Unpasswording word files

I know it can be done, but can anyone recommend a free (or very cheap) piece of software for password removal?

Someone at work has forgotten the password to a document she made a while ago.

http://www.passwordrecoverytools.com/

I found that on some site. I haven't tried it but it looks like it might be free.

unfortunately, it's not free:

This one is ~£7: http://www.password-studio.com

Word and Excel ones just aren't free, I looked everywhere for one then wrote a brute force cracker for xls. It's pretty damn slow though just due to the number of possible keys!

Grey Alien, how slow is damn slow? I'm quite interested in this as I was looking for something like this recently to solve a problem for a forgetful user.

Darkheart

You could try these:

http://www.sofotex.com/download/Security/Password_Recovery/more6.html

They claim to have trial periods, which might indicate that they would work without paying at least once. But then again they might not.

All the trials I've seen prove they work but only on passwords of 2 characters or something equally useless.

Does the forgetful user remember how many characters there are as 5-6 is doable but more is just real bad. Here's my delphi code, you might be able to convert it to a language you use and for Word also ...

procedure TForm1.Button1Click(Sender: TObject);
const
 MaxLength = 8;
var
 xls, xlw: Variant;
 pass: String;
 Success: Boolean;
 n: Integer;
 msg: String;
 passlength: Integer;
 startchar: Char;
 test: Array [0..MaxLength-1] of Char;
 print: Boolean;
 chars: Array [0..255] of Char;
 charscount: Integer;
 finalchar: Integer;
 index: Array[0..255] of Integer;

 procedure ClearArray;
 var i: integer;
 begin
  For i := 0 to MaxLength-1 do
    test[i] := #0;
  For i := 0 to 255 do
    index[i] := 0;
 end;

begin
 Button1.enabled := false;
 {load MS Excel}
 xls := CreateOLEObject('Excel.Application');

 //read in chars to scan for
 CharsCount := Length(EditChars.Text);
 FinalChar := CharsCount-1;
 StrPCopy(chars, EditChars.text);

 Success := False;
 pass := '';
 passlength := 1;
 startchar := chars[0];
 n := 0; //char pos 1
 ClearArray; //all zeros
 test[n] := startchar;
 Print := True;

 While true do
 begin
   If Print then
   begin
     Try
       Pass := test;
        {open the xls-file}
       xlw := xls.WorkBooks.Open(FileName := 'c:\test.xls', Password := pass, ReadOnly := True);
       Success := True;
      Break
     Except
    End;
   end;

  print := true;

  If index[n] < finalchar then
  begin
    Inc(index[n]);
    test[n] := chars[index[n]];
    If n > 0 then n := 0;
  end
  else
  begin
    testing.caption := pass;
    testing.refresh;
    index[n] := 0;
    test[n] := startchar; //reset current
    inc(n);
    If n = MaxLength then break;
    //add a new digit on the end of the string?
    If n = passlength then
    begin
      inc(passlength);
      test[n] := startchar; //reset new
    end;
    print := False;
  end;

  Application.ProcessMessages();
  If FormClose then
   begin
    Close;
    exit;
   end;
 end;

 {save with other file name}
 If success then
 begin
   xlw.SaveAs(FileName := 'c:\test_cracked', Password := '');
   xls.Workbooks.Close;

   msg := 'Password was '+pass;
   application.messagebox(pchar(msg),'Done!', MB_OK);
 end
 else
   application.messagebox('Failed!','Failed!', MB_OK);

 xls.Application.Quit;
 {unload MS Excel}
 xlw := UnAssigned;
 xls := UnAssigned;
 Button1.enabled := true;

EditChars.text is a string typed by the user into an editbox that contains all the characters that you want to check for. Don't just check for all possible characters (upper, lower, symbols) or it'll take forever.

Haha, unpasswording word files and companies selling you software to do it. I feel so much more secure with Windows and my files already.

