Colliding password protected MS office 97-2003 documents
#34
(04-12-2016, 04:13 PM)stepMode Wrote: Are you able to reproduce this with any other hash?

I try to make a test file, and cudahashcat worked to it.

But for the orginal file, it can not get the RC4.

I found that when I open the orginal file in passware, passware show that the file is "Microsoft Base Cryptographic Prider v 1.0. 128 bits", and test file is 40 bits.

When using office2hashcat.py to analyze these two files, the output hash are all start with $oldoffice$3.
Reply


Messages In This Thread
RE: Colliding password protected MS office 97-2003 documents - by bccc - 04-13-2016, 02:30 AM