- #Can you unprotect excel spreadsheet without password how to#
- #Can you unprotect excel spreadsheet without password password#
I don't need to know the original password used by the actor, I don't even need a working office document when I'm done, I just want to dump the decrypted internals so I can run yara against them to determine whether we're patched against the vulnerability. Even olevba can get into the file so I know there are shortcuts that don't involve knowing the original password The file can be opened without the password, and the exploit works and beacons without the password being manually input, so the file obviously gets decrypted based on the key being either in the file itself or office knowing a key to decrypt, otherwise you wouldn't be able to load the file without knowing the "secret". For the sake of being thorough, lets assume I didn't try anything with editing the hex of files or running the VBA script since I can't remember how I got it to work the first time. I know I did something else, but I can't find the source for it again, and looking for the anchor phrase in the hex turns up nothing, so I must have done something else to the file last time that I can't remember doing. I remember running the script on this site: and it not working, but trying again it prevents me from opening the dev console and I don't remember what I did to make it work the first time. office2john.py -> johntheripper: password is not in the dictonary and 2.5 hours on 8 cores does nothing. 
The rest of oletools: either return nothing or return the same thing as using 7zip. The file pops it's exploit without enabling macros even though it has the standard social engineering image telling you to do so. The file format is MS Compound (0xd0cf11e0 magic). xlsx file.Īdditional details based on conversation in meta: 
How do I remove the "protection" from the workbook so I can save it without knowing the password? Trying password crackers "works" (I can still open the file and view it) but it seems to corrupt the file such that I can't save it as cleartext to examine it's internals.
#Can you unprotect excel spreadsheet without password how to#
I need to know which vulnerability the document targets to determine coverage, but I don't know how to remove it. It seems as thought the workbook is protected, and I'm not sure how to access the cleartext version of the document on disk. Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in entropy analysis (7.9) is technically encrypted, even without requiring a password to open.
0 kommentar(er)
