msoffcrypto-tool
msoffcrypto-tool (formerly ms-offcrypto-tool) is a Python tool and library for decrypting encrypted MS Office files with password, intermediate key, or private key which generated its escrow key.
Early PoC version: https://github.com/nolze/ms-offcrypto-tool/tree/v0.1.0
Install
pip install msoffcrypto-tool
Examples
As CLI tool (with password)
msoffcrypto-tool -p Passw0rd encrypted.docx decrypted.docx
Test if the file is encrypted or not:
msoffcrypto-tool -t document.doc
As library
Password and more key types are supported with library functions.
import msoffcrypto
file = msoffcrypto.OfficeFile(open("encrypted.docx", "rb"))
# Use password
file.load_key(password="Passw0rd")
# Use private key
# file.load_key(private_key=open("priv.pem", "rb"))
# Use intermediate key (secretKey)
# file.load_key(secret_key=binascii.unhexlify("AE8C36E68B4BB9EA46E5544A5FDB6693875B2FDE1507CBC65C8BCF99E25C2562"))
file.decrypt(open("decrypted.docx", "wb"))
Supported encryption methods
MS-OFFCRYPTO specs
- ECMA-376 (Agile Encryption/Standard Encryption)
- MS-DOCX (OOXML) (Word 2007-2016)
- MS-XLSX (OOXML) (Excel 2007-2016)
- MS-PPTX (OOXML) (PowerPoint 2007-2016)
- Office Binary Document RC4 CryptoAPI
- MS-DOC (Word 2002, 2003, 2004)
- MS-XLS (Excel 2002, 2003, 2004) (experimental)
- MS-PPT (PowerPoint 2002, 2003, 2004)
- Office Binary Document RC4
- MS-DOC (Word 97, 98, 2000)
- MS-XLS (Excel 97, 98, 2000) (experimental)
- MS-PPT (PowerPoint 97, 98, 2000)
- ECMA-376 (Extensible Encryption)
- XOR Obfuscation
Other
- Word 95 Encryption (Word 95 and prior)
- Excel 95 Encryption (Excel 95 and prior)
- PowerPoint 95 Encryption (PowerPoint 95 and prior)
PRs welcome!
Todo
- Add tests
- Support decryption with passwords
- Support older encryption schemes
- Add function-level tests
- Add API documents
- Publish to PyPI
- Add decryption tests for various file formats
- Merge to more comprehensive projects handling MS Office files (such as oletools?) if possible
- Support decrypting encrypted macros
- Support decrypting encrypted Excel worksheets
- Support decrypting editing protection
References
- "Backdooring MS Office documents with secret master keys" http://secuinside.com/archive/2015/2015-1-9.pdf
- Technical Documents https://msdn.microsoft.com/en-us/library/cc313105.aspx
- [MS-OFFCRYPTO] Agile Encryption https://msdn.microsoft.com/en-us/library/dd949735(v=office.12).aspx
- LibreOffice/core https://github.com/LibreOffice/core
- LibreOffice/mso-dumper https://github.com/LibreOffice/mso-dumper
- wvDecrypt http://www.skynet.ie/~caolan/Packages/wvDecrypt.html
- Microsoft Office password protection - Wikipedia https://en.wikipedia.org/wiki/Microsoft_Office_password_protection#History_of_Microsoft_Encryption_password
Alternatives
- herumi/msoffice https://github.com/herumi/msoffice
- DocRecrypt https://blogs.technet.microsoft.com/office_resource_kit/2013/01/23/now-you-can-reset-or-remove-a-password-from-a-word-excel-or-powerpoint-filewith-office-2013/
Use cases and mentions
1 maintainer
Metadata
1 maintainer
Release files for msoffcrypto-tool 4.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| msoffcrypto-tool-4.6.0.tar.gz | 15.9 kB | Without provenance | Details |
Release files / msoffcrypto-tool-4.6.0.tar.gz
| Download URL | msoffcrypto-tool-4.6.0.tar.gz |
|---|---|
| Size | 15.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
50b57d0195407817bc3ebfa2ed8b2d0c9bd7ad8e851e8fc4014063e01cbc4658
|
|
BLAKE2b-256 checksum How to use checksums |
63ae8011f8677d5ff3e47dde7ccad0557a1941600828c70ee42f96e616b4c007
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.11.0 pkginfo/1.4.2 requests/2.19.1 setuptools/40.1.0 requests-toolbelt/0.8.0 tqdm/4.25.0 CPython/3.6.3
|
Security for msoffcrypto-tool 4.6.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
