How to Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel Spreadsheets « Null Byte :: WonderHowTo

Microsoft Office files can be password-protected in order to prevent tampering and ensure data integrity. But password-protected documents from earlier versions of Office are susceptible to having their hashes extracted with a simple program called office2john. Those extracted hashes can then be cracked using John the Ripper and Hashcat.Extracting the hash from a password-protected Microsoft Office file takes only a few seconds with theoffice2johntool. While the encryption standard across different Office products fluctuated throughout the years, none of them can stand up to office2john's hash-stealing abilities.This tool is written in Python and can be run right from theterminal. As for Office compatibility, it's known to work on any password-protected file from Word, Excel, PowerPoint, OneNote, Project, Access, and Outlook that was created usingOffice 97,Office 2000,Office XP,Office 2003,Office 2007,Office 2010, andOffice 2013, including theOffice for Macversions. It may not work on newer versions of Office, though, we saved a DOCX inOffice 2016that was labeled as Office 2013.Step 1: Install Office2JohnTo get started, we'll need to download the toolfrom GitHubsince office2john is not included in the standard version ofJohn the Ripper(which should already be installed in your Kali system). This can easily be accomplished withwget.~# wget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/office2john.py

--2019-02-05 14:34:45--  https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/office2john.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.148.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.148.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 131690 (129K) [text/plain]
Saving to: ‘office2john.py’

office2john.py                        100%[=======================================================================>] 128.60K  --.-KB/s    in 0.09s

2019-02-05 14:34:46 (1.45 MB/s) - ‘office2john.py’ saved [131690/131690]Step 2: Make Sure Everything's in the Same DirectoryIn order to run office2john withPython, we will need tochangeinto the same directory that it was installed into. For most of you, this will be Home by default (just entercd), but feel free to create a separate directory.Next, we need an appropriate file to test this on. I am using a simple DOCX file named "dummy.docx" that I created and password-protected with Word 2007.Download itto follow along. The password is "password123" as you'll find out. You can also download documents made withWord 2010andWord 2016(that shows up as 2013) to use for more examples. Passwords for those are also "password123."Step 3: Extract the Hash with Office2johnThe first thing we need to do isextract the hashof our password-protected Office file. Run the following command and pipe the output into "hash.txt" for later use.~# python office2john.py dummy.docx > hash.txtTo verify that the hash was extracted successfully, use thecatcommand. We can see that the hash I saved corresponds to Microsoft Office 2007. Neat.~# cat hash.txt

dummy.docx:$office$*2007*20*128*16*a7c7a4eadc2d90fb22c073c6324b6b49*abc5f80409f5f96f97e184e44aacd0b7*930b0c48a7eb5e13a57af4f3030b48e9402b6870Step 4: Crack the Hash You Just SavedLike already mentioned, we'll be showing you two ways to crack the hash you just saved from the password-protected Microsoft Office file. Both methods work great, so it's really up to preference.Option 1: Cracking with JohnSet the--wordlistflag with the location of your favorite word list. The one that is included withNmapwill do for our purposes here, but for tougher passwords, you may want to go with a more extensive word list.~# john --wordlist=/usr/share/wordlists/nmap.lst hash.txt

Using default input encoding: UTF-8
Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 128/128 SSE2 4x / SHA512 128/128 SSE2 2x AES])
Cost 1 (MS Office version) is 2007 for all loaded hashes
Cost 2 (iteration count) is 50000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for statusJohn will start cracking, and depending on the password complexity, will finish when a match is found. Press almost any key to view the current status. When the hash is cracked, a message will be displayed on-screen with the document's password: Since our password was pretty simple, it only took seconds to crack it.password123      (dummy.docx)
1g 0:00:00:03 DONE (2019-02-05 15:00) 0.2824g/s 415.8p/s 415.8c/s 415.8C/s lacoste..cooldude
Use the "--show" option to display all of the cracked passwords reliably
Session completedWe can also use the--showoption to display it, like so:~# john --show hash.txt

dummy.docx:password123

1 password hash cracked, 0 leftNow that we know one method of cracking a password-protected Microsoft Office file, let's look at one other way using the powerful toolHashcat.Option 2: Cracking with HashcatWe can begin by displaying the help menu (--help) for Hashcat. This will provide us with a wealth of information including usage options, hash modes, and other features. There is a ton of information here, so I won't show the output, but you should dive into it if you really want to know Hashcat.~# hashcat --helpFrom the output, we're just interested in the MS Office hash modes. Near the bottom of the help menu, we will find the MS Office mode options and their corresponding numbers. We know from our hash that this is an Office 2007 file, so locate its number ID of9400.9700 | MS Office <= 2003 $0/$1, MD5 + RC4               | Documents
9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1  | Documents
9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2  | Documents
9800 | MS Office <= 2003 $3/$4, SHA1 + RC4              | Documents
9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1    | Documents
9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2    | Documents
9400 | MS Office 2007                                   | Documents
9500 | MS Office 2010                                   | Documents
9600 | MS Office 2013                                   | DocumentsNow we can set the rest of our options using the following command.~# hashcat -a 0 -m 9400 --username -o cracked_pass.txt hash.txt /usr/share/wordlists/nmap.lstThe-aflag sets the attack type as the default straight mode of0.The-mflag specifies the mode we want to use, which we just found.The--usernameoption ignores any usernames in the hash file.We can specify the output file ascracked.txtwith the-oflag.And finally, we can pass inhash.txtwhich contains the hash, and set a word list just like we did earlier.Hashcat will then begin cracking.hashcat (v5.1.0) starting...

