Office Password Cracker

🔐 Can you crack into this locked corporate document?

Challenge 10 Dec 2025 Pro Exclusive Solution Available

A password-protected Word document stands between you and critical information. The file is encrypted, the contents hidden behind a corporate password. Armed with the right tools and techniques, can you break through the protection and uncover what lies within? Time to put your password cracking skills to the test.

Flags

Points

54%

Success Rate

Start Your Challenge

~1-2 min setup

Dedicated server

Private instance

Industry standard

This solution is for Flags Mode

This walkthrough explains how to hack the lab and capture the flags. For help with Learning Mode questions, use the Request Hint button next to each question.

Challenge

Office Password Cracker - Solution

Objective: Crack the password of the protected Word document and retrieve the flag inside.

Step 1: Download the Challenge File

First, download the password-protected Word document from the challenge page:

wget https://lab.hdna.me/141-office-password-cracker/confidential_report.docx

Or simply download it through your web browser by clicking the download button on the challenge page.

Step 2: Verify the Document is Password Protected

Attempt to open the document with LibreOffice or Microsoft Office to confirm it requires a password:

libreoffice confidential_report.docx

You should see a password prompt, confirming the document is encrypted.

Step 3: Install Required Tools

For this challenge, you'll need John the Ripper, which includes the office2john utility for extracting password hashes from Office documents.

On Kali Linux:

sudo apt update
sudo apt install john

On macOS (using Homebrew):

brew install john

On other Linux distributions:

sudo apt install john    # Debian/Ubuntu
sudo yum install john    # CentOS/RHEL
sudo pacman -S john      # Arch Linux

Step 4: Extract the Password Hash

Use office2john to extract the password hash from the Word document. This tool converts the Office document's encryption data into a format that John the Ripper can crack:

office2john confidential_report.docx > hash.txt

View the extracted hash to verify it was extracted successfully:

cat hash.txt

You should see a long hash string that starts with the filename and contains encrypted data.

Step 5: Crack the Password Using John the Ripper

Now use John the Ripper to crack the password. Start with the default wordlist:

john hash.txt

Recommended Approach: For faster results, start with a smaller wordlist of common passwords before moving to larger lists. The 10k-most-common.txt from SecLists (available on GitHub) is an excellent starting point:

# Using SecLists 10k-most-common.txt for quick initial pass
john --wordlist=/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt hash.txt

If you don't have SecLists installed, you can clone it from GitHub:

git clone https://github.com/danielmiessler/SecLists.git

If the password isn't found in the 10k-most-common list, try the larger rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

This password is relatively weak and commonly found in password lists. It should crack quickly with the 10k-most-common.txt wordlist.

If you want to use a mask attack for alphanumeric passwords, you can specify patterns:

# Using mask attack for short alphanumeric passwords
john --mask='?d?d?d?d?d?d?l' hash.txt

# Where ?d = digit and ?l = lowercase letter

Step 6: Display the Cracked Password

Once John has cracked the password, you can display it using:

john --show hash.txt

The output will show the cracked password in the format:

confidential_report.docx:PASSWORD::::::

The password for this document is: 123456a

Step 7: Open the Document and Retrieve the Flag

Now that you have the password, open the document using LibreOffice or Microsoft Office:

libreoffice confidential_report.docx

When prompted, enter the password: 123456a

The document will open and reveal the confidential contents, including the flag in UUID format.

Alternative Method: Using Hashcat

As an alternative to John the Ripper, you can use Hashcat for GPU-accelerated password cracking:

Step 1: Extract the hash using office2john (same as above):

office2john confidential_report.docx > hash.txt

Step 2: Identify the hash type. For Office 2007-2013 documents, the hash mode is typically 9600:

hashcat -m 9600 hash.txt /usr/share/wordlists/rockyou.txt

For Office 2016 and newer (.docx with stronger encryption), use mode 9700:

hashcat -m 9700 hash.txt /usr/share/wordlists/rockyou.txt

Note: You may need to clean up the hash format from office2john output to work with hashcat.

Understanding Office Document Encryption

How Office Encryption Works:

Microsoft Office uses AES encryption to protect documents
The password is used to derive an encryption key through key derivation functions
Older Office formats (.doc) use weaker RC4 encryption
Newer formats (.docx) use stronger AES-256 encryption with PBKDF2
Despite strong encryption, weak passwords remain vulnerable to cracking

Security Best Practices

Protecting Office Documents:

Use strong, unique passwords (minimum 16 characters with mixed case, numbers, and symbols)
Consider using password managers to generate and store complex passwords
For highly sensitive documents, consider additional encryption layers (like encrypting the file system or using encrypted containers)
Regularly update passwords for shared documents
Use multi-factor authentication when sharing documents through cloud services
Be aware that document encryption only protects at rest - not in transit unless using encrypted channels

Tools Summary

Tool	Purpose	Command Example
office2john	Extract password hash from Office documents	`office2john file.docx > hash.txt`
john	CPU-based password cracking	`john hash.txt`
hashcat	GPU-accelerated password cracking	`hashcat -m 9600 hash.txt wordlist.txt`
LibreOffice/MS Office	Open the document after cracking	`libreoffice file.docx`

Key Learning Points

Password-protected Office documents can be cracked offline once obtained
The strength of the encryption depends entirely on the password complexity
Tools like John the Ripper and Hashcat make password cracking accessible
GPU acceleration (hashcat) can dramatically speed up cracking attempts
Strong passwords are essential for protecting sensitive documents
Document encryption is only one layer of security - consider defense in depth

Challenge Complete! You have successfully cracked the Office document password and retrieved the flag. This demonstrates the importance of using strong passwords to protect sensitive information.