Cracking Word files?

[Paul van Hoven]

I've recently heared about john the ripper. Actually I think it is fun
and I wanted to test it. Therefore I downloaded it and compiled it.
Everything worked fine. After that I created a sample Word file and
protected it with a simple password. I downloaded a password list from
the openwall page. Now I wanted to test john on the Word document. But
I cannot find out how. I read the EXAMPLES text file and also had a
look at a wiki article (http://openwall.info/wiki/john/tutorials) but
the articles provided there are not very helpful. Therefore my
question: How do I crack a simple Word file whose password is included
in the download password .lst file?

Thanks, Paul

[Rich Rumble]

On Sun, Jul 8, 2012 at 1:47 PM, Paul van Hoven

Post by Paul van Hoven
I've recently heared about john the ripper. Actually I think it is fun
and I wanted to test it. Therefore I downloaded it and compiled it.
Everything worked fine. After that I created a sample Word file and
protected it with a simple password. I downloaded a password list from
the openwall page. Now I wanted to test john on the Word document. But
I cannot find out how. I read the EXAMPLES text file and also had a
look at a wiki article (http://openwall.info/wiki/john/tutorials) but
the articles provided there are not very helpful. Therefore my
question: How do I crack a simple Word file whose password is included
in the download password .lst file?

You may want to use a build from Robert Harris on the contrib page if
your build did not include the office2john.exe, there may have been
additonal steps you need to do(like applying a patch or uncomenting a
few lines in the make file) for that extra program to compile. You can
find the latest build here:
http://openwall.info/wiki/john/custom-builds Then you just run
office2john.exe from cmd...
office2john.exe c:\path\to\office_file.doc >output.txt
That should echo a sting like this into a file called output.txt
(change at will)

e:\john\Office_2010\2010-Default_myhovercraftisfullofeels_.docx:$office$*2010*100000*128*16*213aefcafd9f9188e78c1936cbb05a44*d5fc7691292ab6daf7903b9a8f8c8441*46bfac7fb87cd43bd0ab54ebc21c120df5fab7e6f11375e79ee044e663641d5e
(that is all one line btw) The password for that hash is
"myhovercraftisfullofeels" btw. You can download a number of samples I
and others have contributed here:
http://openwall.info/wiki/john/sample-non-hashes
Remember office2john only works on office versions 2007-2010, not on
the older RC4 types in office-97, 2000, XP, 2003. And it only works on
the "password to open", not macro or read-only password options in M$
office documents. There is also an ODF2john.exe for open/libre/star
office files.
-rich

[Elijah [W&P]]

Post by Rich Rumble
You may want to use a build from Robert Harris on the contrib page if
your build did not include the office2john.exe, there may have been
additonal steps you need to do(like applying a patch or uncomenting a

few lines in the make file) for that extra program to compile.

Remember office2john only works on office versions 2007-2010, not on

Post by Rich Rumble
the older RC4 types in office-97, 2000, XP, 2003. And it only works on
the "password to open", not macro or read-only password options in M$
office documents. There is also an ODF2john.exe for open/libre/star
office files.
-rich

I think you are referring to odf2john.py.
As to the office2john - it is not made automatically and you need to do it
manually (there is such a target in makefile but it is not advertised like
sipdump and vncpcap2john). You'll need pkg-config and libgsf present in
your cygwin (which is kind of strange to have to install Gnome libraries to
build a windows version of windows file-format handler :)

[Dhiru Kholia]

Post by Rich Rumble
office2john.exe c:\path\to\office_file.doc >output.txt
That should echo a sting like this into a file called output.txt.

On Windows, instead of doing "office2john.exe
c:\path\to\office_file.doc >output.txt" *do* "office2john.exe
office_file.doc >output.txt". The former command causes colon (":") to
be introduced in output.txt, which will result in john not loading the
"hash".

[Rich Rumble]

Post by Dhiru Kholia

Post by Rich Rumble
office2john.exe c:\path\to\office_file.doc >output.txt
That should echo a sting like this into a file called output.txt.

On Windows, instead of doing "office2john.exe
c:\path\to\office_file.doc >output.txt" *do* "office2john.exe
office_file.doc >output.txt". The former command causes colon (":") to
be introduced in output.txt, which will result in john not loading the

Seems like the logic should count colon's or separators from right to
left as opposed to left to right, is that an easy and or proper
solution? That or we probably have to make warnings or documentation
about such issues. Perhaps other *2john programs need to read R to L
as well...
-rich

[Paul van Hoven]

Hi! Thank you for all your answers. The first thing to say is that I
use Mac OS X Lion. Therefore I was not able to use the Windows
binaries. Anyway the page posted by Rich contained some oder binaries
for mac but this archive does not contain the office2john file.

