Remove Password Protection from XLS Document

Question

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) document? Note that I am not asking for ways in which to crack or brute-force the password. I know that Excel 2003 uses RC4 for the encryption scheme. However, it does not store files in the same zip like structure that 2007 and 2010 does.

Additional Updates: This is for a forgotten "File Open" and not VBA password. I would be happy to hex edit the file too if I could find the specifications for where the password was stored. An example used for VBA file removal is listed here, http://gbanik.blogspot.co.uk/2010/08/understanding-excel-file-internals.html, and this is something sort of like what I am looking for except for the "File Open" password.

Answer 1

See this blog post which links to the official documentation. As the blog post explains, it seems that the encryption uses RC4 with a 128-bit key which is derived form the password; BUT (and that's the important point) the derivation truncates the unknown values at some point, down to 40 bits (see section 2.3.6.2). So, for a given document (using the salts and other values which are in the document header), there are only 2⁴⁰ possible RC4 keys, and that's workable with a PC in a fortnight (the blog post states that it could be lowered to "a few minutes" with GPUs, which is a bit exaggerated and unsubstantiated, especially since RC4 does not map well on GPU).

The challenge is finding software which does the exploration, from sources which are sufficiently respectable-looking that you would not fear running it on your PC. The other solution is programming it yourself.

(I had begun something like that at some point, but the file owner suddenly remembered the password and my effort stopped. So I quite believe that it is doable, and not very hard, but I have no code to show.)

Answer 2

Probably if a similar feature exists in 2003. Note that this is only bypasses workbook "protection" where you have viewing access to parts of a spreadsheet but from within excel you have no obvious permission to edit.

Microsoft is aware this doesn't provide security; its meants as a convenience against accidental editing:

http://office.microsoft.com/en-us/excel-help/overview-of-security-and-protection-in-excel-HP005238854.aspx

Yes, a bad name/design (something like this should never have a password protection) as I'm sure idiots out there will think its stronger than its not easily bypassable. However, you can additionally password protect the entire file by encrypting it with a password (but then unprivileged users would not be able to view the data).