MS Office Instant decryption
#7
(08-21-2017, 08:58 AM)philsmd Wrote: because you probably should use the collider mode 9710 (with mask ?b?b?b?b?b) for instant access to the data

Back to my tests, I have a oldoffice "type 1" for which I have the RC4 key thanks to -m 9710.
When I want to find colisions with -m 9720 with ?a mask, it fails to find one colision (cmd: hashcat64 -m 9720 --username -a 3 -w 3 -o result -1 ?a  hash   ?1?1?1?1?1?1?1)
I guess I have to try ?b mask, but it will take 200 days to complete ! Confused -> not quite instant.

I have also several "type 3" oldoffice where I can't even find the RC4 key (attack -m 9810 with ?b?b?b?b?b : exhausted without result).
Again, it's not quite instant ^^

Any idea why? I can share the hashes in private to reproduce if needed.

Thanks.


Messages In This Thread
MS Office Instant decryption - by Mem5 - 08-16-2017, 07:30 PM
RE: MS Office Instant decryption - by atom - 08-18-2017, 10:02 AM
RE: MS Office Instant decryption - by Mem5 - 08-20-2017, 08:47 PM
RE: MS Office Instant decryption - by philsmd - 08-21-2017, 08:58 AM
RE: MS Office Instant decryption - by rsberzerker - 08-26-2017, 07:57 AM
RE: MS Office Instant decryption - by Mem5 - 09-11-2017, 09:37 PM
RE: MS Office Instant decryption - by philsmd - 09-12-2017, 05:00 PM
RE: MS Office Instant decryption - by Mem5 - 09-19-2017, 09:38 PM
RE: MS Office Instant decryption - by Mem5 - 07-15-2018, 10:24 PM