Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reproducing the printer hack of Windows 95

dpolakovic.space

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Reproducing the printer hack of Windows 95

#21

Post by ale42 »

hax96 wrote: post #12

One other trick when the administrator had locked down the Registry Editor was to use the EDIT.COM program to modify REGEDIT.EXE and corrupt the "DisableRegistryTools" string, and save it in some directory you have write access to. Then it wouldn't read the value keyed by that string in the registry. If I remember correctly you'd have to open EDIT with a command line parameter that enabled binary mode, something like…

Exactly, EDIT.COM from Win9x had an incredibly useful binary mode (EDIT /xx filename), where xx is the number of columns to display. I'm really missing it in modern windows... it's very useful to sometimes quickly binary patch a file from a terminal.

Re: Reproducing the printer hack of Windows 95

#22

Post by ale42 »

Lammy wrote: post #10

I always thought that GIF was of NT 4, not Win95, because the Logon box has a Domain field. Question mark ?

Win9x could login to a domain-based network...

The NT4 login dialog looks like those of NT3.51 or Windows 2000 (and XP Pro if you switch do a domain-based login). See e.g. the one of Windows 2000 (on a machine visible not jointed to a domain) here: https://old.reddit.com/r/Windows10/comments/uyau0h/is_it_som.... And AFAIK there's no way to bypass NT login dialog.

Re: Reproducing the printer hack of Windows 95

#23

Post by joshuaissac »

realusername wrote: post #14

I remember a similar thing with the Novell login at school on Windows XP. If you just unplugged the ethernet cable at the right time, you would login straight away and even with a higher permission account compared to a normal login. Nobody really cared about computer security back then.

At my school, you would get different levels of permissions depending on when you unplugged the cable and plugged it back in. Unplug it too early, and you get kicked out of the session. Too late and all the restrictions get applied. In the middle were two sweet spots, one that disabled the Internet filter and another that allowed running arbitrary applications instead of just the ones from the whitelist.

Once the other students found out about this, there were many damaged Ethernet ports as they yanked the cables out of the ports violently. The school administrators eventually fixed the Internet filter vulnerability but the application one remained because not many people cared about it.

Re: Reproducing the printer hack of Windows 95

#24

Post by sumtechguy »

tomrod wrote: post #19
prmoustache wrote: post #15

The rant about qemu/kvm at the bottom is weird. Has the author never heard of virt-manager or gnome-boxes?

virt-manager/gnome-boxes haven't achieved the same mindshare as, say, virtualbox, so it is entirely possible. I know when I took a break from VMs for awhile and came back, I found virt-manager about 3 days after I started trying to crack the nut of qemu/kvm from only the command line.

I as a CLI guy, usually have 2 or 3 open somewhere, I still find some CLI programs to be quite inscrutable. Pop it in a GUI though and suddenly the thing is dead easy to use. Have not quite figured out what triggers this response in me though.

Re: Reproducing the printer hack of Windows 95

#25

Post by sumtechguy »

14 wrote: post #7

Security just wasn’t huge back then. I remember once not having log in credentials so I was able to create a new admin account at the start up and then delete the old password on the original account. It was rather trivial to break into a pc back then.

Depending on the version you could just hit cancel and it would still log you in.

Re: Reproducing the printer hack of Windows 95

#27

Post by a1xndr »

InfamousRece wrote: post #20
tetris11 wrote: post #17

Earlier quoted context omitted.

# create disk image qemu-img create -f qcow2 win95.img 10G # install win95 from iso qemu-system-x86_64 -m 256 -hda win95.img -cdrom windows95.iso -boot d # boot the disk qemu-system-x86_64 -m 256 -hda win95.img

Now configure the network card on that thing

On most builds of QEMU, that command will start a VM with an e1000 card networked through SLIRP. It's the equivalent of something like:

  -netdev user,id=net0 -device e1000,netdev=net0

Re: Reproducing the printer hack of Windows 95

#28

Post by znpy »

jchw wrote: post #18

Cool. No substantial comment but found this quite entertaining to read. > * I prefer to use VirtualBox because I am unable to make QEMU/KVM work, since I am not a rocket scientist. I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer? Seriously, why this needs to be another Wine-like exp…

The very sad thing is that VirtManager (a gtk app) used to be able to handle pretty much everything qemu.

But it's getting deprecated, iirc ?

Re: Reproducing the printer hack of Windows 95

#29

Post by gattilorenz »

jchw wrote: post #18

Cool. No substantial comment but found this quite entertaining to read. > * I prefer to use VirtualBox because I am unable to make QEMU/KVM work, since I am not a rocket scientist. I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer? Seriously, why this needs to be another Wine-like exp…

> Qemu is just an ordinary CLI program.

To be honest, the qemu command line became more and more arcane over the years due to the large number of supported features, and is not very stable across major versions.

For example, until a certain point you could start a VM and install DOS/Win9x with

  qemu-system-i386 -m 32 -hda harddisk.img -cdrom cd.iso -fda floppy.img -boot a
if you try to boot it like this now, it will complain that the hard disk has been guessed as "raw":

  WARNING: Image format was not specified for 'harddisk.img' and probing guessed raw.
           Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
           Specify the 'raw' format explicitly to remove the restrictions.
So the actual incantation to use is

  qemu-system-i386 -m 32 -drive format=raw,file=harddisk.img -cdrom cd.iso -fda floppy.img -boot a
which is not as easy to remember, supports conflicting mnemonics (-cdrom and -hda vs -drive) and whatnot (for the added benefit of... what? I suppose the average qemu user can figure out that some stuff can be "dangerous". Why not print the warning and continue without bugging me?)... The network options are even more varied, and IIRC not even the official guide was up to date at some point.

I put up with qemu, but when possible I am happy to avoid it.

Re: Reproducing the printer hack of Windows 95

#30

Post by Dalewyn »

jchw wrote: post #18

Cool. No substantial comment but found this quite entertaining to read. > * I prefer to use VirtualBox because I am unable to make QEMU/KVM work, since I am not a rocket scientist. I don't see the advantage of a package manager when I have to edit random config files and hunt for tutorials. Why this can't be managed by APT or explained by the developer/maintainer? Seriously, why this needs to be another Wine-like exp…

>Qemu is just an ordinary CLI program.

Most of us here take for granted just how arcane CLI actually is.

Post reply on HN