hashcat Forum
Excel hash extraction (97-2003) - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: Excel hash extraction (97-2003) (/thread-5739.html)



Excel hash extraction (97-2003) - devilsadvocate - 08-11-2016

Is there a utility that can extract a hash from an Excel document (97-2003)?

I have tried office2hashcat.py and office2john with no success.

The file extension is .xls and Windows says it is a 97-2003 file.


RE: Excel hash extraction (97-2003) - epixoip - 08-11-2016

If office2john didn't work, are you positive it's encrypted and not just password-protected? Hashcat only works against encrypted Office docs, not password-protected docs.


RE: Excel hash extraction (97-2003) - devilsadvocate - 08-11-2016

(08-11-2016, 06:51 AM)epixoip Wrote: If office2john didn't work, are you positive it's encrypted and not just password-protected? Hashcat only works against encrypted Office docs, not password-protected docs.

AOPR (from Elcomsoft) tells me the following:
This file is encrypted by a Cryptographic Service Provider (CSP).


RE: Excel hash extraction (97-2003) - curlyboi - 11-07-2016

I am having the exact same problem - office2john or office2hashcat returns nothing. However I am able to crack is using Passware Kit. It's not a modify key, it's a open key (so the document is encrypted).

Passware states it's:
Open Password, CSP Encryption (Microsoft Enhanced Cryptographic Provider v1.0, 128bits)


RE: Excel hash extraction (97-2003) - mkcon - 11-07-2016

i had the very same problem.

After some digging around i changed line 1620 of office2john.py from
elif data[0:4] == '\x01\x00\x02\x00' or data[0:4] == '\x01\x00\x03\x00':
into
elif data[0:4] == '\x01\x00\x02\x00' or data[0:4] == '\x01\x00\x03\x00' or data[0:4] == '\x01\x00\x04\x00':
and everything went smooth.

Perhaps that helps!


RE: Excel hash extraction (97-2003) - magnum - 11-07-2016

(11-07-2016, 04:05 PM)mkcon Wrote: After some digging around i changed line 1620 of office2john.py from
elif data[0:4] == '\x01\x00\x02\x00' or data[0:4] == '\x01\x00\x03\x00':
into
elif data[0:4] == '\x01\x00\x02\x00' or data[0:4] == '\x01\x00\x03\x00' or data[0:4] == '\x01\x00\x04\x00':
and everything went smooth.

I now committed that change to office2john on Github. @curlyboi @devilsadvocate please report if this worked for you also.


RE: Excel hash extraction (97-2003) - curlyboi - 11-08-2016

Works for my file.