How to Break into a Win 95 Box Using a Boot Disk
By : Harshit ChaturvediHow to Break into a Win 95 Box Using a Boot Disk
Step one: shut down
your computer.
Step two: put boot disk
into A: drive.
Step three: boot up.
Step four: at the A:\
prompt, give the command: rename c:\windows\*.pwl c:\windows\*.zzz.
Step four: boot up
again. You can enter anything or nothing at the password prompt and get in.
Step five: Cover your
tracks by renaming the password files back to what they were.
Wow, this is just too
easy! What do you do if you want to keep your prankster friends out of your Win
95 box? Well, there is one more thing you can do. This is a common trick on
LANs where the network administrator doesn’t want to have to deal with people
monkeying around with each others’ computers. The answer -- but not a very good
answer -- is to use a CMOS password.
Hacking into Windows 95 and a little bit of NT lore
By : Harshit Chaturvedi
Hacking into Windows 95 and a little bit of NT lore
Important warning: this
is a beginners lesson. BEGINNERS. Will all you geniuses who were born already
knowing 32-bit Windows just skip reading this one, OK? We don’t need to hear
how disgusted you are that not everyone already knows this.
PARENTAL DISCRETION ADVISED!
This lesson will lay
the foundation for learning how to hack what now is the most commonly installed
workstation operating system: Windows NT. In fact, Windows NT is coming into
wide use as a local area network (LAN), Internet, intranet, and Web server. So
if you want to call yourself a serious hacker, you’d better get a firm grasp on
Win NT.
In this lesson you will
learn serious hacking techniques useful on both Windows 95 and Win NT systems
while playing in complete safety on your own computer.
In this lesson we
explore:
·
Several
ways to hack your Windows 95 logon password
·
How to
hack your Pentium CMOS password
·
How to
hack a Windows Registry -- which is where access control on
Windows-based LANs,
intranets and Internet and Webs servers are hidden!
Let’s set the stage for
this lesson. You have your buddies over to your home to see you hack on your
Windows 95 box. You’ve already put in a really industrial haxor-looking bootup
screen, so they are already trembling at the thought of what a tremendously
elite d00d you are. So what do you do next?
How about clicking on
“Start,” clicking “settings” then “control panel” then “passwords.” Tell your
friends your password and get them to enter a secret new one. Then shut down
your computer and tell them you are about to show them how fast you can break
their password and get back into your own box!
This feat is so easy
I’m almost embarrassed to tell you how it’s done. That’s because you’ll say
“Sheesh, you call that password protection? Any idiot can break into a Win 95
box! And of course you’re right. But that’s the Micro$oft way. Remember this
next time you expect to keep something on your Win95 box confidential.
And when it comes time
to learn Win NT hacking, remember this Micro$oft security mindset. The funny
thing is that very few hackers mess with NT today because they’re all busy
cracking into Unix boxes. But there are countless amazing Win NT exploits just
waiting to be discovered. Once you see how easy it is to break into your Win 95
box, you’ll feel in your bones that even without us holding your hand, you
could discover ways to crack Win NT boxes, too.
But back to your
buddies waiting to see what an elite hacker you are. Maybe you’ll want them to
turn their backs so all they know is you can break into a Win95 box in less
than one minute. Or maybe you’ll be a nice guy and show them exactly how it’s
done.
But first, here’s a
warning. The first few techniques we’re showing work on most home Win 95
installations. But, especially in corporate local area networks (LANs), several
of these techniques don’t work. But never fear, in this lesson we will cover
enough ways to break in that you will be able to gain control of absolutely
*any* Win 95 box to which you have physical access. But we’ll start with the
easy ways first.
Easy Win 95 Breakin #1:
Step one: boot up your
computer.
Step two: When the “system
configuration” screen comes up, press the “F5” key. If your system doesn’t show
this screen, just keep on pressing the F5 key.
If your Win 95 has the
right settings, this boots you into “safe mode.” Everything looks weird, but
you don’t have to give your password and you still can run your programs.
Too easy! OK, if you
want to do something that looks a little classier, here’s another way to evade
that new password.
Easy Win 95 Breakin #2:
Step one: Boot up.
Step two: when you get
to the “system configuration” screen, press the F8 key. This gives you the
Microsoft Windows 95 Startup Menu.
Step three: choose
number 7. This puts you into MS-DOS. At the prompt, give the command “rename
c:\windows\*pwl c:\windows\*zzz.”
Newbie note: MS-DOS
stands for Microsoft Disk Operating System, an ancient operating system dating
from 1981. It is a command-line operating system, meaning that you get a prompt
(probably c:\>) after which you type in a command and press the enter key.
