged on boring". This isn't a bad thing, obviously; a computer is a tool and you generally want your tools to work as expected without surprises. Basically any computer with any operating system you would use in the last fifteen or so years works basically "as-expected", more or less. The security models work alright, they don't really crash, and do their job. This is boring though! I remember when I had an early Windows 95 machine, I genuinely kind of had fun figuring how to break things. I mean, hell, when I discovered you could click "cancel" on the login screen and get a default user so I didn't need to get my parents to unlock it, it felt like I was accessing forbidden knowledge. I think even at the time I knew that was a bit janky. That was kind of the 90's computing experience though; everything was kind of held together with ducktape and prayers, and it kind of worked. It's probably weird to have nostalgia for a time when everything was a little broken, but what can I say?

theamk 2y ago
It's still there, it's just Windows that became boring. Take the most plain Ubuntu system and looking for "window manager" - there are dozens of hits! Install "wmaker" for that classical look and spend a few hours picking up the set of dockapps you like. Try a dynamic tiling manager and a static one.
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

14 2y ago

Security just wasn’t huge back then. I remember once not having log in credentials so I was able to create a new admin account at the start up and then delete the old password on the original account. It was rather trivial to break into a pc back then.

sumtechguy 2y ago
Depending on the version you could just hit cancel and it would still log you in.

xenadu02 2y ago

The "login" dialog on Windows 95 was just providing network credentials. Windows 95 is a single-user OS. There is no actual login or security.

phire 2y ago
Technically True. But there was an optional registry key that prevents the user from doing anything until after you were logged into the network. So practically, it was a login dialog. But still no security.
nubinetwork 2y ago
This, you could literally press escape to login.
- valleyer 2y ago
  The herein linked article discusses disabling that option, and the animated GIF linked at the beginning shows it not working.
Kwpolska 2y ago
Windows 9x does let users have separate profiles with their own files and settings, even if they aren’t super secure.

PebblesHD 2y ago

In a similar flavour, on older versions of Mac OSX, you could touch an initial setup file and reboot which would start the out of box experience and let you make a new admin user if you ever found yourself locked out of one for some reason. Modern disk encryption put an obvious stop to that…

TheNewsIsHere 2y ago
The old /var/db/.AppleSetupDone trick. At least as of 2-3 years ago this still worked. I _think_ they've renamed the file since; I haven't used this in a long time. If I recall correctly that file became SIP protected so had to disable SIP to delete/create it. Even with FileVault2/FDE, it was still possible as long as you could unlock the drive. Now being able to authenticate as an administrator privileged user is (in some scenarios) a direct proxy for demonstrating ownership to recoveryOS, blocking access to the Utilities menu. It's a clever strategy from a security perspective. Mixed, mostly past, tense because I'm not sure if this still works in 2024.

Lammy 2y ago

I always thought that GIF was of NT 4, not Win95, because the Logon box has a Domain field. Question mark ?

LeoPanthera 2y ago
Windows 95 "login" boxes are provided by the network driver, which can ask for any fields it likes. In this example it's definitely Windows 95, because "Setup MSN" is on the desktop at the end. This was never bundled with NT.
ale42 2y ago
Win9x could login to a domain-based network... The NT4 login dialog looks like those of NT3.51 or Windows 2000 (and XP Pro if you switch do a domain-based login). See e.g. the one of Windows 2000 (on a machine visible not jointed to a domain) here: https://old.reddit.com/r/Windows10/comments/uyau0h/is_it_somehow_possible_to_get_the_old_windows/ https://old.reddit.com/r/Windows10/comments/uyau0h/is_it_som.... And AFAIK there's no way to bypass NT login dialog.

hax96 2y ago

One other trick when the administrator had locked down the Registry Editor was to use the EDIT.COM program to modify REGEDIT.EXE and corrupt the "DisableRegistryTools" string, and save it in some directory you have write access to. Then it wouldn't read the value keyed by that string in the registry. If I remember correctly you'd have to open EDIT with a command line parameter that enabled binary mode, something like "/78". Sometimes the Run box and the Command Prompt were locked down too, to get around that you could navigate to C:\WINDOWS\SYSTEM32 in Explorer and run FTP.EXE, then use the "!" command to run whatever other commands you needed. If Microsoft Office was installed, another easy way to run whatever you wanted despite lockdown settings was to open Excel or Word and go to the VBA (Visual Basic for Applications) window with Alt+F11, and use the Shell() function from the Immediate pane.

ale42 2y ago
Exactly, EDIT.COM from Win9x had an incredibly useful binary mode (EDIT /xx filename), where xx is the number of columns to display. I'm really missing it in modern windows... it's very useful to sometimes quickly binary patch a file from a terminal.