@Dhiru
Thank you for that link. I already read this instructions before. But
since I do not use linux, these instructions weren't that helpful,
sorry.
However, I tried to compile it in a virtual machine running ubuntu. I
downloaded the packages you described in you instruction manual and
also downloaded magnumripper from the git repository. Then I changed
into src and entered make office2john. Maybe the result interests you:
***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/src$
make office2john
gcc `xml2-config --cflags` `pkg-config --cflags libgsf-1`
office2john.c common.o base64.o `pkg-config --libs libgsf-1`
`xml2-config --libs` -o ../run/office2john
gcc: common.o: No such file or directory
gcc: base64.o: No such file or directory
In file included from office2john.c:69:0:
common.h:13:18: fatal error: arch.h: No such file or directory
compilation terminated.
make: *** [office2john] Error 1

Back to my problem: What do I have to do to get office2john running on my mac?

Thx,
Paul

Post by Rich Rumble

Post by Dhiru Kholia

Post by Rich Rumble
office2john.exe c:\path\to\office_file.doc >output.txt
That should echo a sting like this into a file called output.txt.

On Windows, instead of doing "office2john.exe
c:\path\to\office_file.doc >output.txt" *do* "office2john.exe
office_file.doc >output.txt". The former command causes colon (":") to
be introduced in output.txt, which will result in john not loading the

Seems like the logic should count colon's or separators from right to
left as opposed to left to right, is that an easy and or proper
solution? That or we probably have to make warnings or documentation
about such issues. Perhaps other *2john programs need to read R to L
as well...
-rich

[magnum]

Post by Paul van Hoven
However, I tried to compile it in a virtual machine running ubuntu. I
downloaded the packages you described in you instruction manual and
also downloaded magnumripper from the git repository. Then I changed
make office2john
gcc `xml2-config --cflags` `pkg-config --cflags libgsf-1`
office2john.c common.o base64.o `pkg-config --libs libgsf-1`
`xml2-config --libs` -o ../run/office2john
gcc: common.o: No such file or directory
gcc: base64.o: No such file or directory
common.h:13:18: fatal error: arch.h: No such file or directory
compilation terminated.
make: *** [office2john] Error 1

Oh, I forgot to report this. I think you need to build john first. You
can't build office2john after a "make clean". This should be fixed or
documented.

magnum

[Frank Dittrich]

Post by magnum
Oh, I forgot to report this. I think you need to build john first. You
can't build office2john after a "make clean". This should be fixed or
documented.

Fixing it may be hard, since you aso depend on arch.h.
And arch.h depends on what target you used when compiling john.

I stumbled across this when I changed the line
office2john:
to
office2john: common.o base64.o

So, the best you can do is probably a helpful error message.

Frank

[Paul van Hoven]

Thanks for the additional help. I finally again had the time to play a
little with office2john under ubuntu. As suggested by Solor I compiled
office2john with the following:

make clean linux-x86-64
make office2john

A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

Now I got a working binary in the run folder. I created a MS Office
2008 for Mac (Version 12.2.0) document encrypted it with the simple
password "password" and tried to decrypt it with office2john, this was
the result:

***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/run$
./office2john
Usage: office2john OFFICE-2007-OR-2010-ENCRYPTED-FILE
***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/run$
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists
***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/run$

So this might be due to fact that it is not a office 2007 or office
2010 file? I checked that in the file "password.lst" the password
"password" is contained and also the file "password.lst" is included
in the run folder.

So am I doing something wrong here?

Post by Frank Dittrich

Post by magnum
Oh, I forgot to report this. I think you need to build john first. You
can't build office2john after a "make clean". This should be fixed or
documented.

Fixing it may be hard, since you aso depend on arch.h.
And arch.h depends on what target you used when compiling john.
I stumbled across this when I changed the line
to
office2john: common.o base64.o
So, the best you can do is probably a helpful error message.
Frank

[Dhiru Kholia]

On Tue, Aug 7, 2012 at 6:30 AM, Paul van Hoven

Post by Paul van Hoven
A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

Strange. Which version of Ubuntu are you using?

Post by Paul van Hoven
Now I got a working binary in the run folder. I created a MS Office
2008 for Mac (Version 12.2.0) document encrypted it with the simple
password "password" and tried to decrypt it with office2john, this was
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists

Can you delete "office2johntNuMqb" folder and try again?

Post by Paul van Hoven
So this might be due to fact that it is not a office 2007 or office
2010 file?

Please post the file (along with the password) for debugging.

Post by Paul van Hoven
So am I doing something wrong here?

