🔐 Can you crack into this locked corporate document?

Office Password Cracker - Solution

Step 1: Download the Challenge File

First, download the password-protected Word document from the challenge page:

wget https://lab.hdna.me/141-office-password-cracker/confidential_report.docx

Or simply download it through your web browser by clicking the download button on the challenge page.

Step 2: Verify the Document is Password Protected

Attempt to open the document with LibreOffice or Microsoft Office to confirm it requires a password:

libreoffice confidential_report.docx

You should see a password prompt, confirming the document is encrypted.

Step 3: Install Required Tools

For this challenge, you'll need John the Ripper, which includes the office2john utility for extracting password hashes from Office documents.

On Kali Linux:

sudo apt update
sudo apt install john

On macOS (using Homebrew):

brew install john

On other Linux distributions:

sudo apt install john    # Debian/Ubuntu
sudo yum install john    # CentOS/RHEL
sudo pacman -S john      # Arch Linux

Step 4: Extract the Password Hash

Use office2john to extract the password hash from the Word document. This tool converts the Office document's encryption data into a format that John the Ripper can crack:

office2john confidential_report.docx > hash.txt

View the extracted hash to verify it was extracted successfully:

cat hash.txt

You should see a long hash string that starts with the filename and contains encrypted data.

Step 5: Crack the Password Using John the Ripper

Now use John the Ripper to crack the password. Start with the default wordlist:

john hash.txt

Recommended Approach: For faster results, start with a smaller wordlist of common passwords before moving to larger lists. The 10k-most-common.txt from SecLists (available on GitHub) is an excellent starting point:

# Using SecLists 10k-most-common.txt for quick initial pass
john --wordlist=/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt hash.txt

If you don't have SecLists installed, you can clone it from GitHub:

git clone https://github.com/danielmiessler/SecLists.git

If the password isn't found in the 10k-most-common list, try the larger rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

This password is relatively weak and commonly found in password lists. It should crack quickly with the 10k-most-common.txt wordlist.

If you want to use a mask attack for alphanumeric passwords, you can specify patterns:

# Using mask attack for short alphanumeric passwords
john --mask='?d?d?d?d?d?d?l' hash.txt

# Where ?d = digit and ?l = lowercase letter

Step 6: Display the Cracked Password

Once John has cracked the password, you can display it using:

john --show hash.txt

The output will show the cracked password in the format:

confidential_report.docx:PASSWORD::::::

The password for this document is: 123456a

Step 7: Open the Document and Retrieve the Flag

Now that you have the password, open the document using LibreOffice or Microsoft Office:

libreoffice confidential_report.docx

When prompted, enter the password: 123456a

The document will open and reveal the confidential contents, including the flag in UUID format.

Alternative Method: Using Hashcat

As an alternative to John the Ripper, you can use Hashcat for GPU-accelerated password cracking:

Step 1: Extract the hash using office2john (same as above):

office2john confidential_report.docx > hash.txt

Step 2: Identify the hash type. For Office 2007-2013 documents, the hash mode is typically 9600:

hashcat -m 9600 hash.txt /usr/share/wordlists/rockyou.txt

For Office 2016 and newer (.docx with stronger encryption), use mode 9700:

hashcat -m 9700 hash.txt /usr/share/wordlists/rockyou.txt

Note: You may need to clean up the hash format from office2john output to work with hashcat.

Understanding Office Document Encryption

Security Best Practices

Tools Summary

Key Learning Points

• Password-protected Office documents can be cracked offline once obtained
• The strength of the encryption depends entirely on the password complexity
• Tools like John the Ripper and Hashcat make password cracking accessible
• GPU acceleration (hashcat) can dramatically speed up cracking attempts
• Strong passwords are essential for protecting sensitive documents
• Document encryption is only one layer of security - consider defense in depth