Comments (8)
herumi
commented on August 18, 2024
How did you make the file 247.docs?(What version is Microsoft Office?)
Can you use gdb?
If you can use it, then could you type the following command?
make DEBUG=1
gdb --args bin/msoffice-crypt.exe -p 5558 247.docx 247-decrypt.docx
(gdb) b include/cfb.hpp:186
(gdb)r
Breakpoint 1, ms::cfb::Header::analyze (... cfb.hpp:186
186 MS_ASSERT(minorVersion == 0x3eu || minorVersion == 0x3bu);
(gdb) p minorVersion
$1 = 62
(qdb) quit
from msoffice.
3Fingers
commented on August 18, 2024
I didn’t make the file. We received it as an email attachment and it contains a macro to drop ransomware on the system. I am developing a workflow for my team to pull the disassembled/deobfuscated VBA code from it for future exams and want to use msoffice-crypt as part of the workflow as a safe method of removing the password for the document.
The document’s metadata reports it was created by Word version 12, so Word 2007.
Not familiar with gdb. I’ll give it a try.
… On Apr 4, 2018, at 12:51 AM, MITSUNARI Shigeo ***@***.***> wrote:
How did you make the file 247.docs?(What version is Microsoft Office?)
Can you use gdb?
If you can use it, then could you type the following command?
make DEBUG=1
gdb --args bin/msoffice-crypt.exe -p 5558 247.docx 247-decrypt.docx
(gdb) b include/cfb.hpp:186
(gdb)r
Breakpoint 1, ms::cfb::Header::analyze (... cfb.hpp:186
186 MS_ASSERT(minorVersion == 0x3eu || minorVersion == 0x3bu);
(gdb) p minorVersion
$1 = 62
(qdb) quit
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASxoGg0I-cwJEKvsRsTQXok0d6pCu9rQks5tlFFegaJpZM4TF-8O>.
from msoffice.
3Fingers
commented on August 18, 2024
Here’s the terminal from gdb:
gdb --args bin/msoffice-crypt.exe -p 5558 247.docx 247-decrypt.docx
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from bin/msoffice-crypt.exe...done.
(gdb) b include/cfb.hpp:186
Breakpoint 1 at 0x411c21: file /home/user/work/msoffice/include/cfb.hpp, line 186.
(gdb) r
Starting program: /home/user/work/msoffice/bin/msoffice-crypt.exe -p 5558 247.docx 247-decrypt.docx
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
inFile=247.docx, outFile=247-decrypt.docx, mode=view, encMode=0
Breakpoint 1, ms::cfb::Header::analyze (this=0x7fffffffce80,
data=0x7ffff7fed000 "\320\317\021\340\241\261", <incomplete sequence \341>, dataSize=37376) at /home/tony/work/msoffice/include/cfb.hpp:186
186 MS_ASSERT(minorVersion == 0x3eu || minorVersion == 0x3bu);
(gdb) p minorVersion
$1 = 62
(gdb) quit
A debugging session is active.
Inferior 1 [process 8203] will be killed.
Quit anyway? (y or n) y
… On Apr 4, 2018, at 12:51 AM, MITSUNARI Shigeo ***@***.***> wrote:
How did you make the file 247.docs?(What version is Microsoft Office?)
Can you use gdb?
If you can use it, then could you type the following command?
make DEBUG=1
gdb --args bin/msoffice-crypt.exe -p 5558 247.docx 247-decrypt.docx
(gdb) b include/cfb.hpp:186
(gdb)r
Breakpoint 1, ms::cfb::Header::analyze (... cfb.hpp:186
186 MS_ASSERT(minorVersion == 0x3eu || minorVersion == 0x3bu);
(gdb) p minorVersion
$1 = 62
(qdb) quit
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASxoGg0I-cwJEKvsRsTQXok0d6pCu9rQks5tlFFegaJpZM4TF-8O>.
from msoffice.
herumi
commented on August 18, 2024
I'm sorry for the late response and thank you for your report.
/home/tony/work/msoffice/include/cfb.hpp:186 186 MS_ASSERT(minorVersion == 0x3eu || minorVersion == 0x3bu);
(gdb) p minorVersion $1 = 62
0x3eu = 62 and minorVersion = 62, then it is strange that MS_ASSERT(minorVersion == ...) fails.
Could you give me the 247.docx if it does not contain secret information?
from msoffice.
3Fingers
commented on August 18, 2024
Password is 247.doc. Inside is the PW protected doc - 247.doc (it's really a docx). Also a 247-unprotected where the password was removed with Password and a screen shot of Passware's findings.
from msoffice.
herumi
commented on August 18, 2024
Thank you for the file. Microsoft Defender detects 247-unprotected.doc is virus and has removed it.
The header of 247/247.doc has majorVersion=3 and minorVersion=33.
An encrypted XML document must have minorVersion=0x3e(MS-CFB).
According to CFBF header format, it is an old Microsoft Office format.
My software does not support old Microsoft Office format.
from msoffice.
n0thing2speak
commented on August 18, 2024
yes, same question as me,how to decrypt that?
from msoffice.
herumi
commented on August 18, 2024
I don't investigate a tool which supports the old format. Could you try to do it by yourself?
from msoffice.
Related Issues (20)
- can not remove a password of xlsx file HOT 1
- Exception DirectoryEntryVec:short size HOT 2
- exception:ms:DetectFormat:unknown format:3C3F786D6C207665
- exception:ms:CipherParam:cipherNameStr:AES:2048:ChainingModeCBC
- Read-Only Password HOT 1
- exception:randomgenerator HOT 1
- error decrypt shared workbook
- fatal error: openssl/hmac.h: No such file or directory HOT 1
- Trouble compiling HOT 4
- Run on Linux (CentOS 8 Stream) HOT 2
- Add support for libssl3 HOT 5
- libcrypto.so.3
- AES256 / sha512 with manually installed OpenSSL3 HOT 2
- Unable to compile on Ubuntu 16.04 HOT 2
- 64-bit compile
- Error cloning new version msoffice HOT 4
- Fails to compile: AtomicAddSub is not a member of cybozu::atomic_local::Tag<8u> HOT 3
- exception:ms:cfb:DirectoryEntryVec:short size:651847:17408 HOT 1
- Problem with miniFAT sectors when numMiniFatSectors > 1 HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from msoffice.