MS-DOS is often abbreviated DOS. It is a little bit similar to Unix, and in
fact in its first version it incorporated thousands of lines of Unix code.
Step four: reboot. You
will get the password dialog screen. You can then fake out your friends by
entering any darn password you want. It will ask you to reenter it to confirm
your new password.
Step five. Your friends
are smart enough to suspect you just created a new password, huh? Well, you can
put the old one your friends picked. Use any tool you like -- File Manager,
Explorer or MS-DOS -- to rename *.zzz back to *.pwl.
Step six: reboot and
let your friends use their secret password. It still works!
Think about it. If
someone where to be sneaking around another person’s Win 95 computer, using
this technique, the only way the victim could determine there had been an
intruder is to check for recently changed files and discover that the *.pwl
files have been messed with
Evil genius tip: Unless
the msdos.sys file bootkeys=0 option is active, the keys that can do something
during the bootup process are F4, F5, F6, F8, Shift+F5, Control+F5 and
Shift+F8. Play with them!
Now let’s suppose you
discovered that your Win 95 box doesn’t respond to the bootup keys. You can
still break in.
If your computer does
allow use of the boot keys, you may wish to disable them in order to be a teeny
bit more secure. Besides, it’s phun to show your friends how to use the boot
keys and then disable these so when they try to mess with your computer they
will discover you’ve locked them out.
The easiest -- but
slowest -- way to disable the boot keys is to pick the proper settings while
installing Win 95. But we’re hackers, so we can pull a fast trick to do the
same thing. We are going to learn how to edit the Win 95 msdos.sys file, which
controls the boot sequence.
Easy Way to Edit your Msdos.sys File:
Step zero: Back up your
computer completely, especially the system files. Make sure you have a Windows
95 boot disk. We are about to play with fire! If you are doing this on someone
else’s computer, let’s just hope either you have permission to destroy the
operating system, or else you are so good you couldn’t possibly make a serious
mistake.
Newbie note: You don’t
have a boot disk? Shame, shame, shame! Everyone ought to have a boot disk for
their computer just in case you or your buddies do something really horrible to
your system files. If you don’t already have a Win 95 boot disk, here’s how to
make one. To do this you need an empty floppy disk and your Win 95 installation
disk(s). Click on Start, then Settings, then Control Panel, then Add/Remove
Programs, then Startup Disk. From here
just follow instructions.
Step one: Find the file
msdos.sys. It is in the root directory (usually C:\). Since this is a hidden
system file, the easiest way to find it is to click on My Computer, right click
the icon for your boot drive (usually C:), left click Explore, then scroll down
the right side frame until you find the file “msdos.sys.”
Step two: Make
msdos.sys writable. To do this, right click on msdos.sys, then left click
“properties.” This brings up a screen on which you uncheck the “read only” and
“hidden” boxes. You have now made this a file that you can pull into a word
processor to edit.
Step three: Bring
msdos.sys up in Word Pad. To do this, you go to File Manager. Find msdos.sys
again and click on it. Then click “associate” under the “file” menu. Then click
on “Word Pad.” It is very important to use Word Pad and not Notepad or any
other word processing program! Then double click on msdos.sys.
Step four: We are ready
to edit. You will see that Word Pad has come up with msdos.sys loaded. You will
see something that looks like this:
[Paths]
WinDir=C:\WINDOWS
WinBootDir=C:\WINDOWS
HostWinBootDrv=C
[Options]
BootGUI=1
Network=1
;
;The following lines are
required for compatibility with other programs.
;Do not remove them
(MSDOS>SYS needs to be >1024 bytes).
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
To disable the function
keys during bootup, directly below [Options] you should insert the command
“BootKeys=0.” Or, another way to disable the boot keys is to insert the command
BootDelay=0. You can really mess up your snoopy hacker wannabe friends by
putting in both statements and hope they don’t know about BootDelay. Then save
msdos.sys.
Step five: since
msdos.sys is absolutely essential to your computer, you’d better write protect
it like it was before you edited it. Click on My Computer, then Explore, then
click the icon for your boot drive (usually C:), then scroll down the right
side until you find the file “msdos.sys.” Click on msdos.sys, then left click
“properties.” This brings back that screen with the “read only” and “hidden”
boxes. Check “read only.”
Step six: You *are*
running a virus scanner, aren’t you? You never know what your phriends might do
to your computer while your back is turned. When you next boot up, your virus
scanner will see that msdos.sys has changed. It will assume the worst and want
to make your msdos.sys file look just like it did before. You have to stop it
from doing this. I run Norton Antivirus, so all I have to do when the virus
warning screen comes up it to tell it to “innoculate.”
Hard Way to Edit your (or someone else’s) Msdos.sys File.
