2

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in entropy analysis is technically encrypted, even without a password. It seems as thought the workbook is protected, and I'm not sure how to access the cleartext version of the document

I need to know which vulnerability the document targets to determine coverage, but I don't know how to remove it.

How do I remove the "protection" from the workbook so I can save it without knowing the password? Trying password crackers "works" but it seems to corrupt the file such that I can't save it as cleartext to examine it's internals.

I should mention that this is an .xlsx file.

3
  • 2
    XLSX files are compressed (zip format) so I would expect high entropy. Have you tried renaming the file with a zip extension and unzipping to see the contents ? – Ian Cook Jan 25 '20 at 10:27
  • The internals aren't the same as an ordinary workbook: I have [6]DataSpaces, EncryptedPackage, and EncryptionInfo at the top level of the zip file. DataSpaces doesn't have anything of note in it either. – solumnant Jan 27 '20 at 17:25
  • I've started in on the password using John the Ripper, but it's been two hours now on an 8 core machine. – solumnant Jan 27 '20 at 19:20
1

If I get your question right This link can help you to get the password of office files.

1
  • I need to do this locally: I can't submit files to third party sites. – solumnant Jan 27 '20 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.