Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 30 Jan 2014 22:24:40 -0500
From: "Matt Weir" <cweir@...edu>
To: <john-users@...ts.openwall.com>
Subject: RE: Decrypting PPT files

Dhiru,
	I'd say the cracking code is working great since while Powerpoint
crashes when I try the cracked password it handles normal "bad" passwords
with the usually "incorrect password" prompt. The password doesn't look
realistic though, (I cracked it with incremental=alnum). That's why I was
wondering if there was any chance of false positives which would also
explain PPT crashing if it was trying to decrypt garbage. I tried it on a
different computer with the same results. Funny story, apparently Powerpoint
for Macs doesn't even have the ability to open password protected files...
It's possible the file itself might be corrupted though.

Long story short, the problem is almost certainly either because there is
the possibility of false positives, or my file is corrupted. Based on what
Magnum said, I'd bet it's corrupted.

Thanks again for the help!
Matt

-----Original Message-----
From: Dhiru Kholia [mailto:dhiru.kholia@...il.com] 
Sent: Thursday, January 30, 2014 9:33 PM
To: john-users@...ts.openwall.com
Subject: Re: [john-users] Decrypting PPT files

On 01/31/14 at 02:10am, magnum wrote:
> On 2014-01-30 22:38, Matt Weir wrote:
> >So another question I have regarding this: Can the $oldoffice$3* hash 
> >format create false positives? Basically I "cracked" the hash but 
> >when I use it to open up the powerpoint file in question, powerpoint just
hangs.
> >Please note when I enter in the wrong password, Powerpoint will 
> >instead say that the password is invalid.
>
> There should be no false positives and I think the sympthoms rather 
> indicate your (presumably newer) Office version has a bug when loading 
> the older format. Maybe try older Office versions or some other 
> alternatives like converters, viewers or even things like LibreOffice 
> and see if they can open it.

Hopefully, I didn't screw up the cracking code this time :-)

Hi Matt,

Does the cracked password look familiar / realistic?

--
Dhiru

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.