RE: Microsoft Word Protection Bypass

[Jerry Shenk]

Their advisory says that this protection is only to protect against
accidental modification....harumph! That's not what they used to say;)

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodt
echnol/office/office2000/reskit/ork2000/html/65t2_2.asp

-----Original Message-----
From: Thorsten Delbrouck-Konetzko
[mailto:Thorsten.Delbrouck@guardeonic.com]
Sent: Friday, January 02, 2004 5:51 AM
To: bugtraq@securityfocus.com
Cc: Microsoft Security Response Center
Subject: Microsoft Word Protection Bypass


Hi all,

Microsoft Word provides an option to protect "forms" by password. This
is
used to ensure that unauthorized users cannot manipulate the contents of

documents except within specially designed "form" areas. This feature is

also often used to protect documents which do not even have form areas
(quotations/offers etc.).

This form protection can easily be removed without any additional tools
(apart from a hex-editor).

Please find the full advisory attached.

best regards,
/tdk

--
Thorsten Delbrouck
Chief Information Officer

Guardeonic Solutions AG
Rosenheimer Str. 116
D-81669 Munich
---------------------------------

[Vladimir Katalov]

In-Reply-To: <OF60A8C9AA.4F52F3E5-ON00256E0F.003B08BA-C1256E0F.003B9AEC@l=
ocalhost>

>To: bugtraq@securityfocus.com=0D
>Cc: "Microsoft Security Response Center" <secure@microsoft.com>=0D
>Subject: Microsoft Word Protection Bypass=0D
>From: Thorsten Delbrouck-Konetzko <Thorsten.Delbrouck@guardeonic.com>=0D
>Date: Fri, 2 Jan 2004 10:51:03 +0000=0D
>Content-Type: multipart/mixed; boundary=3D"=3D_mixed 003B9AC4C1256E0F_=3D=
"=0D
>=0D
>Microsoft Word provides an option to protect "forms" by password. This i=
s =0D
>used to ensure that unauthorized users cannot manipulate the contents of=
=0D
>documents except within specially designed "form" areas. This feature is=
=0D
>also often used to protect documents which do not even have form areas =0D
>(quotations/offers etc.).=0D
>=0D
>This form protection can easily be removed without any additional tools =
=0D
>(apart from a hex-editor).=0D
>=0D
>Please find the full advisory attached.=0D
=0D
Actually, we have reported about this problem almost three years ago at "=
Black Hat Windows Security 2001" conference (Las Vegas, Feb'2001), see:=0D
=0D
http://www.blackhat.com/html/bh-multi-media-archives.html#Windows%20Secur=
ity%202001=0D
=0D
Here is the presentation ("Analysis of Microsoft Office Password Protecti=
on System, and Survey of Encryption Holes In Other MS Windows Application=
s") in PowerPoint format:=0D
=0D
http://www.blackhat.com/presentations/win-usa-01/Malyshev/bh-win-01-malys=
hev.ppt=0D
=0D
And streaming video:=0D
rtsp://media-1.datamerica.com/blackhat/bh-usa-win-01/video/bh-usa-win-01-=
andrey-malyshev-video.rm=0D
=0D
Microsoft, of course, was aware. There is an article published in Microso=
ft TechNet:=0D
=0D
Ask Us About... Security, March 2001=0D
http://www.microsoft.com/technet/columns/security/askus/auas0301.asp=0D
=0D
Quote from there:=0D
=0D
"Recovering Office passwords=0D
Q: I'm creating a document using Microsoft Word that may potentially cont=
ain sensitive information. I note that Word has a password protection fea=
ture (under Tools/Protect Document). How strong is the security surroundi=
ng this feature? =0D
A: I get a lot of mail asking about the strength of passwords for Office =
documents. As was demonstrated in an analysis of the Microsoft Office pas=
sword protection system presented by ElcomSoft at Black Hat (see above), =
the password-protection features of these programs were not designed to b=
e invincible. [...]"=0D
=0D
You may also want to have a look at our software that can recover or remo=
ve this password, among many other ones:=0D
=0D
Advanced Office XP Password Recovery=0D
http://www.elcomsoft.com/aoxppr.html=0D
=0D
-- =0D
Sincerely yours,=0D
Vladimir=0D
=0D
Vladimir Katalov=0D
Managing Director=0D
ElcomSoft Co.Ltd.=0D
Member of Association of Shareware Professionals (ASP)=0D
Member of Russian Cryptology Association=0D
mailto:vkatalov@elcomsoft.com=0D
http://www.elcomsoft.com

[Dave.Collins@tetratech.com]

Where can I find the "how to" to get around the password protection? I have a form that I need to modify, but whoever created it is no longer with the company and as a result, the password is "gone"

Many Thanks

[dan@logicalhosting.co.uk]

There are many programs to get the password from a word document, The one I use often is Advanced Office Password Recovery, it's demo is often enough.



dan.