It seems that office2john is buggy. office2john is a crappy program
and will soon be re-written in Python.

Thanks for the report.

[Paul van Hoven]

Thanks for the anser. My Ubuntu version is:

Distributor ID: Ubuntu
Description: Ubuntu 11.04
Release: 11.04
Codename: natty

I deleted the folder as you said, but office2john again fails an
creates another folder called office2johnXYZ, like this:

***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/run$
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx : office2johnkQHoKX: File exists

I attached the word document the password is "password".

Paul

Post by Dhiru Kholia
On Tue, Aug 7, 2012 at 6:30 AM, Paul van Hoven

Post by Paul van Hoven
A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

Strange. Which version of Ubuntu are you using?

Post by Paul van Hoven
Now I got a working binary in the run folder. I created a MS Office
2008 for Mac (Version 12.2.0) document encrypted it with the simple
password "password" and tried to decrypt it with office2john, this was
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists

Can you delete "office2johntNuMqb" folder and try again?

Post by Paul van Hoven
So this might be due to fact that it is not a office 2007 or office
2010 file?

Please post the file (along with the password) for debugging.

Post by Paul van Hoven
So am I doing something wrong here?

It seems that office2john is buggy. office2john is a crappy program
and will soon be re-written in Python.
Thanks for the report.
--
Cheers,
Dhiru

[Solar Designer]

Post by Paul van Hoven
A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

What error were you getting when trying to compile the original code?
(I am aware that some systems now print deprecation warnings or even
errors about mktemp(), but I thought Ubuntu was not one of those where
mktemp() was treated as a fatal error.)

Post by Paul van Hoven
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists

I think this is a consequence of your source code change above - perhaps
your code, with the change, tries to create the directory twice.

Dhiru - I think it'd be best to write cleaner C code rather than rewrite
this in Python (as you said you were going to), unless you have a
specific reason for that rewrite (e.g., some needed library only easily
available from Python).

Thanks,

Alexander

[Dhiru Kholia]

Post by Solar Designer

Post by Paul van Hoven
A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

What error were you getting when trying to compile the original code?
(I am aware that some systems now print deprecation warnings or even
errors about mktemp(), but I thought Ubuntu was not one of those where
mktemp() was treated as a fatal error.)

office2john.c works fine on CentOS 6.2 and Arch Linux without any changes.

Please post the errors you got when compiling under Ubuntu.

Post by Solar Designer

Post by Paul van Hoven
./office2john /media/psf/Home/Downloads/TestEncrypted.docx

I could successfully crack this file with JtR. No problems.

Post by Solar Designer

Post by Paul van Hoven
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists

I think this is a consequence of your source code change above - perhaps
your code, with the change, tries to create the directory twice.

I too think so.

Post by Solar Designer
Dhiru - I think it'd be best to write cleaner C code rather than rewrite
this in Python (as you said you were going to), unless you have a
specific reason for that rewrite (e.g., some needed library only easily
available from Python).

I could not figure out how to use libxml without giving it a file name
to operate on. Python libraries are easier to use and using them won't
involve dirty hacks.

[Paul van Hoven]

Sorry for not having answered so long. I now had again time to try the
compilation of office2john. On my Ubunut Natty installation I altered
the code of office2john.c back from mkdtemp to mktemp. Then I again
executed the following commands on the console

make clean linux-x86-64 (works fine)
make office2john

I get the follwing compilation error

***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/src$
make office2john
gcc `xml2-config --cflags` `pkg-config --cflags libgsf-1`
office2john.c common.o base64.o `pkg-config --libs libgsf-1`
`xml2-config --libs` -o ../run/office2john
/tmp/ccbohS5F.o: In function `test':
office2john.c:(.text+0xdf2): warning: the use of `mktemp' is
dangerous, better use `mkstemp' or `mkdtemp'

This is where the compilation stops.

Post by Dhiru Kholia

Post by Solar Designer

Post by Paul van Hoven
A small hint: I had to replace mktemp by mkdtemp in office2john.c in
order to get the file compiled.

What error were you getting when trying to compile the original code?
(I am aware that some systems now print deprecation warnings or even
errors about mktemp(), but I thought Ubuntu was not one of those where
mktemp() was treated as a fatal error.)

office2john.c works fine on CentOS 6.2 and Arch Linux without any changes.
Please post the errors you got when compiling under Ubuntu.

Post by Solar Designer

Post by Paul van Hoven
./office2john /media/psf/Home/Downloads/TestEncrypted.docx

I could successfully crack this file with JtR. No problems.

