Forensic Blogs

An aggregator for digital forensics blogs

by

Update: msoffcrypto-crack.py Version 0.0.2

In this update of msoffcrypto-crack.py, two new options were added:

-e takes a text file and extracts all words from this text file to be used in the dictionary attack. Words are strings delimited by space characters. Words between single or double quotes, and words after string “password” are put at the beginning of the list for the dictionary attack.

The idea for option -e, is that you give it the content of an email message that contains the password of the encrypted attachment(s).

-c takes the password to decrypt the document. You use this option after the password was recovered (with option -p or -e for example), and need to run the tool again to decrypt the document. You can run the password cracking each time when you need to decrypt the document, but if this takes too long, then you just run it once and from then on provide the recovered password with option -c.

Password VelvetSweatshop was added to the embedded password list.

msoffcrypto-crack_V0_0_2.zip (https)
MD5: 010B7FA68FCF9CE84427815EFDFE1C42
SHA256: 6B368E40EEE8A907D444A49963B37F456A3645991201CE06F0E46A0F2E188A74

by

Update: numbers-to-string.py Version 0.0.7

In this update, I added option -T. This is an alternative for option -t (table for number to character conversion). In stead of providing the full table with option -t, now you can provide a partial table with option -T, provided the table is present in the input.

This is often the case in DOSfuscated scripts:

In this example, the table starts with MkBMMM. Hence I use option -T MkBMMM, in stead of option -t with the full table: -t MkBMMMdkGLKIEzzjzlJJanhzSNf7,Y9x@bm(/5Hqo6 +8wri)$;uv{-QtgOUP}C:\VDFW.=y’AsRe0cp

numbers-to-string_v0_0_7.zip (https)
MD5: C23E49A24B54365F469BB35CCDA12701
SHA256: 3E9E7DF84359BEB4A054FC82E73C3E94219FC85E462FFBE3676C16E115F61AB3