To be fair, that's not just microsoft/windows... There are password crackers for countless file formats around, like microsoft word/excel/outlook, but also .zip, .rar, or even the windows or linux encrypted system passwords... Many of these are brute force and therefore very slow, but can be a life saver. But don't count on any software password to keep your data secure. :-?

Maybe I'm missing something, but what's the point of setting a password in the first place?

In a corporate environment there's plenty of confidential info floating around, that people don't necesarily want non-privileged employees to have access to. Having critical files password protected just adds an additional layer of security. May not be perfect, but it does accomplish the objective in most cases.

Thanks :) I actually own delphi 7 so I'll give that a go.

No it doesn't. Any "security" that can be bypassed by a seven quid program is useless.

>>No it doesn't. Any "security" that can be bypassed by a seven quid program is useless.<<

Exactly my thoughts.

Perturbatio: Good luck, that was written in Delphi3 but should be OK. You need to include ComObj in Uses (if it's still called that) also FormClose is a global Boolean variable for the form that get's set to true on FormCloseQuery, thus when Application.ProcessMessages is called, it can detect if the user has closed the app. You could enhance this code to have a starting value so that if you shut your PC off one day, you can continue from where you left off the next day :-)

Well most peple won't think to look for a cracker AND if you password is say 12 chars long, they won't crack it without utilising hundreds of PCs in some kind of SETI screensaver type arangement.

I think you're seriously overestimating the time it takes to crack most peoples 12 character passwords. That is assuming a Brute Force attack is even the best attack strategy in the first place. Considering it's a Microsoft product, I can't imagine it not having one or more serious security vulnurabilities that open up for much more elegant attack strategies than simple brute force (I mean it is RC4 after all).

Just like a physical lock on a diary is trivial to circumvent, it still blocks out 'casual snoopers'.

It's useless if data has to be secure, but will still *reduce* the chances of accidental exposure if nothing else.

FD: Not most people's, a programmers password, i.e. you don't use dictionary words and you include symbols like $ or something in it so a plain alphanumeric brute force approach will fail.

The point is a poassword WILL keep MOST people out, and a good one will keep even more people out.

I love poasswords.

You are right, he is grossly overstating it. I have done it in as little as three seconds.

Brute Force should be the last thing you try. For DOC/PDF, etc files, in the business would, people are not programming gurus. They are going to use names or words they can easily remember. It is just a matter of having the password cracker sift through its dictionary file.

well a) I was exagerating and b) I already explained that a decent 12 char password should have NO dictionary words and it should utilise symbols like $ and _ etc.

To put this in perspective: years ago I had to decrypt the NTLM password hive of an ancient Windows NT4 server in order to be able to migrate it over to a Linux system. A brute-force password crack on all alpha numerical characters plus ($#%@!?:;'.,-_*&) for passwords up to 14 characters (the maximum length supported by NT4) took about a week on a Pentium 600.

Note that that's not the time it takes to find the password for a user, but the time it takes to find the passwords for *all* users using any of those characters (in my case, it discovered 1497 out of 1499 accounts)

Although in the case of NT4, microsoft cut a lot of corners and made a number of very dumb (in hindsight) design choices. (e.g. instead of encrypting a 14-character password as-is, they chose to store & encrypt it as two seperate 7-character passwords. A 10 character password gets stores as a 7-character and a 3-character... Making them orders of magnitude easier to break than if they hadn't done so.)

Anyway, the password encryption algorithm used by Windows 2000 and XP is significantly more difficult, so at least they addressed those issues since they were first confronted with the cracking programs that could break NT4 in days rather than the 'tens of thousands of years' Microsoft's CSO initially claimed when NT was launched.

That said, most *applications* use significantly less rigorous password encryption than the operating system itself does, and typically take less time to break.

You can also cut down the time significantly by using a dictionary search first, rather than a pure brute force... Especially if you have a large dictionary file, and include lists of common first names, last names, etc. That's enough to catch the majority right there.