Microsoft Excel

For more information on macros, see Microsoft Office Macros.

Unprotect Workbook / Worksheet

Import into GoogleDOCS

Import in Google Docs, then export to Excel file. This should remove the protection.

Edit the XML files

• Add .zip to the file extension.
• Open the zip file.
• Navigate to /xl/worksheets
• Open the xml file for the protected sheet
• Search for “sheetProtection” and remove the whole tag <sheetProtection …>
• Remove the .zip extension.
• The protection should be gone (might require saying “Yes” to recovering file)

Bruteforce the password

Bruteforce with Visual Basic Application (VBA)

Old Excel hash with 4-letter format: e.g. “CDEF”, lot of collisions…

Sub PasswordBreaker()
    'Author unknown but submitted by brettdj of www.experts-exchange.com
    Dim i As Integer, j As Integer, k As Integer
    Dim l As Integer, m As Integer, n As Integer
    Dim i1 As Integer, i2 As Integer, i3 As Integer
    Dim i4 As Integer, i5 As Integer, i6 As Integer
 
    On Error Resume Next
 
    For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
    For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
    For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
    For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
 
    ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
        Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
        Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
    If ActiveSheet.ProtectContents = False Then
 
        MsgBox "One usable password is " & Chr(i) & Chr(j) & _
            Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
            Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
        ActiveWorkbook.Sheets(1).Select
 
        Range("a1").FormulaR1C1 = Chr(i) & Chr(j) & _
            Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
            Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
        Exit Sub
 
    End If
 
    Next: Next: Next: Next: Next: Next
    Next: Next: Next: Next: Next: Next
End Sub

Bruteforce with a wordlist

Option Explicit
' CHANGE THESE
Const strWordlist As String = "C:\wordlists\rockyou.txt"
Const strWorksheetName As String = "Sheet1"

Dim Found As Boolean

Sub BruteForce()
    Dim strLine As String
    Found = False
        
    Open strWordlist For Input As #1
    Do While Not EOF(1) And Not Found
       Line Input #1, strLine
       Unprotect_WorkSheet (strLine)
    Loop
    Close #1

    If Not Found Then
        MsgBox "Password was NOT found"
    End If
End Sub

Sub Unprotect_WorkSheet(strPassword As String)
    On Error Resume Next
    ThisWorkbook.Sheets(strWorksheetName).Unprotect Password:=strPassword

    If Err.Number <> 0 Then
        'MsgBox "The Password provided is incorrect"
        Exit Sub
    Else
        Found = True
        MsgBox "The Password is " & strPassword
    End If
End Sub

Extract the hash and use Hashcat

9700 | MS Office <= 2003 $0/$1, MD5 + RC4               | Documents
9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1  | Documents
9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2  | Documents
9800 | MS Office <= 2003 $3/$4, SHA1 + RC4              | Documents
9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1    | Documents
9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2    | Documents
9400 | MS Office 2007                                   | Documents
9500 | MS Office 2010                                   | Documents
9600 | MS Office 2013                                   | Documents

Hashcat

Extract password from External Data Connection

When there is an External Data Connection (data query), if the password is saved, it is possible to extract.

• Rename myfile.xlsx to myfile.zip
• The credentials and connection information are in myfile.zip\xl\connections.xml