Page 1 of 1

Decrypting Office files - password removal

Posted: Sun Dec 06, 2009 7:25 am
by dillion
I wrote a Christmas shopping list earlier this year and put in password-protection on it (open) - when the time came for me to start shopping... I cannot remember the password! :banghead:

So far with a few freeware applications, I am not able to recover the password and the only thing that actually worked is the decryption service (e.g. password removal) like http://www.officepasswordremover.com/

This made me think... how do they do it? I would love to write a PHP function to do this but no idea how they managed to decrypt a password-protected file in a matter of seconds and so easily!

For the moment, I am not too keen on spending £25 to allow me to open a word document. :wink:

Re: Decrypting Office files - password removal

Posted: Sun Dec 06, 2009 3:18 pm
by dillion
Ok... further research has yield that Word password protection is based on RC4 encryption so this means that an encryption key must be somewhere inside the Word document file.

What are your thoughts?

EDIT: I have found another password removal service - http://www.decryptum.com - pretty impressive but still pretty expensive!

Re: Decrypting Office files - password removal

Posted: Sun Dec 06, 2009 4:54 pm
by BlaineSch
Since it is your password it might be possible to try and bruteforce it using the letters from your common passwords?

Re: Decrypting Office files - password removal

Posted: Sun Dec 06, 2009 5:13 pm
by dillion
BlaineSch wrote:Since it is your password it might be possible to try and bruteforce it using the letters from your common passwords?
The file is being bruteforced at the moment and has been since last night (my poor computer!) - whether it will work or not, I don't know. The software I am using are:
- GuaWord (command-line)
- MS Word Excel Cracker
- Office Key

As a side project, I thought it would be interesting to write a function to decrypt a doc file - so far I am not able to find where the encryption key is stored or what it looks like!

Re: Decrypting Office files - password removal

Posted: Tue Dec 08, 2009 5:46 am
by dillion
*bump* any ideas?

Re: Decrypting Office files - password removal

Posted: Tue Dec 08, 2009 3:16 pm
by daedalus__

Re: Decrypting Office files - password removal

Posted: Tue Dec 08, 2009 3:58 pm
by daedalus__

Re: Decrypting Office files - password removal

Posted: Tue Dec 08, 2009 4:32 pm
by dillion
thanks for your replies - unfortunately, the 1st link is only applicable for Modify password and not Open password.

The 2nd one looks interesting and shall look further although I am not familar with .NET. :)

I did find this one earlier - http://msdn.microsoft.com/en-us/library/dd945851.aspx - so far, I can't see anything in the text unless I am missing something. :crazy:

Re: Decrypting Office files - password removal

Posted: Sat Dec 12, 2009 5:16 am
by josh
Could this be related? http://user.services.openoffice.org/en/ ... 56&start=0
Probably not

Re: Decrypting Office files - password removal

Posted: Wed Jun 16, 2010 10:42 am
by steeveherris
Yes it can be done if some expert in decrypting can do the password hacking and decrypt the office files. So always be aware of such masters. They can trouble you and your data.

Re: Decrypting Office files - password removal

Posted: Wed Jun 16, 2010 10:49 am
by Benjamin
:arrow: Locked. Sorry, this is too shady.