* Device #2: Not a native Intel OpenCL runtime. Expect massive speed loss.
             You can use --force to override, but do not report related errors.
OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Core(TM) i5 CPU       M 480  @ 2.67GHz, 934/3736 MB allocatable, 4MCU

...After some time has passed, the status will show as cracked, and we are ready to view the password.Session..........: hashcat
Status...........: Cracked
Hash.Type........: MS Office 2007
Hash.Target......: $office$*2007*20*128*16*a7c7a4eadc2d90fb22c073c6324...2b6870
Time.Started.....: Tue Feb  5 15:08:00 2019 (4 secs)
Time.Estimated...: Tue Feb  5 15:08:04 2019 (0 secs)
Guess.Base.......: File (/usr/share/wordlists/nmap.lst)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      610 H/s (8.51ms) @ Accel:512 Loops:128 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 2048/5084 (40.28%)
Rejected.........: 0/2048 (0.00%)
Restore.Point....: 0/5084 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:49920-50000
Candidates.#1....: #!comment:  ***********************IMPORTANT NMAP LICENSE TERMS************************ -> Princess

Started: Tue Feb  5 15:07:50 2019
Stopped: Tue Feb  5 15:08:05 2019Simplycatout the specified output file, and it will show the hash with the plaintext password tacked on the end.~# cat cracked_pass.txt

$office$*2007*20*128*16*a7c7a4eadc2d90fb22c073c6324b6b49*abc5f80409f5f96f97e184e44aacd0b7*930b0c48a7eb5e13a57af4f3030b48e9402b6870:password123Success! Now we know two methods of cracking the hash after extracting it from a password-protected Microsoft Office file with office2john.How to Defend Against CrackingWhen it comes topassword crackingof any kind, the best defense technique is to usepassword best practices. This means using unique passwords that are long and not easily guessable. It helps to utilize a combination of upper and lowercase letters, numbers, and symbols, although recent research has shown that simply usinglong phrases with high entropy is superior. Even better are long, randomly generated passwords which makes cracking them nearly impossible.In regards to this specific attack, usingMicrosoft Office 2016or2019documents or newer may not be effective, since office2john is designed to work on earlier versions of Office. However, as you can see above, Office 2016 may very well spit out a 2013 document without the user even knowing, so it doesn't mean a "new" file can't be cracked. Plus, there are still plenty of older Microsoft Office documents floating around out there, and some organizations continue to use these older versions, making this attack still very feasible today.Wrapping UpToday, we learned that password-protected Microsoft Office files are not quite as secure as one would be led to believe. We used a tool called office2john to extract the hash of a DOCX file, and then cracked that hash using John the Ripper and Hashcat. These types of files are still commonly used today, so if you come across one that has a password on it, rest easy knowing that there is a way to crack it.Don't Miss:How to Create Stronger Passwords (Advice from a Real Hacker)Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byefes/PixabayRelatedHow To:Expand Your Analytical & Payload-Building Skill Set with This In-Depth Excel TrainingHow To:Create & Edit Documents Using Microsoft Office for Android & iOSHow To:The Ultimate Guide to Password-Protecting Files & Folders in Mac OS X YosemiteHack Like a Pro:How to Extract Metadata from Websites Using FOCA for WindowsHow To:Get the Galaxy S4's Polaris Office 5 to Edit Microsoft Office Docs on Your Samsung Galaxy Note 2How To:Password-Protect Files & Folders in Mac OS X (Snow Leopard)How To:Still Using Notes? Here Are 3 Better Word Processing Apps for Writing on Your iPhoneHow To:Add spreadsheet snippets in Microsoft Excel: Mac 2008Office for Mac 2016:See What's New & Try Out the Public PreviewDeal Alert:Grab This Microsoft Office Beginner's Guide for Only $35How To:Protect Word Doc with PasswordHow To:Score a Full Version of Microsoft Office for Only $10How To:Import different types of data in Microsoft ExcelHow To:Format spreadsheets in Microsoft Office ExcelHow To:Get started using Microsoft Office ExcelHow To:Count word length with the LEN function in MS ExcelHow To:Use VLOOKUP in Microsoft Office Excel 2007How To:Add comments to cells in Microsoft ExcelHow To:Concatenate in Microsoft Office ExcelHow To:Calculate averages in Microsoft Office ExcelHow To:Get Data Directly from a Paper Table into an Excel File on Your Phone with This Neat FeatureHow To:Use HLOOKUP across two worksheets in Microsoft ExcelHow To:Use the LEFT and RIGHT functions in Microsoft ExcelHow To:Prevent duplicate entries in an Excel spreadsheetHow To:Use conditional formatting in Microsoft ExcelHow To:Use nested IF statements in Microsoft Office ExcelHow To:Use simple formulae in Microsoft Office ExcelHow To:Use predefined workflows in Microsoft Office: Mac 2008How To:Concatenate in Microsoft Excel using cell referencesHow To:Use Visual Basic macros in Microsoft Excel: Mac 2008How To:Translate documents in Microsoft Office: Mac 2008How To:Use COUNTIF in Microsoft ExcelHow To:Use VLOOKUP across worksheets in MS Excel 2007How To:Use absolute ($) cell referencing in ExcelHow To:Count unique records exceeding a hurdle in MS ExcelHow To:Convert .docx format files to .doc in Microsoft OfficeHow To:Use the auto-complete feature in MS Office Excel 2007How To:Zoom in on Microsoft Office documents in Mac OS XHow To:Use the QUOTIENT and MOD functions in Microsoft ExcelHow To:Download and use clipart in Microsoft Office: Mac 2008