msoffcrypto-tool
msoffcrypto-tool (formerly ms-offcrypto-tool) is a Python tool and library for decrypting encrypted MS Office files with password, intermediate key, or private key which generated its escrow key.
Early PoC version: https://github.com/nolze/ms-offcrypto-tool/tree/v0.1.0
Install
pip install msoffcrypto-tool
Examples
As CLI tool (with password)
msoffcrypto-tool -p Passw0rd encrypted.docx decrypted.docx
Test if the file is encrypted or not:
msoffcrypto-tool -t document.doc
As library
Password and more key types are supported with library functions.
import msoffcrypto
file = msoffcrypto.OfficeFile(open("encrypted.docx", "rb"))
# Use password
file.load_key(password="Passw0rd")
# Use private key
# file.load_key(private_key=open("priv.pem", "rb"))
# Use intermediate key (secretKey)
# file.load_key(secret_key=binascii.unhexlify("AE8C36E68B4BB9EA46E5544A5FDB6693875B2FDE1507CBC65C8BCF99E25C2562"))
file.decrypt(open("decrypted.docx", "wb"))
Supported encryption methods
MS-OFFCRYPTO specs
- ECMA-376 (Agile Encryption/Standard Encryption)
- MS-DOCX (OOXML) (Word 2007-2016)
- MS-XLSX (OOXML) (Excel 2007-2016)
- MS-PPTX (OOXML) (PowerPoint 2007-2016)
- Office Binary Document RC4 CryptoAPI
- MS-DOC (Word 2002, 2003, 2004)
- MS-XLS (Excel 2002, 2003, 2004) (experimental)
- MS-PPT (PowerPoint 2002, 2003, 2004)
- Office Binary Document RC4
- MS-DOC (Word 97, 98, 2000)
- MS-XLS (Excel 97, 98, 2000) (experimental)
- MS-PPT (PowerPoint 97, 98, 2000)
- ECMA-376 (Extensible Encryption)
- XOR Obfuscation
Other
- Word 95 Encryption (Word 95 and prior)
- Excel 95 Encryption (Excel 95 and prior)
- PowerPoint 95 Encryption (PowerPoint 95 and prior)
PRs welcome!
Todo
- Add tests
- Support decryption with passwords
- Support older encryption schemes
- Add function-level tests
- Add API documents
- Publish to PyPI
- Add decryption tests for various file formats
- Merge to more comprehensive projects handling MS Office files (such as oletools?) if possible
- Support decrypting encrypted macros
- Support decrypting encrypted Excel worksheets
- Support decrypting editing protection
References
- "Backdooring MS Office documents with secret master keys" http://secuinside.com/archive/2015/2015-1-9.pdf
- Technical Documents https://msdn.microsoft.com/en-us/library/cc313105.aspx
- [MS-OFFCRYPTO] Agile Encryption https://msdn.microsoft.com/en-us/library/dd949735(v=office.12).aspx
- LibreOffice/core https://github.com/LibreOffice/core
- LibreOffice/mso-dumper https://github.com/LibreOffice/mso-dumper
- wvDecrypt http://www.skynet.ie/~caolan/Packages/wvDecrypt.html
- Microsoft Office password protection - Wikipedia https://en.wikipedia.org/wiki/Microsoft_Office_password_protection#History_of_Microsoft_Encryption_password
Alternatives
- herumi/msoffice https://github.com/herumi/msoffice
- DocRecrypt https://blogs.technet.microsoft.com/office_resource_kit/2013/01/23/now-you-can-reset-or-remove-a-password-from-a-word-excel-or-powerpoint-filewith-office-2013/
Use cases and mentions
1 maintainer
Release files for msoffcrypto-tool 4.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| msoffcrypto-tool-4.6.0.tar.gz | 15.9 kB | Details |
Release files / msoffcrypto-tool-4.6.0.tar.gz
| Download URL | msoffcrypto-tool-4.6.0.tar.gz |
|---|---|
| Size | 15.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
50b57d0195407817bc3ebfa2ed8b2d0c9bd7ad8e851e8fc4014063e01cbc4658
|
|
BLAKE2b-256 checksum How to use checksums |
63ae8011f8677d5ff3e47dde7ccad0557a1941600828c70ee42f96e616b4c007
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.11.0 pkginfo/1.4.2 requests/2.19.1 setuptools/40.1.0 requests-toolbelt/0.8.0 tqdm/4.25.0 CPython/3.6.3
|