Step zero. This is
useful practice for using DOS to run rampant someday in Win NT LANs, Web and
Internet servers. Put a Win 95 boot disk in the a: drive. Boot up. This gives
you a DOS prompt A:\.
Step one: Make
msdos.sys writable. Give the command “attrib -h -r -s c:\msdos.sys” (This
assumes the c: drive is the boot disk.)
Step two: give the
command “edit msdos.sys” This brings up this file into the word processor.
Step three: Use the
edit program to alter msdos.sys. Save it. Exit the edit program.
Step four: At the DOS
prompt, give the command “attrib +r +h +s c:\msdos.sys” to return the msdos.sys
file to the status of hidden, read-only system file.
OK, now your computer’s boot keys are disabled.
Does this mean no one can break in? Sorry, this isn’t good enough.
As you may have guessed
from the “Hard Way to Edit your Msdos.sys” instruction, your next option for
Win 95 breakins is to use a boot disk that goes in the a: floppy drive.
HOW TO CUSTOMIZE WINDOWS 95 VISUALS
By : Harshit Chaturvedi
OK, let's say you are
hosting a wild party in your home. You decide to show your buddies that you are
one of those dread hacker d00dz. So you fire up your computer and what should
come up on your screen but the logo for "Windows 95." It's kind of
lame looking, isn't it? Your computer looks just like everyone else's box. Just
like some boring corporate workstation operated by some guy with an IQ in the
80s.
Now if you are a
serious hacker you would be booting up Linux or FreeBSD or some other kind of
Unix on your personal computer. But your friends don't know that. So you have
an opportunity to social engineer them into thinking you are fabulously elite
by just by customizing your bootup screen.
Now let's say you want
to boot up with a black screen with orange and yellow flames and the slogan
" K-Rad Doomsters of the Apocalypse." This turns out to be super
easy.
Now Microsoft wants you
to advertise their operating system every time you boot up. In fact, they want
this so badly that they have gone to court to try to force computer retailers
to keep the Micro$oft bootup screen on the systems these vendors sell.
So Microsoft certainly
doesn't want you messing with their bootup screen, either. So M$ has tried to
hide the bootup screen software. But they didn't hide it very well. We're going
to learn today how to totally thwart their plans.
Evil Genius tip: One of
the rewarding things about hacking is to find hidden files that try to keep you
from modifying them -- and then to mess with them anyhow. That's what we're
doing today.
The Win95 bootup
graphics is hidden in a file named c:\logo.sys. To see this file, open File
Manager, click "view", then click "by file type," then
check the box for "show hidden/system files." Then, back on
"view," click "all file details." To the right of the file
logo.sys you will see the letters "rhs." These mean this file is
"read-only, hidden, system."
The reason this
innocuous graphics file is labeled as a system file -- when it really is just a
graphics file -- is because Microsoft is afraid you'll change it to read
something like "Welcome to Windoze 95 -- Breakfast of Lusers!" So by
making it a read-only file, and hiding it, and calling it a system file as if
it were something so darn important it would destroy your computer if you were
to mess with it, Microsoft is trying to trick you into leaving it alone.
Now here's the easy way
to thwart Micro$oft and get the startup logo of your choice. We start by
finding the MSPaint program. It's probably under the accessories folder. But
just in case you're like me and keep on moving things around, here's the
fail-safe program finding routine:
1) Click "Start" on the lower left
corner of your screen.
2) Click "Windows Explorer"
3) Click "Tools"
4) Click "Find"
5) Click "files or folders"
6) After "named" type in
"MSPaint"
7) After "Look in" type in 'C:"
8) Check the box that says "include
subfolders"
9) Click "find now"
10)Double click on the icon of a paint bucket that turns up in a window.
This loads the paint program.
11)Within the paint program, click "file"
12)Click "open" OK, now you have MSPaint. Now you have a super
easy way to create your new bootup screen:
13)13) After "file
name" type in c:\windows\logos.sys. This brings up the graphic you get
when your computer is ready to shut down saying "It's now safe to turn off
your computer." This graphic has exactly the right format to be used for
your startup graphic. So you can play with it any way you want (so long as you
don't do anything on the Attributes screen under the Images menu) and use it
for your startup graphic.
14)14) Now we play with this
picture. Just experiment with the controls of MSPaint and try out fun stuff.
15)15) When you decide you really
like your picture (fill it with frightening hacker stuph, right?), save it as
c:\logo.sys. This will overwrite the Windows startup logo file. From now on,
any time you want to change your startup logo, you will be able to both read
and write the file logo.sys.
16)16. If you want to change the
shut down screens, they are easy to find and modify using MSPaint. The
beginning shutdown screen is named c:\windows\logow.sys. As we saw above, the
final "It's now safe to turn off
your computer" screen graphic is named c:\windows\logos.sys.