[Christian King]

Quick HOWTO:

1. Open the protected document in Word
2. File / Save As (XML Document)
3. Open XML Document, look for <w:documentProtection =
w:edit=3D"read-only"
w:enforcement=3D"on" w:unprotectPassword=3D"xxxxxxx"/> The
"unprotectPassword" will be a hex byte string.
4. Open the .doc in your favorite hex editor, and search for the hex
string in the reverse order, i.e. if the unprotectPassword says "1F C6
CB EB" you would be searching for "EB CB C6 1F" .. when you find this
string simply zero them out and save the document (I suggest saving as a
copy obviously). Once you open the document again you should be able
to just click "Tools / Unprotect Document" and it will not even prompt
for a password.

-Chris

-----Original Message-----
From: Dave.Collins@tetratech.com [mailto:Dave.Collins@tetratech.com]=20
Sent: Wednesday, July 06, 2005 4:11 PM
To: bugtraq@securityfocus.com
Subject: Re: Microsoft Word Protection Bypass

Where can I find the "how to" to get around the password protection? I
have a form that I need to modify, but whoever created it is no longer
with the company and as a result, the password is "gone"

Many Thanks

[Walter Wickersham]

I usually open it in OpenOffice and remove the protection there (use =
openoffice2.0) then save it as a word file again

-----Original Message-----
From: Dave.Collins@tetratech.com [mailto:Dave.Collins@tetratech.com]
Sent: Wednesday, July 06, 2005 1:11 PM
To: bugtraq@securityfocus.com
Subject: Re: Microsoft Word Protection Bypass


Where can I find the "how to" to get around the password protection? I =
have a form that I need to modify, but whoever created it is no longer =
with the company and as a result, the password is "gone"

Many Thanks

[Johan De Meersman]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig21A33F328A798B9A4BD6E75E
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


Actually, just remove the entire tag in step 3, and open the xml file in
word again - You don't even lose formatting as far as I see :-)

Christian King wrote:

>Quick HOWTO:
>
>1. Open the protected document in Word
>2. File / Save As (XML Document)
>3. Open XML Document, look for <w:documentProtection w:edit="read-only"
>w:enforcement="on" w:unprotectPassword="xxxxxxx"/> The
>"unprotectPassword" will be a hex byte string.
>4. Open the .doc in your favorite hex editor, and search for the hex
>string in the reverse order, i.e. if the unprotectPassword says "1F C6
>CB EB" you would be searching for "EB CB C6 1F" .. when you find this
>string simply zero them out and save the document (I suggest saving as a
>copy obviously). Once you open the document again you should be able
>to just click "Tools / Unprotect Document" and it will not even prompt
>for a password.
>
>-Chris
>
>-----Original Message-----
>From: Dave.Collins@tetratech.com [mailto:Dave.Collins@tetratech.com]
>Sent: Wednesday, July 06, 2005 4:11 PM
>To: bugtraq@securityfocus.com
>Subject: Re: Microsoft Word Protection Bypass
>
>Where can I find the "how to" to get around the password protection? I
>have a form that I need to modify, but whoever created it is no longer
>with the company and as a result, the password is "gone"
>
>Many Thanks
>
>
>
>


--
When you're in command, command.
-- Admiral Nimitz
--

Public GPG key at blackhole.pca.dfn.de

GCS/IT d- s:+ a- C(+++)$ UL++++$ P+++(++++)$ L++(+++)$ !E- W+(+++)$
N+(++) o K w$ !O !M V PS(++)@ PE-(++)@ Y+ PGP++(+++) t(+) 5 X R tv--
b++(++++) DI++(++++) D++ G e++>+++++ h(+) r y+**


--------------enig21A33F328A798B9A4BD6E75E
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFC1TE+xz0AbiB4HpQRAlxNAJ9S5QK4am3wp6g7O5sJGM cKB6VgiwCeIV2t
YZZQM/fbutjWYPBrh3n4q9c=
=2o6i
-----END PGP SIGNATURE-----

--------------enig21A33F328A798B9A4BD6E75E--