mavhc 2y ago

There's a similar hack for some Android tablets that get stuck at the sign up screen, open keyboard, keyboard settings, help, now you have a web browser, open android settings from there and configure things

realusername 2y ago

I remember a similar thing with the Novell login at school on Windows XP. If you just unplugged the ethernet cable at the right time, you would login straight away and even with a higher permission account compared to a normal login. Nobody really cared about computer security back then.

joshuaissac 2y ago
At my school, you would get different levels of permissions depending on when you unplugged the cable and plugged it back in. Unplug it too early, and you get kicked out of the session. Too late and all the restrictions get applied. In the middle were two sweet spots, one that disabled the Internet filter and another that allowed running arbitrary applications instead of just the ones from the whitelist. Once the other students found out about this, there were many damaged Ethernet ports as they yanked the cables out of the ports violently. The school administrators eventually fixed the Internet filter vulnerability but the application one remained because not many people cared about it.

prmoustache 2y ago

The rant about qemu/kvm at the bottom is weird. Has the author never heard of virt-manager or gnome-boxes?

tetris11 2y ago
# create disk image qemu-img create -f qcow2 win95.img 10G # install win95 from iso qemu-system-x86_64 -m 256 -hda win95.img -cdrom windows95.iso -boot d # boot the disk qemu-system-x86_64 -m 256 -hda win95.img
- InfamousRece 2y ago
  Now configure the network card on that thing
  - a1xndr 2y ago
    On most builds of QEMU, that command will start a VM with an e1000 card networked through SLIRP. It's the equivalent of something like: -netdev user,id=net0 -device e1000,netdev=net0
tomrod 2y ago
virt-manager/gnome-boxes haven't achieved the same mindshare as, say, virtualbox, so it is entirely possible. I know when I took a break from VMs for awhile and came back, I found virt-manager about 3 days after I started trying to crack the nut of qemu/kvm from only the command line.
- sumtechguy 2y ago
  I as a CLI guy, usually have 2 or 3 open somewhere, I still find some CLI programs to be quite inscrutable. Pop it in a GUI though and suddenly the thing is dead easy to use. Have not quite figured out what triggers this response in me though.
  - 2y ago

jchw 2y ago

Cool. No substantial comment but found this quite entertaining to read. > * I prefer to use VirtualBox because I am unable to make QEMU/KVM work, since I am not a rocket scientist. I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer? Seriously, why this needs to be another Wine-like experience is beyond me. Not sure what this means to be honest: "I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer?" Nor this: "Seriously, why this needs to be another Wine-like experience is beyond me." Of course, Virtualbox is substantially fine for this sort of thing, but Qemu/KVM isn't that absurd. Qemu is just an ordinary CLI program. Admittedly, forging a proper Qemu command for running a VM is an exercise in frustration because the CLI arguments have changed over time and some of them are now quite complicated to set up, but this is more FFMPEG-like than Wine-like. That said, if you want to use Qemu/KVM more like a desktop virtualization solution, try libvirt with virt-manager. That will give you a GUI with wizards. It's a little weird, but very powerful. Virtualbox may still be better for Windows 95. Honestly, 86Box may be best for Windows 95, being an emulator of older hardware rather than a VM.

znpy 2y ago
The very sad thing is that VirtManager (a gtk app) used to be able to handle pretty much everything qemu. But it's getting deprecated, iirc ?
- jchw 2y ago
  It's still being updated. I don't see anything on the virt-manager homepage or GitHub that would suggest it is deprecated. https://virt-manager.org/ https://virt-manager.org/ https://github.com/virt-manager/virt-manager https://github.com/virt-manager/virt-manager It can't do literally everything Qemu/libvirt can do using only the UI, but given that it has escape hatches to directly edit libvirt configurations, and libvirt has escape hatches to directly pass arguments to Qemu, there's very little you can't do with it.
  - 2y ago

qingcharles 2y ago

There's other fun hacks using print dialogs. When I was in jail the computers only ran one piece of legal software (on Windows Vista). But it would let you print. And the printer drivers from HP had a button to "Order more ink" which if you pressed it opened IE and tried to navigate to hp.com. From there you could just use IE as File Explorer and browse the hard drive and run explorer.exe.

dpola 2y ago

I would like to thank all of you for reading my blog. It means a lot to me! I think I need to address the many comments about my qemu/kvm rant... I think my experience could be best described by the user asciimov in his comment. I don't know what I do wrong, but I always get some error messages and barely make the virtualization work. Never even get to network the VMs.

garaetjjte 2y ago

In the same vein, navigating through help and accessibility menus could be used to bypass Android FRP lock.

dpola 2y ago

With .net ported back to 95, one should get his security ready too.

kevinyew 2y ago
Love this reference, that MattKC video is so good. For the uninitiated, I present this masterpiece: https://youtu.be/CTUMNtKQLl8 https://youtu.be/CTUMNtKQLl8