Password for MS Word

[DCRookie]

Thank you. I did recover the hash and tried to crack with merged.txt and rockyou.txt with code 9500 for office 2010. It didn't work.

I got this info through 7z. Any idea how to plug this in into hashcat?

"<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><keyData saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" saltValue="mBpBa0/xc+Ne9NmlqOPEbw=="/><dataIntegrity encryptedHmacKey="HUrn5QfXfWAUHwF7gV8V2Gi4B0NhgUJ9TT3l0F1CYnk=" encryptedHmacValue="YM6uHfILRzUazgcZl+o9w6q+gbLKIiLkNzgMA6cKonw="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" saltValue="G3zscs0TucKtP2kMuY+CtA==" encryptedVerifierHashInput="g2QBm8nfS7PF0jBy8jbeSA==" encryptedVerifierHashValue="XpOSz0uQGZ91blr4nb3qdgaffbiFkqnechVO8+O38iI=" encryptedKeyValue="8IgrrhOtHASYziu/j8ez9g=="/></keyEncryptor></keyEncryptors></encryption>"

Thanks again

- use for example this Python-script to recover the hash
- check the output with https://hashcat.net/wiki/doku.php?id=example_hashes in order to determine the correct mode
- start cracking

Literally the first hit on Google when typing "office crack hashcat" gives you a more detailed how-to.