tag:blogger.com,1999:blog-7750805153536412131.post4521365465975716936..comments2024-03-27T14:28:08.679+07:00Comments on untitled: Excel RC4 Encryption AlgorithmWorawit (sleepya)http://www.blogger.com/profile/16667985019731254845noreply@blogger.comBlogger19125tag:blogger.com,1999:blog-7750805153536412131.post-56245807949387563142017-02-12T22:58:15.250+07:002017-02-12T22:58:15.250+07:0044-4d => 0-9, 75-7a => A-F44-4d => 0-9, 75-7a => A-FAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-67812491678312206792016-10-26T22:30:10.567+07:002016-10-26T22:30:10.567+07:00have you made pregress on that syntax? how do 2 di...have you made pregress on that syntax? how do 2 digits represent one?<br />Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-19047364600845663502014-08-07T00:48:29.844+07:002014-08-07T00:48:29.844+07:00Every two digits of the key represent one digit of...Every two digits of the key represent one digit of the real key.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-16065448637449801292014-04-02T16:04:08.364+07:002014-04-02T16:04:08.364+07:00Amazing post and work performed.There is the tool ...Amazing post and work performed.There is the tool named guaexcel. The demo version allows you to use any real key to decrypt any <a href="http://pinterest.com/computerteachpr/" rel="nofollow"> Excel File </a>.MS Word is the same as MS Excel. Just change the stream name from "Workbook" to "worddocument" stream. Then use tool named guaword to decrypt the Word file.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-26798829733218908832013-12-21T18:36:33.961+07:002013-12-21T18:36:33.961+07:00"AnonymousJuly 22, 2013 at 8:28 AM
Hi Gavin...."AnonymousJuly 22, 2013 at 8:28 AM<br /><br />Hi Gavin. Code works and I successfully decrypted an excel file. Missing password for more than 6 years and was able to retrieve the key in 6 days. Awesome tool!<br />"<br /><br />hi can u please provide me your full working code becoz its not working on my side I also want to recover password of my file.<br />Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-57834833892305568172013-12-21T18:24:25.347+07:002013-12-21T18:24:25.347+07:00hi gavin I gor this error "The type or namesp...hi gavin I gor this error "The type or namespace name 'ManagedRC4' could not be found"<br /><br />can u help me for thisAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-67926333061739262902013-07-22T08:28:52.076+07:002013-07-22T08:28:52.076+07:00Hi Gavin. Code works and I successfully decrypted ...Hi Gavin. Code works and I successfully decrypted an excel file. Missing password for more than 6 years and was able to retrieve the key in 6 days. Awesome tool!Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-26056889653759471232013-02-27T10:22:03.809+07:002013-02-27T10:22:03.809+07:00Anonymous - If you ever see this, I've been re...Anonymous - If you ever see this, I've been researching the MS Word format and this would not appear to be correct. If the Word document is encrypted the necessary fields will appear in the "1Table" stream (or maybe the "0Table" stream). I intend to support automatically extracting this information in my key-finding program.Gavin Smithhttps://www.blogger.com/profile/03344927856394739965noreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-68088412412292401152012-07-22T12:01:32.737+07:002012-07-22T12:01:32.737+07:00>> MS Word is the same as MS Excel. Just cha...>> MS Word is the same as MS Excel. Just change the stream name from "Workbook" to "worddocument" stream.<br /><br />I did this but I get "Cannot find RC4 pass info". Can you double-check whether this works? Thanks!Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-70690052716883702212012-07-02T06:51:15.259+07:002012-07-02T06:51:15.259+07:00I've written a C version at my blog at http://...I've written a C version at my blog at http://gavinsmith87.blogspot.co.uk/2012/06/microsoft-excel-2003-encryption-scanner.html.Gavin Smithhttps://www.blogger.com/profile/03344927856394739965noreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-65137257622484884952012-04-12T14:21:09.259+07:002012-04-12T14:21:09.259+07:00So far so good, but which is 10 byte key in this:
