cracking excel file protection

by beAsty • 28 Apr 2012, 18:18 • Journals
Since some employee got kicked and I have to continue his work (with all his .xlsx files being password protected) I wonder if anyone knows a good way (besides bruteforcing) to crack that password.

Talking about file protection (so not worksheet protection.. I dont see anything when opening the file except a password prompt). Maybe there is a way to get the md5 hash and let online crackers do the job? Any exploits?

Thanks
Comments
23
▼
Mayni 28 Apr 2012, 19:23
Probably not overly helpful, but there are definitely programs that you can use, would help if could remember the name... google should be your friend.

e: Fuck Excel & VBA.
▼
beAsty 28 Apr 2012, 19:25
I googled all day but could only find apps to crack the work sheet protection :/
Parent
▼
LeFrancis 28 Apr 2012, 19:24
ahahah he got kicked and trolled hard his boss
▼
sAm. 28 Apr 2012, 19:30
call him and ask for password
▼
beAsty 28 Apr 2012, 19:33
that guy is kinda pissed. No chance to get the password from him :P
Parent
▼
chosen 28 Apr 2012, 19:36
pretty easy - tell your boss and get lawyers. he got paid for those and he doesnt own them :p

Dont know any tool :(
▼
slajdan 28 Apr 2012, 23:58
Well that is one way to see it, this journal don't really tell much of the story but the ex-employee is probably pissed for a reason. From 2nd hand experience information, middle to semi-big companies sometimes screw employees over. In most countries the laws aint as biased towards the workers, unlike in Germany.
Parent
▼
twister 28 Apr 2012, 19:50
Unless its an ancient excel version you arent gonna crack it.
▼
vj7o 28 Apr 2012, 20:44
ask the file if it gives u the psw :D
▼
Seanza 28 Apr 2012, 20:50
Not sure how your company works, but is there not a network admin who can get into the files for you?
▼
slajdan 28 Apr 2012, 20:52
no decent person would help with that, just scrap it and let them pay the expense to re-do it
▼
yellowpowerranger 28 Apr 2012, 21:10
dont know if brute force will work on that
▼
unblind 28 Apr 2012, 22:04
no idea, does it encrypt the data in the sheets or just lock the file to excel?

if it doesn't encrypt the data you could copy it without the password lols
▼
beAsty 28 Apr 2012, 22:11
hmm no idea actually. How can I copy the data if it isn't encrypted? However I'm sure its encrypted with aes 128 bit
Parent
▼
beAsty 28 Apr 2012, 22:13
looks like its not encrypted.. look at file encryption:
http://www.mcgimpsey.com/excel/fileandvbapwords.html
Parent
▼
beAsty 28 Apr 2012, 22:19
bla.. hex editor only shows encrypted content.. one of the first lines even is "encrypted package"
Parent
▼
unblind 29 Apr 2012, 00:44
sad, there was a java package which would let you export the sheets into a new file without the password included but if they get encrypted nowdays it probably wouldn't be much use:P

might want to try a dictionary hack maybe, or what is the data you need to get out of the sheet it must exist somewhere else too
Parent
▼
beAsty 29 Apr 2012, 10:36
nah it's an excel sheet with all kind of information written in it. I have "copies" of it with the extension ".xlk".. but also password protected.

Hmm I don't think that a dicionary attack will include the propably weird password :P I Mean it won't have any special character but it surely is something from our company related.
Parent
▼
montage 29 Apr 2012, 13:49
Same as trying to crack PDF file,both encrypted and since I don't know about any exploit / buffer overflow avi , you could either search for one,or go bruteforce on it,tho it's just a file so you wont need proxies and shit,just a good words list,also keep in mind,that if that's not a personal file,the pw might be hard to crack with any kind of wordlist,just find a good cracker and pay him off.
▼
beAsty 29 Apr 2012, 16:16
trying to find some guy with a nice system & rainbowtable/wordlist for cracking.. couldn't find one so far :S
Parent
▼
montage 29 Apr 2012, 22:03
Craigslist / go to deep web / post at 4chan ^_^
I can hook you up with someone at irc,but it may cost you some.
Parent
▼
beAsty 30 Apr 2012, 16:22
would be nice, let me know the price ;P
Parent
Back to top