Crippling Windows - taking advantage of Windows vulnerabilities

Back
during college days and when cybercafes around the region were mushrooming
at a steady pace, a few of my friends used to hang out in these cafes
during study breaks or after class (or those classes we skip occasionally
;)

At
that time, 1996-97, PCs were considered high-end with Pentium 133MHz and
16MB RAM and were mainly running Windows 95 (some Windows OSR 1 A.K.A.
Windows 96 A.K.A. Windows 95 version A etc.). While the others went there
mainly to play network games of Quake 1 and Command & Conquer:Red
Alert, I use to enjoy fiddling around with their PCs in the cafe.

Knowing the so-called 'system admin' there didn't know much about PCs
other than logging people in which he's so good at doing, it's nice to
screw up some systems and watch him scratch his head wondering what's
going on. You'd think admins running a net cafe would know more about
the systems they had...but nooooooo, they're more adapt at going around
asking ppl if they logged in or if they paid for their food/drinks....which
so happens this Java cafe was horrible at producing!

<<
ENOUGH OF THE HISTORY, GET ON WITH IT ALREADY! >>

Allright
then, i know this more of a Linux site (heck, if we went along with Microsoft,
we'd all end up as Borgs under Gates empire...it's about time the Rebellion
was born!) but i've been around DOS/Windows more often so i'll be telling
more about those. First of all, you DO have Windows don't you? (even though
you're probably running Linux on your PC) If you don't what's the use
reading all these for? Aha, unless you want to try it out on some poor
soul's system and let them wonder how you did it...

Anyway,
windows, being more of an OE (Operating Environment) than an OS, doesn't
have security measures before you reach the GUI desktop. Halting Win before
is loads up at the command prompt easily makes the critical files available
to anyone via DOS. If you have Windows 95 onwards, hit F8 before the Windows
startup logo appears. One such fun file that windows uses to load settings
is the system.ini file. Windows executes this file before the other companion,
win.ini. These 2 text config files can be edited with any text editor,
like from the dos prompt:

C:>edit
c:windowssystem.ini

yeah,
wouldn't it be nice to have green text alike The Matrix when you type
in DOS? Of course you can...you'll need to edit your autoexec.bat and config.sys (found in the root of your hard disc) to add these lines:

C:>edit
c:config.sys

Then
type this in one of the lines and exit and save it:

devicehigh=c:windowscommandansi.sys

Next,
add this in the autoexec.bat file and save, exit:

prompt
$e[1;32;40m

Wallah!
Next time you reboot your PC, anything you type at the dos prompt (either
before win has loaded or from the command prompt in win) you'll get green
text.

<<
NOT RECOMMENDED FOR NEWBIES OR THOSE UNFAMILIAR WITH WINDOWS >>

Right
then, back to editing that system.ini file. We're more interested in
the first few lines of system.ini:

[boot]
oemfonts.fon=vgaoem.fon
shell=Explorer.exe
system.drv=system.drv

See that
shell=explorer.exe line? That line tells windows what executable to
use as the shell. In this case, the taskbar, desktop icons and such
when you're in the GUI is part of the Explorer shell. Now if you were
to change that to point to say, calc.exe (my personal fav), then when
the desktop appears, all that will be there is the calculator program
that comes with Windows. No desktop icons, no taskbar, no right click
desktop to call up display properties, etc. You could say what you have
with you now is one heck of an expensive calculator :)

Now if
you want to do anything else in Windows, the only option is to double
click the desktop to call up Task Manager and from there run an application
or reboot/shutdown. The other alternative is to CTRL+ALT+DEL to call
up the running list apps and click shutdown. :D

Now if
you want...you can even change the .exe of taskman (which is the Task
Manager) so that if anyone double clicks the desktop, that app will
run instead. This way, no one can even run any program at all nor reboot
the system. The only option is to hit that 3 finger salute and click
shutdown :) How? Add/modify this:

taskman=calc.exe
(or
anything else like winver.exe which will pop up win version)

To restore
it back, change it to:

taskman=taskman.exe

For additional
fun, instead of making the shell as calc.exe, you can try winver.exe
:)

- xearthed

1.)
OsReview
: Mandrake Linux 7.0 Deluxe -
L33tdawg

2.)
Setting up
a DHCP server (Part 1) -
L33tdawg

3.)
Basic
Networking Guide -
Haven

4.)
How
To HaX0r1z3 your Toaster -
[SANiTY]

5.)
INFOSEC:
Theoretical vs. Practical Security
- Silere Praeses

6.)
Hop Box
- A telephone relay proposal -
Silere Praeses

7.)
Crippling
Windows -
xearthed