hashcat Forum

Hi All,

New to this so please forgive the basic or easily understood questions.

I have a 2007 DOCX file that I am trying to access with no success.

I have tried this and other variations of turning off protection:

http://opensourcehacker.com/2011/09/23/u...-document/

The file appears to be encrypted so here I am.

I have a PC with 3 video cards (7850's) and semi advanced pc skills. Windows7 (64 bit) with updated drivers and the latest version of oclHashcat64.

I am having trouble with commands and getting the program to run completely. I have watched numerous youtube videos about hashcat but at this point I need written help.

Research leads me to believe the encryption is MD5 but not really certain. Common sense would tell me it's SHA1 because if I open the file with Notepad it says: encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><keyData saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" saltValue="...............encryptedHmacKey...........

I have gone here to get HASH value for hash.txt :

http://www.insidepro.com/hashes.php?lang=eng


I have downloaded wordlists but in oclhashcat I keep getting an error about no such file or directory.




If anyone could help me I would greatly appreciate it.

Determine the proper algorithm.
Do I use salt value to create HASH?
How long should the salt value be? Based on algo used?
Determine the correct attack method.

Much thanks.

oclHashcat does not support MS Office documents.

Further, there is no hash in the document that you can crack. MS Office uses PBKDF2-HMAC-SHA1 to derive an encryption key to encrypt the document.

(07-01-2014, 01:43 AM)epixoip Wrote: [ -> ]oclHashcat does not support MS Office documents.

Further, there is no hash in the document that you can crack. MS Office uses PBKDF2-HMAC-SHA1 to derive an encryption key to encrypt the document.

Thanks for the prompt reply. Is there any program that you could recommend?


I believe I removed the hash before I posted. It's a family document.