17)17. To make graphics that will
be available for your wallpaper, name them something like
c:\windows\evilhaxor.bmp (substituting your filename for "exilhaxor"
-- unless you like to name your wallpaper "evilhaxor.")
Evil Genius tip: The
Microsoft Windows 95 startup screen has an animated bar at the bottom. But once
you replace it with your own graphic, that animation is gone. However, you can
make your own animated startup screen using the shareware program BMP Wizard.
Some download sites for this goodie include:
http://www.pippin.com/English/ComputersSoftware/Software/Windows95/graphic.htm
http://search.windows95.com/apps/editors.html
http://www.windows95.com/apps/editors.html
Now the trouble with
using one of the existing Win95 logo files is that they only allow you to use
their original colors. If you really want to go wild, open MSPaint again. First
click "Image," then click "attributes." Set width 320 and
height to 400. Make sure under Units that Pels is selected. Now you are free to
use any color combination available in this program. Remember to save the file
as c:\logo.sys for your startup logo, or
c:\windows\logow.sys and or c:\windows\logos.sys for your shutdown
screens.
But if you want some
really fabulous stuff for your starting screen, you can steal graphics from
your favorite hacker page on the Web and import them into Win95's startup and
shutdown screens. Here's how you do it.
1) Wow, kewl graphics! Stop your browsing on that
Web page and hit the "print screen" button.
2) Open MSPaint and set width to 320 and height to
400 with units Pels.
3) Click edit, then click paste. Bam, that image
is now in your MSPaint program.
4) When you save it, make sure attributes are
still 320X400 Pels. Name it c:\logo.sys, c:\windows\logow.sys,
c:\windows\logos.sys, or c:\winodws\evilhaxor.bmp depending on which screen or
wallpaper you want to display it on.
Of course you can do
the same thing by opening any graphics file you choose in MSPaint or any other
graphics program, so long as you save it with the right file name in the right
directory and size it 320X400 Pels.
Oh, no, stuffy Auntie
Suzie is coming to visit and she wants to use my computer to read her
email! I'll never hear the end of it if
she sees my K-Rad Doomsters of the Apocalypse startup screen!!!
Here's what you can do
to get your boring Micro$oft startup logo back. Just change the name of
c:logo.sys to something innocuous that Aunt Suzie won't see while snooping with
file manager. Something like logo.bak. Guess what happens? Those Microsoft guys
figured we'd be doing things like this and hid a copy of their boring bootup
screen in a file named "io.sys." So if you rename or delete their
original logo.sys, and there is no file by that name left, on bootup your
computer displays their same old Windows 95 bootup screen.
Evil genius tip: Want
to mess with io.sys or logo.sys? Here's how to get into them. And, guess what,
this is a great thing to learn in case you ever need to break into a Windows
computer -- something we'll look at in detail in the next section.
Click "Start"
then "Programs" then "MS-DOS." At the MS_DOS prompt enter
the commands:
ATTRIB -R -H -S
C:\IO.SYS
ATTRIB -R -H -S
C:\LOGO.SYS
Now they are totally at
your mercy, muhahaha!
OK, that's it for
now. You 31337 hackers who are feeling
insulted by reading this because it was too easy, tough cookies. I warned you.
But I'll bet my box has a happier hacker logon graphic than yours does. K-Rad
Doomsters of the apocalypse, yesss!
Want to see back issues
of Guide to (mostly) Harmless Hacking? See either
http://www.tacd.com/zines/gtmhh/
or
http://ra.nilenet.com/~mjl/hacks/codez.htm
or
http://www3.ns.sympatico.ca/loukas.halo8/HappyHacker/
Subscribe to our email
list by emailing to hacker@techbroker.com with message "subscribe" or
join our Hacker forum at http://www.infowar.com/cgi-shl/login.exe.
Chat with us on the
Happy Hacker IRC channel. If your browser can use Java, just direct your
browser to www.infowar.com, click on chat, and choose the #hackers channel.
Want to share some kewl
stuph with the Happy Hacker list? Correct mistakes? Send your messages to
hacker@techbroker.com. To send me
confidential email (please, no discussions of illegal activities) use cmeinel@techbroker.com and be sure to
state in your message that you want me to keep this confidential. If you wish
your message posted anonymously, please say so!
Direct flames to
dev/null@techbroker.com. Happy hacking!
Ooops! We had a period
on a line by itself followed by return which made the SMTP port think it had
gotten the end of the message. Shoot, all the good stuff came after it! Now
this time you get enough to learn the hacker way to edit Windows Registries and
trash your CMOS, heh,heh...
