Colliding password protected MS office 97-2003 documents

[eosfor]

Exploitation

<skip>

To make it more comfortable, this technique requires two seperate oclHashcat modes. The first to brute-force the intermediate hash and once you cracked it just store it. Then you can use oclHashcat "normally" with the second mode. This mode works with the previosly cracked key and therefore only needs to calculates steps 1-5. Note that in this second mode you are not stick to Brute-Force, you can use any attack-mode you want. Actually you will not need to do that unless you try to find the real password that was used (forensic stuff). Just continue reading...

<skip>

Hello colleagues, can you please elaborate a bit more on this. For instance i received a HEX value on the first stage of the process. What do i do with this value if i don't need a real password?

Thanks in advance