Pearson's OSCP Notebook

Office Documents

Properties2
tagsoffice, xlsx, excel, docx, msoffcrypto, libreoffice, office2john, access_review, password-protected
aliasesAccess_Review.xlsx

2 min read

Office Documents — Encrypted Excel / Word

Ctrl+F: Access_Review · msoffcrypto · libreoffice · office2john · xlsx · decrypted.xlsx

Workflow when you find a password-protected .xlsx / .docx on a share (e.g. via CrackMapExec - nxc > 📌 5) Share Enumeration, Spider & File Download).

📌 Step 1 — Obtain the file

nxc smb DC.voleur.htb -u ryan.naylor -p 'PASS' -d voleur.htb -k --share IT \
  --get-file 'First-Line Support\\Access_Review.xlsx' Access_Review.xlsx

Or smbclient · manual copy from share.

📌 Step 2 — Crack the password

office2john Access_Review.xlsx > office.hash
# or: python3 /usr/share/john/office2john.py Access_Review.xlsx > office.hash
 
john office.hash --wordlist=/usr/share/wordlists/rockyou.txt
john office.hash --show

See John > office2john — Microsoft Office Password (Word, Excel, PowerPoint)

📌 Step 3 — Open / decrypt it

Once you recover the password:

# Option A — open directly (GUI)
libreoffice Access_Review.xlsx

or decrypt to a new unprotected file:

# Install if missing
pip install msoffcrypto-tool
# or: sudo apt install python3-msoffcrypto  (if packaged)
 
# Option B — decrypt to new file
python3 -m msoffcrypto-tool -p 'PASSWORD' Access_Review.xlsx decrypted.xlsx

Then open decrypted.xlsx:

libreoffice decrypted.xlsx

📌 Quick cheat sheet

office2john file.xlsx > office.hash
john office.hash --wordlist=/usr/share/wordlists/rockyou.txt --show
python3 -m msoffcrypto-tool -p 'CRACKED_PASS' file.xlsx decrypted.xlsx
libreoffice decrypted.xlsx

Graph View

Backlinks