Post by Solar Designer

Post by Paul van Hoven
/media/psf/Home/Downloads/TestEncrypted.docx : office2johntNuMqb: File exists

I think this is a consequence of your source code change above - perhaps
your code, with the change, tries to create the directory twice.

I too think so.

Post by Solar Designer
Dhiru - I think it'd be best to write cleaner C code rather than rewrite
this in Python (as you said you were going to), unless you have a
specific reason for that rewrite (e.g., some needed library only easily
available from Python).

I could not figure out how to use libxml without giving it a file name
to operate on. Python libraries are easier to use and using them won't
involve dirty hacks.
--
Cheers,
Dhiru

[Dhiru Kholia]

On Sun, Sep 2, 2012 at 4:59 AM, Paul van Hoven

Post by Paul van Hoven
I get the follwing compilation error
office2john.c:(.text+0xdf2): warning: the use of `mktemp' is
dangerous, better use `mkstemp' or `mkdtemp'
This is where the compilation stops.

This is just a warning and compilation shouldn't stop. Does
../run/office2john binary gets created?

[Paul van Hoven]

Okay, you're right. The binary is created. I then tried to invoke the
program on my encrypted file. This is the result:

***@ubuntu:~/Downloads/magnumripper-magnum-jumbo-47a6d4e/run$
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx:$office$*2007*20*128*16*bafe5db56473f6c230010c898272f4aa*8bec0d9ceac42898e422be33ea1f229a*73c80d49f3480b1145c553f148cc95d277145a7ef895034ee7ccc39b8cfcd13a

I tried to open it and I'm being asked for the password. Is there a
certain place where the password is written to?

Post by Dhiru Kholia
On Sun, Sep 2, 2012 at 4:59 AM, Paul van Hoven

Post by Paul van Hoven
I get the follwing compilation error
office2john.c:(.text+0xdf2): warning: the use of `mktemp' is
dangerous, better use `mkstemp' or `mkdtemp'
This is where the compilation stops.

This is just a warning and compilation shouldn't stop. Does
../run/office2john binary gets created?
--
Cheers,
Dhiru

[Guth]

Hi,
Actually you did not find the password yet.

You have just extracted the hash so far.
You need to feed john with the output of office2jhonoffice2john, ex:

Save hash to file:
./office2john /media/psf/Home/Downloads/TestEncrypted.docx > test.office

Run john:
./john test.office
Loaded 1 password hash (Office 2007/2010 SHA-1/AES [32/64])
password (/media/psf/Home/Downloads/TestEncrypted.docx)
guesses: 1 time: 0:00:02:44 DONE



On Sun, Sep 2, 2012 at 12:58 PM, Paul van Hoven <

Post by Paul van Hoven
Okay, you're right. The binary is created. I then tried to invoke the
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx:$office$*2007*20*128*16*bafe5db56473f6c230010c898272f4aa*8bec0d9ceac42898e422be33ea1f229a*73c80d49f3480b1145c553f148cc95d277145a7ef895034ee7ccc39b8cfcd13a
I tried to open it and I'm being asked for the password. Is there a
certain place where the password is written to?

Post by Dhiru Kholia
On Sun, Sep 2, 2012 at 4:59 AM, Paul van Hoven

Post by Paul van Hoven
I get the follwing compilation error
office2john.c:(.text+0xdf2): warning: the use of `mktemp' is
dangerous, better use `mkstemp' or `mkdtemp'
This is where the compilation stops.

This is just a warning and compilation shouldn't stop. Does
../run/office2john binary gets created?
--
Cheers,
Dhiru

[Paul van Hoven]

Ah okay. Thanks for the tip.

So what I did what feeding john with the hash. The first file (which I
also provided to you in this email thread) was cracked after about 7
minutes in my virtual machine. Then I created a new file with the
password "password23". Now, currently john is already trying to crack
this file for now about 2 hours and it is still not finished yet.

I heard that john can be run on gpus. Is there some sort of manual
that explains how to do this? I've got a NVIDIA GeForce 9400M in my
Macbook. So, I'm wondering if this is technically (dispite of
performance issues) possible. I mean, I just want to try it .

Post by Guth
Hi,
Actually you did not find the password yet.
You have just extracted the hash so far.
./office2john /media/psf/Home/Downloads/TestEncrypted.docx > test.office
./john test.office
Loaded 1 password hash (Office 2007/2010 SHA-1/AES [32/64])
password (/media/psf/Home/Downloads/TestEncrypted.docx)
guesses: 1 time: 0:00:02:44 DONE
On Sun, Sep 2, 2012 at 12:58 PM, Paul van Hoven <

Post by Paul van Hoven
Okay, you're right. The binary is created. I then tried to invoke the
./office2john /media/psf/Home/Downloads/TestEncrypted.docx
/media/psf/Home/Downloads/TestEncrypted.docx:$office$*2007*20*128*16*bafe5db56473f6c230010c898272f4aa*8bec0d9ceac42898e422be33ea1f229a*73c80d49f3480b1145c553f148cc95d277145a7ef895034ee7ccc39b8cfcd13a
I tried to open it and I'm being asked for the password. Is there a
certain place where the password is written to?

