(整理)EXCEL密码破解.

1、EXCEL密码破解翻开文件工具-宏录制新宏-输入名字如：aa停止录制(这样得到一个空宏)工具-宏宏,选aa点编辑按钮删除窗口中的所有字符(只有几个),替换为下面的内容：(复制吧)关闭编辑窗口工具-宏宏选AlllnternalPasswords,运行,确定两次,等2分钟,再确定.OK,没有密码了!内容如下：PublicSubAllInternalPasswords()'Breaksworksheetandworkbookstructurepasswords.BobMcCormick'probablyoriginatorofbasecodealgorithmmodifiedforc

2、overage'ofworkbookstructure/windowspasswordsandformultiplepasswords''NormanHarkerandJEMcGimpsey27-Dec-2002(Version1.1)'Modified2003-Apr-04byJEM:Allmsgstoconstants,and'eliminateoneExitSub(Version1.1.1)'RevealshashedpasswordsNOToriginalpasswordsConstDBLSPACEAsString=vbNewLine&a

3、mp;vbNewLineConstAUTHORSAsString=DBLSPACE&vbNewLine&_"AdaptedfromBobMcCormickbasecodeby"&_"NormanHarkerandJEMcGimpsey"ConstHEADERAsString="AllInternalPasswordsUserMessage"ConstVERSIONAsString=DBLSPACE&"Version1.1.12003-Apr-04"ConstREPBACKAsStri

4、ng=DBLSPACE&"Pleasereportfailure"&_"grammingnewsgroup."ConstALLCLEARAsString=DBLSPACE&"Theworkbookshould"&_"nowbefreeofallpasswordprotection,somakesureyou:"&_DBLSPACE&"SAVEITNOW!"&DBLSPACE&am

5、p;"andalso"&_DBLSPACE&"BACKUP!,BACKUP!,BACKUP!"&_DBLSPACE&"Also,rememberthatthepasswordwas"&_"putthereforareason.Don'tstuffupcrucialformulas"&_"ordata."&DBLSPACE&"Accessanduseofsomedata"&_"maybea

6、noffense.Ifindoubt,don't."ConstMSGNOPWORDS1AsString="Therewerenopasswordson"&_"sheets,orworkbookstructureorwindows."&AUTHORS&VERSIONConstMSGNOPWORDS2AsString="Therewasnoprotectionto"&_"workbookstructureorwindows."&DBLSPACE&_&qu

7、ot;Proceedingtounprotectsheets."&AUTHORS&VERSIONConstMSGTAKETIMEAsString="AfterpressingOKbuttonthis"&_"willtakesometime."&DBLSPACE&"Amountoftime"&_"dependsonhowmanydifferentpasswords,the"&_"passwords,andyourcomputer'ss

8、pecification."&DBLSPACE&_"Justbepatient!Makemeacoffee!"&AUTHORS&VERSIONConstMSGPWORDFOUND1AsString="YouhadaWorksheet"&_"StructureorWindowsPasswordset."&DBLSPACE&_"Thepasswordfoundwas:"&DBLSPACE&"$"&DBLSPAC

9、E&_"Noteitdownforpotentialfutureuseinotherworkbooksby"&_"thesamepersonwhosetthispassword."&DBLSPACE&_"Nowtocheckandclearotherpasswords."&AUTHORS&VERSIONConstMSGPWORDFOUND2AsString="YouhadaWorksheet"&_"passwordset."&DBL

10、SPACE&"Thepasswordfoundwas:"&_DBLSPACE&"$"&DBLSPACE&"Noteitdownforpotential"&_"futureuseinotherworkbooksbysamepersonwho"&_"setthispassword."&DBLSPACE&"Nowtocheckandclear"&_"otherpasswords."&

11、amp;AUTHORS&VERSIONConstMSGONLYONEAsString="Onlystructure/windows"&_"protectedwiththepasswordthatwasjustfound."&_ALLCLEAR&AUTHORS&VERSION&REPBACKDimw1AsWorksheet,w2AsWorksheetDimiAsInteger,jAsInteger,kAsInteger,lAsIntegerDimmAsInteger,nAsInteger,i1AsIntege