...So far so good, but which is 10 byte key in this:<br />01E7FF40 00C03C58 ASCII "result=2&key=4d444a4a787a4a447549"Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-17736948599462504382012-03-07T05:52:43.244+07:002012-03-07T05:52:43.244+07:00What's that key returned by rixler.com? It...What's that key returned by rixler.com? It's not 40-bit.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-27434727533617741402011-11-11T05:09:26.650+07:002011-11-11T05:09:26.650+07:00hi, im Apuromafo of Crackslatinos, i was cheked ot...hi, im Apuromafo of Crackslatinos, i was cheked other app from rixler (DEMO),and from the program of that, in multi cracked was converted in full(unique in this class) , and this compañy have a hash and big proof as you say, can send the value example , work good, i was tested now in a friend app with aperture and was working..if you need check if can crack<br /><br />example: rixler.com&protocol_version=1.2&program_name=MDPC&program_version=3.0.0.4&command=1&target=2&decryption_mode=1&reg_code=123456&engine_data=a2c036063187cc84b1cb215eb1354a1d3ced16f564fc10a93290dadd46092aac14141414148fc7b3e0d6a7e7ee6ffdaeb120bc8cf87b897d78515559575959464948414459454d41484d4957415546494a414d4a49554c4658494b4959573a8487798a78837382898173758088517a444778444a4b774c774548457945763a&check_sum=At<br /><br />and response of server:<br />01E7FF40 00C03C58 ASCII "result=2&key=4d444a4a787a4a447549"<br />that hash decode the xls, and re assign a new pass and demo only show some limit, cracked is in that pass.. and you remove with that and done<br /><br /><br />*tested in 20 xls in open..and work, can be decripted and recovered without the real pass..Apuromafo CLShttps://www.blogger.com/profile/10967016497906023063noreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-20593123903356027882011-07-07T02:49:57.935+07:002011-07-07T02:49:57.935+07:00Nice post! One of the trial recovery tools let...Nice post! One of the trial recovery tools let's you see the key as it is sent back to the client. I tried to use this key with the guaexcel known_key as you mentioned but it only works for files with a fixed pwd in demo. How do you decrypt a file once you have the key?Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-35612448900980099652011-04-14T08:28:01.786+07:002011-04-14T08:28:01.786+07:00You rock! Thank you for this information. I'...You rock! Thank you for this information. I've written a brute-forcer in C based on your code.<br /><br />I'm just using MD5 from OpenSSL so with work I should be able to replace OpenSSL with packed SSE-based MD5 and make it 4x faster.Brandon Enright (bmenrigh)http://www.brandonenright.netnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-58710712506304083932011-03-26T22:11:14.275+07:002011-03-26T22:11:14.275+07:00My script is just testing the password. I wrote it...My script is just testing the password. I wrote it just for demonstrate the algorithm. For cracking, you should write it in C. It is much more faster.Worawit (sleepya)https://www.blogger.com/profile/16667985019731254845noreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-69925689619151770452011-03-25T10:30:20.798+07:002011-03-25T10:30:20.798+07:00Thanks for writing back. After compiling/installi...Thanks for writing back. After compiling/installing your script and running it, I'm prompted not only for the name of the excel file, but also a password. Perhaps I'm using it incorrectly, is there a way to use your script to actually crack the .xls file? Thanks again.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-51220068894038741022011-03-24T10:07:18.244+07:002011-03-24T10:07:18.244+07:00No complete program. I just wrote a small program ...No complete program. I just wrote a small program to test cracking speed.Worawit (sleepya)https://www.blogger.com/profile/16667985019731254845noreply@blogger.comtag:blogger.com,1999:blog-7750805153536412131.post-9386688231675260052011-03-23T12:31:29.152+07:002011-03-23T12:31:29.152+07:00Great article and work. Have you ever gotten arou...Great article and work. Have you ever gotten around to a complete program to open/decrypt protected Excel 2003 (RC4 40bit) files?Anonymousnoreply@blogger.com