Hacking a Windows 95 shell via Microsoft Office.

Bypassing a Restricted Workstation using Microsoft Office.

Breaking out of a Windows 95 Shell with a Word Processor.

Bypassing a Restricted Workstation using Microsoft Office.

So, the admins have restricted a workstation leaving you stuck in a "Windows 95 shell", so to speak. Your access to the Start Menu is extremely limited. You don't even have access to the My Computer and Network Neighborhood icons, normally located on the desktop. What do you do now? There is no way to get to the files you need. But then you see the Microsoft Office menu bar at the top right of the screen. Here is what you do.

The following technique will work with almost any Microsoft program in the Windows 95 environment. Specifically Microsoft Office. Even more specifically Microsoft Word, Excel, PowerPoint, Outlook, Access, and Binder. Go to The help menu in any of the preceding programs and down to About **** (**** is the program name). Then click on System Info. Once you have the System Info window up you will want to click the Run button located just under and slightly to the right of the Edit menu. You then have the ability to run and delete any program on the computer. Also, there is a nice little way of getting onto a network setup so you can type in a username and password if you have one. Go to the File menu. Then go to the Open menu. Then click on Network and you will get to a prompt which shows all the previously accessed servers on the network. Sometimes you might be able to get into servers at your campus or other campuses in other counties (it should be noted that you will only see these other servers on the network if someone else has already visited that place on the network via Windows 95). Be careful.

Breaking out of a Windows 95 Shell with a Word Processor.

If you want total access (including the start menu), just using a basic word processing program (anything Microsoft Office and maybe some "third party" programs such as WordPerfect).

Click on the "Insert" button on the Menu bar.

Then scroll down to "Object" and click on it.

If you are using Microsoft Office 97 to do this, the next thing you will do is click on the "Create From File" tab on the window that comes up.

Then click the "Browse" button.

Look for the "Explorer.exe" icon ((or "Winfile.exe", whichever you prefer) these are in the "C:\Windows" folder).

After you have selected a program that will let you explore the directories, click on "Ok".

Now you should see the icon on your document. Double click the icon and --poof-- Windows Explorer pops up out of nowhere.

Now search for "*.pol" (A file that is created by the System policy editor). Backup whatever file you find with the extension of *.pol. Then delete that file and the start button should be fully operational. Another way is to press F8 at startup, distrupting normal operation and using safemode to start up Windows 95.

Then when in safemode change the name of the shell program used by the school. This is done by editing the system.ini file located at c:\windows\system.ini. You can put a semicolon in front of what the current shell is. The shell you should have is SHELL=C:\WINDOWS\EXPLORER.EXE. Make sure that line is in the system.ini file under the [Boot] section and then save the changes you have made to the file. Then reboot.. Now you have access to everything, but remember to cover you tracks and change the name of the shell back. So the next person that uses the computer will get the restricted shell again.

Also remember to edit the autoexec.bat file located at c:\autoexec.bat. If a shell program is still running after you have edited the system.ini file, then you might need to edit this file. To temporarily change what the autoexec file does, all you need to do is put the word "REM" without the quotes in front of a command in the autoexec file.

Remember the most important thing is the trust and gullibility of your school staff, so cover those tracks.

written and submitted by The Old One
modified by m2mike

X ViRuSxKiLLeRsX pReZ.

The person who submitted this to me has left details vague. I have filled in what I know is correct. As you can see, there is a lack of specifics. If there is a discrepancy, please tell me. If you have anything to add or correct, then you know how to send e-mail. m2mike@yahoo.com Thank you.

written by m2mike

As always, if you know something about bypassing restricted workstations, then please e-mail me. Thank you.

Michael Edwards
213 Productions
Copyright 1997-2003
Last updated 11-4-98