2

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in entropy analysis is technically encrypted, even without a password. It seems as thought the workbook is protected, and I'm not sure how to access the cleartext version of the document

I need to know which vulnerability the document targets to determine coverage, but I don't know how to remove it.

How do I remove the "protection" from the workbook so I can save it without knowing the password? Trying password crackers "works" but it seems to corrupt the file such that I can't save it as cleartext to examine it's internals.

I should mention that this is an .xlsx file.

Improve this question
3
  • 2
    XLSX files are compressed (zip format) so I would expect high entropy. Have you tried renaming the file with a zip extension and unzipping to see the contents ?
    – Ian Cook
    Jan 25, 2020 at 10:27
  • The internals aren't the same as an ordinary workbook: I have [6]DataSpaces, EncryptedPackage, and EncryptionInfo at the top level of the zip file. DataSpaces doesn't have anything of note in it either.
    – solumnant
    Jan 27, 2020 at 17:25
  • I've started in on the password using John the Ripper, but it's been two hours now on an 8 core machine.
    – solumnant
    Jan 27, 2020 at 19:20

1 Answer 1

Reset to default
1

If I get your question right This link can help you to get the password of office files.

Improve this answer
1
  • I need to do this locally: I can't submit files to third party sites.
    – solumnant
    Jan 27, 2020 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.