+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Excel Protected Workbook Known PW Length (/thread-10671.html)
Excel Protected Workbook Known PW Length - HelmanFrow - 03-19-2022
Hi, first-time listener; first-time caller.
I've gone and locked myself out of a spreadsheet.
I first ran paid software called PassFab For Excel in trial mode.
While I didn't pay to get my results, I did note that the password is four characters long and contains only lower- and upper-case letters (I ran a custom brute-force attack). PassFab For Excel returned the results in about 12 minutes.
When I realized that PassFab wanted $20 for my 4-digit password I found JtR.
I extracted the file hash using office2john.py (which seems to produce a format that HashCat can use, as well).
I tried JtR in default mode but it doesn't recognize my GPU (Quadro M100M) for some reason, even after I edited the nvidia.icd file with the location of nvopencl.dll.
Then I found HashCat (which sees my GPU out of the box) and for the last few hours I've been breaking my head over learning the the syntax and I can't figure out which attack to use and how to structure it to search for passwords only 4 characters in length and with the character set I need.
It's probably simple enough but I'm a bit slow on the uptake, and now I'm tired and frustrated.
Please to help.
PS I'm on Windows 10.
RE: Excel 2013 Protected Workbook Known PW Length - HelmanFrow - 03-19-2022
I've had JtR running on CPU at about 290 p/s for about 12 hours in default mode but it hasn't found anything yet.
I'm hoping things will move along faster on the GPU with HashCat.
![[Image: OajdNQn.png]](https://i.imgur.com/OajdNQn.png)
RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-19-2022
Actually, upon closer inspection, it looks as though hashcat can't use my GPU yet.
I'm in the middle of downloading the CUDA Toolkit in the event that I need to install it.
Will I need to install it?
![[Image: PXdQOGK.png]](https://i.imgur.com/PXdQOGK.png)
RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-19-2022
Still trying to get HashCat working.
Right now it's been stuck on Initializing backend runtime for device #1. Please be patient... for over 20 minutes. I'm not sure if I should cancel or not.
![[Image: tvk91UO.png]](https://i.imgur.com/tvk91UO.png)
RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-19-2022
I cancelled the hung recovery.
Running hashcat.exe -I gives me this:
Code:
S D:\desktop\hashcat-6.2.5> ./hashcat.exe -I
hashcat (v6.2.5) starting in backend information mode
Successfully initialized NVIDIA CUDA library.
Failed to initialize NVIDIA RTC library.
* Device #1: CUDA SDK Toolkit not installed or incorrectly installed.
CUDA SDK Toolkit required for proper device support and utilization.
Falling back to OpenCL runtime.
OpenCL Info:
============
OpenCL Platform ID #1
Vendor..: NVIDIA Corporation
Name....: NVIDIA CUDA
Version.: OpenCL 3.0 CUDA 11.4.156
Backend Device ID #1
Type...........: GPU
Vendor.ID......: 32
Vendor.........: NVIDIA Corporation
Name...........: Quadro M1000M
Version........: OpenCL 3.0 CUDA
Processor(s)...: 4
Clock..........: 1071
Memory.Total...: 2048 MB (limited to 512 MB allocatable in one block)
Memory.Free....: 1728 MB
OpenCL.Version.: OpenCL C 1.2
Driver.Version.: 472.42
PCI.Addr.BDF...: 01:00.0
OpenCL Platform ID #2
Vendor..: Intel(R) Corporation
Name....: Intel(R) OpenCL HD Graphics
Version.: OpenCL 3.0
Backend Device ID #2
Type...........: GPU
Vendor.ID......: 8
Vendor.........: Intel(R) Corporation
Name...........: Intel(R) HD Graphics 530
Version........: OpenCL 3.0 NEO
Processor(s)...: 24
Clock..........: 1050
Memory.Total...: 13036 MB (limited to 2047 MB allocatable in one block)
Memory.Free....: 1760 MB
OpenCL.Version.: OpenCL C 3.0
Driver.Version.: 30.0.100.9865RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-20-2022
I installed the CUDA toolkit and ran hashcat.exe -I.
Now I get this:
Code:
PS D:\desktop\hashcat-6.2.5> ./hashcat.exe -I
hashcat (v6.2.5) starting in backend information mode
CUDA Info:
==========
CUDA.Version.: 11.4
Backend Device ID #1 (Alias: #2)
Name...........: Quadro M1000M
Processor(s)...: 4
Clock..........: 1071
Memory.Total...: 2048 MB
Memory.Free....: 1685 MB
PCI.Addr.BDFe..: 0000:01:00.0
OpenCL Info:
============
OpenCL Platform ID #1
Vendor..: NVIDIA Corporation
Name....: NVIDIA CUDA
Version.: OpenCL 3.0 CUDA 11.4.156
Backend Device ID #2 (Alias: #1)
Type...........: GPU
Vendor.ID......: 32
Vendor.........: NVIDIA Corporation
Name...........: Quadro M1000M
Version........: OpenCL 3.0 CUDA
Processor(s)...: 4
Clock..........: 1071
Memory.Total...: 2048 MB (limited to 512 MB allocatable in one block)
Memory.Free....: 1728 MB
OpenCL.Version.: OpenCL C 1.2
Driver.Version.: 472.42
PCI.Addr.BDF...: 01:00.0
OpenCL Platform ID #2
Vendor..: Intel(R) Corporation
Name....: Intel(R) OpenCL HD Graphics
Version.: OpenCL 3.0
Backend Device ID #3
Type...........: GPU
Vendor.ID......: 8
Vendor.........: Intel(R) Corporation
Name...........: Intel(R) HD Graphics 530
Version........: OpenCL 3.0 NEO
Processor(s)...: 24
Clock..........: 1050
Memory.Total...: 13036 MB (limited to 2047 MB allocatable in one block)
Memory.Free....: 1408 MB
OpenCL.Version.: OpenCL C 3.0
Driver.Version.: 30.0.100.9865Everything looks hunky + dorey but when I try to run a recovery on my file it errors out with this:
Code:
PS D:\desktop\hashcat-6.2.5> ./hashcat -a 3 -m 9600 --username hash.txt ?l?l?l?l
hashcat (v6.2.5) starting
* Device #1: WARNING! Kernel exec timeout is not disabled.
