Password for MS Word

[DCRookie]

Hi. I am trying to crack a MS Word 2010 which seems to have AES encryption with two hash and two salt values. Any suggestions as to how to go about cracking the password using hashcat?

Thanks

[Banaanhangwagen]

- use for example this Python-script to recover the hash
- check the output with https://hashcat.net/wiki/doku.php?id=example_hashes in order to determine the correct mode
- start cracking

Literally the first hit on Google when typing "office crack hashcat" gives you a more detailed how-to.

[DCRookie]

Thank you. I did recover the hash and tried to crack with merged.txt and rockyou.txt with code 9500 for office 2010. It didn't work.

I got this info through 7z. Any idea how to plug this in into hashcat?

"<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><keyData saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" saltValue="mBpBa0/xc+Ne9NmlqOPEbw=="/><dataIntegrity encryptedHmacKey="HUrn5QfXfWAUHwF7gV8V2Gi4B0NhgUJ9TT3l0F1CYnk=" encryptedHmacValue="YM6uHfILRzUazgcZl+o9w6q+gbLKIiLkNzgMA6cKonw="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="128" hashSize="20" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA1" saltValue="G3zscs0TucKtP2kMuY+CtA==" encryptedVerifierHashInput="g2QBm8nfS7PF0jBy8jbeSA==" encryptedVerifierHashValue="XpOSz0uQGZ91blr4nb3qdgaffbiFkqnechVO8+O38iI=" encryptedKeyValue="8IgrrhOtHASYziu/j8ez9g=="/></keyEncryptor></keyEncryptors></encryption>"

Thanks again

- use for example this Python-script to recover the hash
- check the output with https://hashcat.net/wiki/doku.php?id=example_hashes in order to determine the correct mode
- start cracking

Literally the first hit on Google when typing "office crack hashcat" gives you a more detailed how-to.

[Banaanhangwagen]

You need to give the extracted hash as input in Hashcat, nothing more nothing less.
You say "it didn't work". What do you mean exactly? What command did you type? Was there an error?

Finally, no need to investigate the .docx itself, the script did it for you.