Microsoft Excel

For more information on macros, see Microsoft Office Macros.

Table of Contents

Unprotect Workbook / Worksheet

Option 1 – Edit the XML files

  • Add .zip to the file extension.
  • Open the zip file.
  • Navigate to /xl/worksheets
  • Open the xml file for the protected sheet
  • Search for “sheetProtection” and remove the whole tag <sheetProtection …>
  • Remove the .zip extension.
  • The protection should be gone (might require saying “Yes” to recovering file)

It could also be useful to crack the hash from the sheetProtection tag. Passwords are often reused.

<sheetProtection algorithmName="SHA-512" hashValue=".../...==" saltValue="...==" spinCount="100000" .../>

Hashcat Type is MS Office 2016 – SheetProtection (25300)

$office$2016$0$spinCount$saltValue$hashValue
hashcat --session=mask -O -m 25300 -a 3 --increment --increment-min=1 --increment-max=8 $HASH ?a?a?a?a?a?a?a?a

Option 2 – Import into GoogleDOCS

Import in Google Docs, then export to Excel file. This should remove the protection.

Bruteforce the password

For password on the macros (vbaProject.bin)

When prompted for a password when trying to view the macro code

  • Rename the Excel file as <filename>.zip
  • Copy file <filename.zip/xl/vbaProject.bin to Kali Linux
  • Look for a hardcoded password in the content (HEX)
xxd vbaProject.bin > hex.txt
grep -A1 pass hex.txt

Bruteforce with Visual Basic Application (VBA)

Old Excel hash with 4-letter format: e.g. “CDEF”, lot of collisions…

Sub PasswordBreaker()
    'Author unknown but submitted by brettdj of www.experts-exchange.com
    Dim i As Integer, j As Integer, k As Integer
    Dim l As Integer, m As Integer, n As Integer
    Dim i1 As Integer, i2 As Integer, i3 As Integer
    Dim i4 As Integer, i5 As Integer, i6 As Integer
 
    On Error Resume Next
 
    For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
    For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
    For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
    For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
 
    ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
        Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
        Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
    If ActiveSheet.ProtectContents = False Then
 
        MsgBox "One usable password is " & Chr(i) & Chr(j) & _
            Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
            Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
        ActiveWorkbook.Sheets(1).Select
 
        Range("a1").FormulaR1C1 = Chr(i) & Chr(j) & _
            Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
            Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
 
        Exit Sub
 
    End If
 
    Next: Next: Next: Next: Next: Next
    Next: Next: Next: Next: Next: Next
End Sub

Bruteforce with a wordlist

Option Explicit
' CHANGE THESE
Const strWordlist As String = "C:\wordlists\rockyou.txt"
Const strWorksheetName As String = "Sheet1"

Dim Found As Boolean

Sub BruteForce()
    Dim strLine As String
    Found = False
        
    Open strWordlist For Input As #1
    Do While Not EOF(1) And Not Found
       Line Input #1, strLine
       Unprotect_WorkSheet (strLine)
    Loop
    Close #1

    If Not Found Then
        MsgBox "Password was NOT found"
    End If
End Sub

Sub Unprotect_WorkSheet(strPassword As String)
    On Error Resume Next
    ThisWorkbook.Sheets(strWorksheetName).Unprotect Password:=strPassword

    If Err.Number <> 0 Then
        'MsgBox "The Password provided is incorrect"
        Exit Sub
    Else
        Found = True
        MsgBox "The Password is " & strPassword
    End If
End Sub

Extract the hash and use Hashcat

9700 | MS Office <= 2003 $0/$1, MD5 + RC4               | Documents
9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1  | Documents
9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2  | Documents
9800 | MS Office <= 2003 $3/$4, SHA1 + RC4              | Documents
9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1    | Documents
9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2    | Documents
9400 | MS Office 2007                                   | Documents
9500 | MS Office 2010                                   | Documents
9600 | MS Office 2013                                   | Documents

Hashcat

Extract password from External Data Connection

When there is an External Data Connection (data query), if the password is saved, it is possible to extract.

  • Rename myfile.xlsx to myfile.zip
  • The credentials and connection information are in myfile.zip\xl\connections.xml