12、r,i2AsIntegerDimi3AsInteger,i4AsInteger,i5AsInteger,i6AsIntegerDimPWord1AsStringDimShTagAsBoolean,WinTagAsBooleanApplication.ScreenUpdating=FalseWithActiveWorkbookWinTag=.ProtectStructureOr.ProtectWindowsEndWithShTag=FalseForEachw1InWorksheetsShTag=ShTagOrw1.ProtectContentsNextw1IfNotShTagAndNotWinT

13、agThenMsgBoxMSGNOPWORDS1,vbInformation,HEADERExitSubEndIfMsgBoxMSGTAKETIME,vbInformation,HEADERIfNotWinTagThenMsgBoxMSGNOPWORDS2,vbInformation,HEADERElseOnErrorResumeNextDo'dummydoloopFori=65To66:Forj=65To66:Fork=65To66Forl=65To66:Form=65To66:Fori1=65To66Fori2=65To66:Fori3=65To66:Fori4=65To66For

14、i5=65To66:Fori6=65To66:Forn=32To126WithActiveWorkbook.UnprotectChr(i)&Chr(j)&Chr(k)&_Chr(l)&Chr(m)&Chr(i1)&Chr(i2)&_Chr(i3)&Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)If.ProtectStructure=FalseAnd_.ProtectWindows=FalseThenPWord1=Chr(i)&Chr(j)&Chr(k)&Chr(l)&a

15、mp;_Chr(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)MsgBoxApplication.Substitute(MSGPWORDFOUND1,_"$",PWord1),vbInformation,HEADERExitDo'Bypassallfor.nextsEndIfEndWithNext:Next:Next:Next:Next:NextNext:Next:Next:Next:Next:NextLoopUntilTrueOnError

16、GoTo0EndIfIfWinTagAndNotShTagThenMsgBoxMSGONLYONE,vbInformation,HEADERExitSubEndIfOnErrorResumeNextForEachw1InWorksheets'AttemptclearancewithPWord1w1.UnprotectPWord1Nextw1OnErrorGoTo0ShTag=FalseForEachw1InWorksheets'ChecksforallclearShTagtriggeredto1ifnot.ShTag=ShTagOrw1.ProtectContentsNextw

17、1IfShTagThenForEachw1InWorksheetsWithw1If.ProtectContentsThenOnErrorResumeNextDo'DummydoloopFori=65To66:Forj=65To66:Fork=65To66Forl=65To66:Form=65To66:Fori1=65To66Fori2=65To66:Fori3=65To66:Fori4=65To66Fori5=65To66:Fori6=65To66:Forn=32To126.UnprotectChr(i)&Chr(j)&Chr(k)&_Chr(l)&Ch

18、r(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)IfNot.ProtectContentsThenPWord1=Chr(i)&Chr(j)&Chr(k)&Chr(l)&_Chr(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)MsgBoxApplication.Substitute(MSGPWORDFOUND2,_

19、"$",PWord1),vbInformation,HEADER'leveragefindingPwordbytryingonothersheetsForEachw2InWorksheetsw2.UnprotectPWord1Nextw2ExitDo'Bypassallfor.nextsEndIfNext:Next:Next:Next:Next:NextNext:Next:Next:Next:Next:NextLoopUntilTrueOnErrorGoTo0EndIfEndWithNextw1EndIfMsgBoxALLCLEAR&AUTHORS&

20、amp;VERSION&REPBACK,vbInformation,HEADEREndSub穷举破解EXCEL、WORD文档密码摘要：本文讨论了如何使用VB编程,通过穷举法解除EXCEL文档和WORD文档的密码.并在破解过程中参加了中断,以方便用户随时中断破解过程.关键字：穷举法、解密、EXCEL文档、WORD文档、密码Excel和Word提供了多种方法限制访问用户文档,以免未经授权者的查看和更改.但在信息化的今天,用户需要记忆的密码太多,一旦密码丧失,用户将无法翻开或访问该文档,给用户造成很大的损失.能否借助计算机的高速运行,解开密码呢？通过尝试,笔者认为：在无法弄清Excel和Wo

