Cracking VBA Project Passwords
Excel VBA Project Password. If a developer wants to hide the code of the project from the other users, VBA has provided us with a tool to do so, now using this tool we can password protect a single project or multiple projects when we right-click on a project we get an option for VBA project properties and in the protection segment we can password protect the project. Up until this research, the change to make a VBA Project locked/unviewable was said to be irreversible but I discovered that if you simulate a password protected document by setting the. Unviewable password protected vba project Unviewable password protected VBA projects are less secure than the equivalent locked projects, as recovery information has to be maintained within the file. Unviewable password protected projects can be made visible and re-locked, if required. I Finally Found It! Re-gain access to your valuable Excel worksheets and workbooks that were protected by an Excel 2007 or 2010 program. Also remove the protection of any regularly protected VBA project! This Excel add-in will provide you with a workable password and remove any protection from your worksheets that you are locked out of. Step 3: Unlocks and open password protected VBA project file. Step 4: Generates a new password for VBA file. Empire total war free. Step 5: Recover lost excel VBA password. Step 6: Crack VBA password from.xls,.xla files. Step 7: Best tool for.mdb VBA password recovery. Step 8: Access VBA password protected.
VBA projects can be protected with a password. The password is not used to encrypt the content of the VBA project, it is just used as protection by the VBA IDE: when the password is set, you will be prompted for the password.
Tools like oledump.py are not hindered by a VBA password, they can extract VBA code without problem, as it is not encrypted.
The VBA password is stored as the DPB value of the PROJECT stream:
You can remove password protection by replacing the values of ID, CMG, DPB and GC with the values of an unprotected VBA Project.
Thus a VBA password is no hindrance for staticanalysis.
However, we might still want to recover the password, just for the fun of it. How do we proceed?
Unlock Password Protected Vba Project
The password itself is not stored inside the PROJECT stream. In stead, a hash is stored: the SHA1 hash of the password (MBCS representation) + 4 byte salt.
Then, this hash is encrypted (data encryption as described in MS-OVBA 2.4.3.2) and the hexadecimal representation of this encrypted hash is the value of DPB.
Crack Vba Project Password
This data encryption is done according to an algorithm that does not use a secret key. I wrote an oledump.py plugin (plugin_vbaproject.py) to decrypt the hash and display it in a format suitable for John the Ripper and Hashcat:
The SHA1 of a password + salt is a dynamic format in John the Ripper: dynamic_24.
For Hashcat, it is mode 110 and you also need to use option –hex-salt.
Password Protected Vba Project
The password itself is not stored inside the PROJECT stream. In stead, a hash is stored: the SHA1 hash of the password (MBCS representation) + 4 byte salt.
Then, this hash is encrypted (data encryption as described in MS-OVBA 2.4.3.2) and the hexadecimal representation of this encrypted hash is the value of DPB.
Crack Vba Project Password
This data encryption is done according to an algorithm that does not use a secret key. I wrote an oledump.py plugin (plugin_vbaproject.py) to decrypt the hash and display it in a format suitable for John the Ripper and Hashcat:
The SHA1 of a password + salt is a dynamic format in John the Ripper: dynamic_24.
For Hashcat, it is mode 110 and you also need to use option –hex-salt.
Password Protected Vba Project
Remark that the password passed as argument to the SHA1 function is represented in Multi Byte Character Set format. This means that ASCII characters are represented as bytes, but that non-ASCII characters might be represented with more than one byte, depending on the VBA project's code page.