This may cause "CL_OUT_OF_RESOURCES" or related errors.
To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #2: WARNING! Kernel exec timeout is not disabled.
This may cause "CL_OUT_OF_RESOURCES" or related errors.
To disable the timeout, see: https://hashcat.net/q/timeoutpatch
nvmlDeviceGetFanSpeed(): Not Supported
nvmlDeviceGetTemperatureThreshold(): Not Supported
CUDA API (CUDA 11.4)
====================
* Device #1: Quadro M1000M, 1685/2048 MB, 4MCU
OpenCL API (OpenCL 3.0 CUDA 11.4.156) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: Quadro M1000M, skipped
OpenCL API (OpenCL 3.0 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #3: Intel(R) HD Graphics 530, 1408/13036 MB (2047 MB allocatable), 24MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP
* Uses-64-Bit
Watchdog: Temperature abort trigger set to 90c
cuLinkAddData(): the provided PTX was compiled with an unsupported toolchain.
* Device #1: Kernel ./OpenCL/shared.cl link failed. Error Log:
ptxas application ptx input, line 9; fatal : Unsupported .version 7.6; current version is '7.4'
* Device #1: Kernel ./OpenCL/shared.cl build failed.
Started: Sat Mar 19 19:41:18 2022
Stopped: Sat Mar 19 19:41:21 2022I'm running a Lenovo ThinkPad P50 20EN with Windows 10 21H2.
What am I missing?
RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-20-2022
p.s. I accidentally cancelled the JtR session after a fruitless 16 hours and now I'm back at square 1.
RE: Excel Protected Workbook Known PW Length - secpro - 03-20-2022
(03-20-2022, 01:50 AM)HelmanFrow Wrote: p.s. I accidentally cancelled the JtR session after a fruitless 16 hours and now I'm back at square 1.
Try adding --restore to the command line and it might pick up where it left off.
Given a rate of 291/s, trying all uppercase and lowercase letters should take about 7 hours, if I'm doing the math right.
Note that hashcat will not make it super obvious when it's found; there won't be a popup or anything.
You'll be watching the 0/1 line and see when it changes to 1/1.
RE: Excel Protected Workbook Known PW Length - slyexe - 03-20-2022
geezus man, you're pretty impatient. Your first attempt at cracking your password would have been fine if you didn't keep installing drivers ontop of drivers. Just use the damn OpenCL driver that would have worked at square one.
Look at the Wiki for your hash.
https://hashcat.net/wiki/doku.php?id=example_hashes
Now look at how your attack will work.
https://hashcat.net/wiki/doku.php?id=mask_attack
So you have your hashmode and your attack mode so now you just need to put it all together.
hashcat.exe -d 2 -m xxxxx -a 3 -1 ?l?u hash.txt ?1?1?1?1
RE: Excel Protected Workbook Known PW Length - HelmanFrow - 03-20-2022
(03-20-2022, 02:17 AM)slyexe Wrote: geezus man, you're pretty impatient.😂 Guilty as charged, although I'm also tenacious + curious and I have a habit of using threads I've started to keep track of my progress.
(03-20-2022, 02:17 AM)slyexe Wrote: Your first attempt at cracking your password would have been fine if you didn't keep installing drivers on top of drivers. Just use the damn OpenCL driver that would have worked at square one.
Whoops.
In my defense, despite my best efforts I still lack perfect information in every knowledge domain so I may occasionally not realize there is an OpenCL driver.
(03-20-2022, 02:17 AM)slyexe Wrote: Look at the Wiki for your hash.Yup, I pored over those pagers for hours.
https://hashcat.net/wiki/doku.php?id=example_hashes
Now look at how your attack will work.
https://hashcat.net/wiki/doku.php?id=mask_attack
Like I said, I'm a little slow on the uptake.
(03-20-2022, 02:17 AM)slyexe Wrote: So you have your hashmode and your attack mode so now you just need to put it all together.
hashcat.exe -d 2 -m xxxxx -a 3 -1 ?l?u hash.txt ?1?1?1?1
Aha. Now I understand the syntax a little better.
Anyway, that gets me down to one error code instead of three:
Code:
PS D:\desktop\hashcat-6.2.5> ./hashcat.exe -d 2 -m9600 -a 3 -1 ?l?u hash.txt ?1?1?1?1
hashcat (v6.2.5) starting
nvmlDeviceGetFanSpeed(): Not Supported
nvmlDeviceGetTemperatureThreshold(): Not Supported
CUDA API (CUDA 11.4)
====================
* Device #1: Quadro M1000M, skipped
OpenCL API (OpenCL 3.0 CUDA 11.4.156) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: Quadro M1000M, 1728/2048 MB (512 MB allocatable), 4MCU
OpenCL API (OpenCL 3.0 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #3: Intel(R) HD Graphics 530, skipped
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashfile 'hash.txt' on line 1 (Networ...29650db9647151a349923ea29f76d274): Signature unmatched
No hashes loaded.
Started: Sat Mar 19 20:52:43 2022
Stopped: Sat Mar 19 20:52:45 2022
PS D:\desktop\hashcat-6.2.5>