Post by Dhiru Kholia
On Sun, Sep 2, 2012 at 4:59 AM, Paul van Hoven

Post by Paul van Hoven
I get the follwing compilation error
office2john.c:(.text+0xdf2): warning: the use of `mktemp' is
dangerous, better use `mkstemp' or `mkdtemp'
This is where the compilation stops.

This is just a warning and compilation shouldn't stop. Does
../run/office2john binary gets created?
--
Cheers,
Dhiru

[Solar Designer]

Post by Paul van Hoven
So what I did what feeding john with the hash. The first file (which I
also provided to you in this email thread) was cracked after about 7
minutes in my virtual machine. Then I created a new file with the
password "password23". Now, currently john is already trying to crack
this file for now about 2 hours and it is still not finished yet.

Try:

./john -w=password.lst --rules=jumbo FILENAMEHERE

to enable more wordlist rules.

By default, JtR won't crack this password, unfortunately. The "append
two digits" rule (as opposed to appending just one digit) is not
included in the default wordlist mode ruleset, and incremental mode is
limited to lengths up to 8 by default. Yes, we need to improve the
defaults.

The "jumbo" ruleset includes this rule (and a lot more).

Alexander

[Solar Designer]

Hi Paul,

Post by Paul van Hoven
Hi! Thank you for all your answers. The first thing to say is that I
use Mac OS X Lion. Therefore I was not able to use the Windows
binaries. Anyway the page posted by Rich contained some oder binaries
for mac but this archive does not contain the office2john file.

Yes, we don't yet have a released binary build of 1.7.9-jumbo-6 for Mac
OS X. You should be able to make such a build on your own, after you
install Xcode. We did test builds of 1.7.9-jumbo-6 for Mac OS X before
we released -jumbo-6; I am not sure if we tested building of office2john
on Mac OS X specifically, though, as this program has extra prerequisite
libraries.

Post by Paul van Hoven
make office2john
gcc `xml2-config --cflags` `pkg-config --cflags libgsf-1`
office2john.c common.o base64.o `pkg-config --libs libgsf-1`
`xml2-config --libs` -o ../run/office2john
gcc: common.o: No such file or directory
gcc: base64.o: No such file or directory
common.h:13:18: fatal error: arch.h: No such file or directory

As magnum correctly pointed out, "make office2john" is only supposed to
work after a successful build of John itself in the same tree. So you
should do something like:

make clean linux-x86-64
make office2john

Replace "linux-x86-64" with e.g. "linux-x86-sse2" if your Linux distro
install is 32-bit.

Post by Paul van Hoven
Back to my problem: What do I have to do to get office2john running on my mac?

I've provided some options above. Please give these a try and let us
know. Given that you already have a Linux install in a VM, it's
probably quicker for you to get office2john built there.

Thanks,

Alexander

[Solar Designer]

Paul,

Post by Paul van Hoven
I've recently heared about john the ripper. Actually I think it is fun
and I wanted to test it. Therefore I downloaded it and compiled it.

[...]

Post by Paul van Hoven
question: How do I crack a simple Word file whose password is included
in the download password .lst file?

What OS are you on? Somehow both Rich and Elijah assumed Windows, but
you never said so. Did you find their answers so far helpful enough or
are you still looking for more specific instructions?

Alexander

[Dhiru Kholia]

On Sun, Jul 8, 2012 at 11:17 PM, Paul van Hoven

Post by Paul van Hoven
I've recently heared about john the ripper. Actually I think it is fun
and I wanted to test it. Therefore I downloaded it and compiled it.
Everything worked fine. After that I created a sample Word file and
protected it with a simple password. I downloaded a password list from
the openwall page. Now I wanted to test john on the Word document. But
I cannot find out how. I read the EXAMPLES text file and also had a
look at a wiki article (http://openwall.info/wiki/john/tutorials) but
the articles provided there are not very helpful. Therefore my
question: How do I crack a simple Word file whose password is included
in the download password .lst file?

Hi Paul,

Did you go through
https://github.com/magnumripper/magnum-jumbo/blob/magnum-jumbo/doc/OFFICE
document ?
If you did not find that document helpful, let the list know. Thanks.