We can see that the hash I saved corresponds to Microsoft Office 2007. To verify that the hash was extracted successfully, use the cat command. ~# python office2john.py dummy.docx > hash.txt Run the following command and pipe the output into 'hash.txt' for later use. The first thing we need to do is extract the hash of our password-protected Office file. Passwords for those are also 'password123.' Step 3: Extract the Hash with Office2john You can also download documents made with Word 2010 and Word 2016 (that shows up as 2013) to use for more examples. The password is 'password123' as you'll find out. I am using a simple DOCX file named 'dummy.docx' that I created and password-protected with Word 2007. Next, we need an appropriate file to test this on. For most of you, this will be Home by default (just enter cd), but feel free to create a separate directory. In order to run office2john with Python, we will need to change into the same directory that it was installed into.

14:34:46 (1.45 MB/s) - ‘office2john.py’ saved Step 2: Make Sure Everything's in the Same Directory This can easily be accomplished with wget. To get started, we'll need to download the tool from GitHub since office2john is not included in the standard version of John the Ripper (which should already be installed in your Kali system). It may not work on newer versions of Office, though, we saved a DOCX in Office 2016 that was labeled as Office 2013.

As for Office compatibility, it's known to work on any password-protected file from Word, Excel, PowerPoint, OneNote, Project, Access, and Outlook that was created using Office 97, Office 2000, Office XP, Office 2003, Office 2007, Office 2010, and Office 2013, including the Office for Mac versions. This tool is written in Python and can be run right from the terminal. While the encryption standard across different Office products fluctuated throughout the years, none of them can stand up to office2john's hash-stealing abilities. Those extracted hashes can then be cracked using John the Ripper and Hashcat.Įxtracting the hash from a password-protected Microsoft Office file takes only a few seconds with the office2john tool. But password-protected documents from earlier versions of Office are susceptible to having their hashes extracted with a simple program called office2john. Microsoft Office files can be password-protected in order to prevent tampering and ensure data integrity.

What is john the ripper software