3

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) document? Note that I am not asking for ways in which to crack or brute-force the password. I know that Excel 2003 uses RC4 for the encryption scheme. However, it does not store files in the same zip like structure that 2007 and 2010 does.

Additional Updates: This is for a forgotten "File Open" and not VBA password. I would be happy to hex edit the file too if I could find the specifications for where the password was stored. An example used for VBA file removal is listed here, http://gbanik.blogspot.co.uk/2010/08/understanding-excel-file-internals.html, and this is something sort of like what I am looking for except for the "File Open" password.

4
  • I assume that you do not know the password?
    – schroeder
    Aug 30, 2012 at 20:11
  • There is a file open password that has been forgotten. Cannot read the spreadsheet until it is removed. I am also not sure what you mean by stored in the heads.
    – John
    Aug 30, 2012 at 20:16
  • Maybe you want just to save it without password, or just null it, right? Aug 30, 2012 at 22:18
  • @AndrewSmith, that is correct, just null the password would be good.
    – John
    Aug 30, 2012 at 22:20

2 Answers 2

8

See this blog post which links to the official documentation. As the blog post explains, it seems that the encryption uses RC4 with a 128-bit key which is derived form the password; BUT (and that's the important point) the derivation truncates the unknown values at some point, down to 40 bits (see section 2.3.6.2). So, for a given document (using the salts and other values which are in the document header), there are only 240 possible RC4 keys, and that's workable with a PC in a fortnight (the blog post states that it could be lowered to "a few minutes" with GPUs, which is a bit exaggerated and unsubstantiated, especially since RC4 does not map well on GPU).

The challenge is finding software which does the exploration, from sources which are sufficiently respectable-looking that you would not fear running it on your PC. The other solution is programming it yourself.

(I had begun something like that at some point, but the file owner suddenly remembered the password and my effort stopped. So I quite believe that it is doable, and not very hard, but I have no code to show.)

2
  • +1 on this. I discovered how terrible their XLS encryption is on older documents when I was looking into OpenXML. Thankfully the new documents (.xlsx) have a much stronger design.
    – Polynomial
    Aug 31, 2012 at 6:12
  • 1
    crackxls2003 (which I wrote) is a program to do this. Mar 31, 2014 at 4:26
2

Probably if a similar feature exists in 2003. Note that this is only bypasses workbook "protection" where you have viewing access to parts of a spreadsheet but from within excel you have no obvious permission to edit.

Microsoft is aware this doesn't provide security; its meants as a convenience against accidental editing:

http://office.microsoft.com/en-us/excel-help/overview-of-security-and-protection-in-excel-HP005238854.aspx

Yes, a bad name/design (something like this should never have a password protection) as I'm sure idiots out there will think its stronger than its not easily bypassable. However, you can additionally password protect the entire file by encrypting it with a password (but then unprivileged users would not be able to view the data).

1
  • I think he's stuck with the other password issue: can't open the file to view it.
    – Jeff Ferland
    Aug 30, 2012 at 21:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.