Notifications
Clear all

Excel VBA passwords

bsc.Smith19
(@bsc-smith19)
Junior Member

I was going to raise a question similar to this regarding Excel 2007 Workbooks. I was asked by my employer to inspect a few excel sheets that were left by a disgruntled employee on the servers who was quite savvy with VBA. Naturally the employee had password protected the code and no one knew the password.

Knowing from previous research that Excel files are stored as zipped archives I opened the file using 7-zip and went into the directory "xl" from there extracted the vbaProject.bin file. Using a hex editor I located the specific string that contained the password. As shown in the image below

Full Size Image Click Here

I have attempted to convert this from hex - ascii to obtain the original password with no such luck i get an array of strange characters. Does anyone know of anyway to decrypt the original password?

Quote
Topic starter Posted : 25/03/2014 2:28 am
jaclaz
(@jaclaz)
Community Legend

Does anyone know of anyway to decrypt the original password?

Do you want to decrypt that password or get access to the actual VBA module?

I have a couple possible method for the second, but not for the first.

http//blog.nig.gl/post/63428658404/excel-vba-password-protection-is-useless
http//davidbugden.com/?p=16
(for the latter method with an Excel 2007 file, open it in Excel and save it in 2003 format)
There is also a freeware tool that does the same as the above
http//www.excel-tool.com/vbarecovery.html

There are however Commercial tools capable of decrypting the VBA passwords, example
http//www.rixler.com/eng/vba_password_recovery.htm

jaclaz

ReplyQuote
Posted : 25/03/2014 6:37 pm
bsc.Smith19
(@bsc-smith19)
Junior Member

Does anyone know of anyway to decrypt the original password?

Do you want to decrypt that password or get access to the actual VBA module?

jaclaz

Thank you for the suggested tools I will give them a try.

I was successful in getting into the VBA. I forced a checksum error by changing DPB into DPx. Created a new copy of the bin file and inserted it into a copy of the file in question. When opened in Excel the software then assumes an error has occurred. Once you save it and re open it the VBA code is there to view.

I would like to understand how Microsoft has encrypted the password, as it seems to be in what i believe to be 7-bit.

ReplyQuote
Topic starter Posted : 26/03/2014 11:55 am
jaclaz
(@jaclaz)
Community Legend

I would like to understand how Microsoft has encrypted the password, as it seems to be in what i believe to be 7-bit.

According to this ?
http//cae2y.morainevalley.edu/compete/resources/paswordprotectionguide.pdf

With Office 97, the password is protected using a simple encryption algorithm, and stored in the file.
With Office 2000 and later, the password is hashed using the 192 bit SHA algorithm, and then encrypted.

but it does not "sound" right to me, as the mentioned program (for passwords in the "demo" range of max three small letters latin characters) is instantaneous, with Office XP Excel files.
It seems to me more like a simple encryption or hash.

BTW, we are really going OT, if you are OK with it, I would ask jamie if he can split the Excel Vba related posts to a new thread.

jaclaz

ReplyQuote
Posted : 26/03/2014 3:59 pm
Jamie
(@jamie)
Community Legend

Topic split as requested.

ReplyQuote
Posted : 26/03/2014 4:36 pm
jaclaz
(@jaclaz)
Community Legend

Thanks jamie. )

Documented field "ProjectPassword" (for later office versions, but the method/approach shouldn't be that much different, if different at all for 2000/XP/2003)
http//msdn.microsoft.com/en-us/library/dd924969(v=office.12).aspx
http//msdn.microsoft.com/en-us/library/dd949453(v=office.12).aspx
http//msdn.microsoft.com/en-us/library/dd921085(v=office.12).aspx
http//msdn.microsoft.com/en-us/library/dd925094(v=office.12).aspx

Also
http//download.microsoft.com/download/2/4/8/24862317-78F0-4C4B-B355-C7B2C1D997DB/[MS-OVBA].pdf

jaclaz

ReplyQuote
Posted : 26/03/2014 6:13 pm
Share: