msoffcrypto-tool

msoffcrypto-tool (formerly ms-offcrypto-tool) is a Python tool and library for decrypting encrypted MS Office files with password, intermediate key, or private key which generated its escrow key.

Early PoC version: https://github.com/nolze/ms-offcrypto-tool/tree/v0.1.0

Install

pip install msoffcrypto-tool

Examples

As CLI tool (with password)

msoffcrypto-tool -p Passw0rd encrypted.docx decrypted.docx

Test if the file is encrypted or not:

msoffcrypto-tool -t document.doc

As library

Password and more key types are supported with library functions.

import msoffcrypto

file = msoffcrypto.OfficeFile(open("encrypted.docx", "rb"))

# Use password
file.load_key(password="Passw0rd")

# Use private key
# file.load_key(private_key=open("priv.pem", "rb"))
# Use intermediate key (secretKey)
# file.load_key(secret_key=binascii.unhexlify("AE8C36E68B4BB9EA46E5544A5FDB6693875B2FDE1507CBC65C8BCF99E25C2562"))

file.decrypt(open("decrypted.docx", "wb"))

Supported encryption methods

MS-OFFCRYPTO specs

ECMA-376 (Agile Encryption/Standard Encryption)
- MS-DOCX (OOXML) (Word 2007-2016)
- MS-XLSX (OOXML) (Excel 2007-2016)
- MS-PPTX (OOXML) (PowerPoint 2007-2016)
Office Binary Document RC4
- MS-DOC (Word 97, 98, 2000)
- MS-XLS (Excel 97, 98, 2000)
- MS-PPT (PowerPoint 97, 98, 2000)
ECMA-376 (Extensible Encryption)
Office Binary Document RC4 CryptoAPI
- MS-DOC (Word 2002, 2003, 2004)
- MS-XLS (Excel 2002, 2003, 2004)
- MS-PPT (PowerPoint 2002, 2003, 2004)
XOR Obfuscation

Other

Word 95 Encryption (Word 95 and prior)
Excel 95 Encryption (Excel 95 and prior)
PowerPoint 95 Encryption (PowerPoint 95 and prior)

PRs welcome!

Todo

Add tests
Support decryption with passwords
Support older encryption schemes
Add function-level tests
Add API documents
Publish to PyPI
Add decryption tests for various file formats
Merge to more comprehensive projects handling MS Office files (such as oletools?) if possible
Support decrypting encrypted macros
Support decrypting encrypted Excel worksheets
Support decrypting editing protection

References

"Backdooring MS Office documents with secret master keys" http://secuinside.com/archive/2015/2015-1-9.pdf
Technical Documents https://msdn.microsoft.com/en-us/library/cc313105.aspx
- [MS-OFFCRYPTO] Agile Encryption https://msdn.microsoft.com/en-us/library/dd949735(v=office.12).aspx
LibreOffice/core https://github.com/LibreOffice/core
LibreOffice/mso-dumper https://github.com/LibreOffice/mso-dumper
wvDecrypt http://www.skynet.ie/~caolan/Packages/wvDecrypt.html
Microsoft Office password protection - Wikipedia https://en.wikipedia.org/wiki/Microsoft_Office_password_protection#History_of_Microsoft_Encryption_password

Alternatives

Use cases and mentions

Metadata

Release files for msoffcrypto-tool 4.3.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for msoffcrypto-tool 4.3.1
File	Size	Uploaded
msoffcrypto-tool-4.3.1.tar.gz	11.1 kB	Jul 12, 2018	Details

Release files / msoffcrypto-tool-4.3.1.tar.gz

Download URL	msoffcrypto-tool-4.3.1.tar.gz
Size	11.1 kB
Tags	Source
SHA-256 checksum How to use checksums	`9cedbdbd38aef47acdff84dee4f54169e74b9e108d6f608f7b77ca731f9fd75e`
BLAKE2b-256 checksum How to use checksums	`f80449198326d22857fafcc1fa23b34333b1baaa3c549f7530b3c4cb7464e0b9`
Upload date	Jul 12, 2018
Uploaded using Trusted Publishing? What is trusted publishing?	No