±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 2
New Yesterday: 3
Overall: 27137
Visitors: 37

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Excel VBA passwords

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Re: Password Recovery Software

Post Posted: Mon Mar 24, 2014 4:28 pm

I was going to raise a question similar to this regarding Excel 2007 Workbooks. I was asked by my employer to inspect a few excel sheets that were left by a disgruntled employee on the servers who was quite savvy with VBA. Naturally the employee had password protected the code and no one knew the password.

Knowing from previous research that Excel files are stored as zipped archives I opened the file using 7-zip and went into the directory "xl" from there extracted the vbaProject.bin file. Using a hex editor I located the specific string that contained the password. As shown in the image below:



Full Size Image Click Here

I have attempted to convert this from hex - ascii to obtain the original password with no such luck i get an array of strange characters. Does anyone know of anyway to decrypt the original password?  

bsc.Smith19
Member
 
 
  

Re: Password Recovery Software

Post Posted: Tue Mar 25, 2014 8:37 am

- bsc.Smith19
Does anyone know of anyway to decrypt the original password?

Do you want to decrypt that password or get access to the actual VBA module?

I have a couple possible method for the second, but not for the first.

blog.nig.gl/post/63428...is-useless
davidbugden.com/?p=16
(for the latter method with an Excel 2007 file, open it in Excel and save it in 2003 format)
There is also a freeware tool that does the same as the above:
www.excel-tool.com/vbarecovery.html

There are however Commercial tools capable of decrypting the VBA passwords, example:
www.rixler.com/eng/vba...covery.htm

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Password Recovery Software

Post Posted: Wed Mar 26, 2014 1:55 am

- jaclaz
- bsc.Smith19
Does anyone know of anyway to decrypt the original password?

Do you want to decrypt that password or get access to the actual VBA module?

jaclaz


Thank you for the suggested tools I will give them a try.

I was successful in getting into the VBA. I forced a checksum error by changing DPB into DPx. Created a new copy of the bin file and inserted it into a copy of the file in question. When opened in Excel the software then assumes an error has occurred. Once you save it and re open it the VBA code is there to view.

I would like to understand how Microsoft has encrypted the password, as it seems to be in what i believe to be 7-bit.  

bsc.Smith19
Member
 
 
  

Re: Password Recovery Software

Post Posted: Wed Mar 26, 2014 5:59 am

- bsc.Smith19


I would like to understand how Microsoft has encrypted the password, as it seems to be in what i believe to be 7-bit.

According to this Confused :
cae2y.morainevalley.ed...nguide.pdf
With Office 97, the password is protected using a simple encryption algorithm, and stored in the file.
With Office 2000 and later, the password is hashed using the 192 bit SHA algorithm, and then encrypted.

but it does not "sound" right to me, as the mentioned program (for passwords in the "demo" range of max three small letters latin characters) is instantaneous, with Office XP Excel files.
It seems to me more like a simple encryption or hash.

BTW, we are really going OT, if you are OK with it, I would ask jamie if he can split the Excel Vba related posts to a new thread.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Excel VBA passwords

Post Posted: Wed Mar 26, 2014 6:36 am

Topic split as requested.  

jamie
Site Admin
 
 
  

Re: Excel VBA passwords

Post Posted: Wed Mar 26, 2014 8:13 am

Thanks jamie. Smile

Documented field "ProjectPassword" (for later office versions, but the method/approach shouldn't be that much different, if different at all for 2000/XP/2003):
msdn.microsoft.com/en-...e.12).aspx
msdn.microsoft.com/en-...e.12).aspx
msdn.microsoft.com/en-...e.12).aspx
msdn.microsoft.com/en-...e.12).aspx

Also:
download.microsoft.com...-OVBA].pdf

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1