21、rd加密算法的情况下,利用穷举法尝试解密文档,是解密唯一的选择.1 .实现原理本程序选用VB6.0编写,并充分利用了Office组件中的对象库,穷举尝试各种口令,到达解密文档的目的.巧用整数的取整及取余,产生密码字符串Excel和Word文档密码可以是字母、数字、空格以及符号的任意组合,最长可达15个字符,且区分大小写.本程序的破解过程利用一个两层循环,产生选定字符的排列组合尝试密码,其中外层循环限制密码的位数,内层循环生成N位密码的所有排列组合.产生尝试密码的方法是：将一个N位字符串密码password作为一个数值",该数值每个位上的数字属于选定字符范围,且该数值与一个整数X一对应

22、,并满足以下条件：0<XwArrayLenN-1ArrayLen是选定密码字符范围的总字符数,如：仅选定数字时,ArrayLen=10;仅选定数字和小写字母时,ArrayLen=10+26=36;对X整除、取余N-1次,对每次的余数Y做以下操作：password=password+CharArrayY注：CharArray是存放选定字符的一维数组,最后做以下操作：password=CharArrayXMODArrayLen+password,产生的password就是整数X对应的N位字符串.利用VB的错误处理功能,尝试口令破解当运行程序尝试一个密码时用该密码翻开文档,假设密码错误,那么会

23、产生运行错误.为此,必须在尝试口令前,使用OnError语句翻开一个错误处理程序；由于本程序是尝试各种口令,当一个口令错误时,直接尝试下一个口令即可,因此,应使用"OnErrorResumeNext语句.那么,如何得知找到口令了呢？VB有一个内部错误对象Err,它的Number属性中的值是用来确定发生错误的原因.在尝试一个口令后,检查Err.Number中的值,以确定该口令是否正确.破解过程中的中断利用穷举法解密对系统资源的占用是十分惊人的,在解密的过程中CPU的利用率几乎是100%,假设不参加解密过程中的中断,计算机系统会处于一种假死机状态.为此,在破解过程的内循环中参加了DoEv

24、ents函数.DoEvents函数提供了一种取消任务的简便方法,它将限制切换到操作环境内核.只要此环境中的所有应用程序都有时机响应待处理事件,应用程序就又恢复限制.使用该函数的优点是：不会使应用程序放弃焦点,且后台事件能够得到有效处理.2 .具体实现过程编程实现时,需要机器安装有VB应用程序及MicrosoftOffice组件.新建VB工程,并对其初始化新建一个VB工程,取名Get_Password,将启动窗体命名为FrmMain.首先选择工程菜单中的引用,在引用“对话框中选择"MicrosoftExcel10.0ObjectLibrary和“MicrOsoftWord10.0Obj

25、ectLibrary(注意：如果安装的是Office2000或Office97,应该选择Excel对象库和Word对象库的9.0版或8.0版).其次在工程菜单中部件对话框中,选择添加"MicrosoftWindowscommoncontrols-2.5(sp2)和aMicrosoftCommonDialogcontrol6.0,以便在窗体设计中使用微调控件和对话框控件.在FrmMain窗体上添加控件在FrmMain窗体上,根据以下图的位置添加表1中的控件,然后根据表1修改每个对象的属性.表1:序号控件名称控件属性及其属性值1 FrameName=Frame1,Caption=选择加密

26、文件*.DOC、*.XLS2 FrameName=Frame2,Caption=选定密码字符范围：3 FrameName=Frame3,Caption=选择密码的长度：4 ComboBowName=Combo15CommandButton6CommandButtonName=CmdBrowse,Caption=i|LName=CmdStartCrack,Caption=开始破解7CommandButtonName=CmdQuit,Caption=退出系统8CheckBoxName=ChkDigital,Caption=数字109CheckBoxName=ChkLowercase,Caption

27、j、写字母2610CheckBoxName=ChkUppercase,Caption=大写字母2611CheckBox12CheckBox13CheckBox14TextBox15TextBox16TextBoxName=ChkSpace,Caption=空格1Name=ChkBracket,Caption=括号6Name=ChkOthers,Caption=其他OEM字符26Name=txtPasswordStartLong,Text=2Name=txtPasswordEndLong,Text=2Name=Text117UpDownName=UpDown1,BuddyProperty=Tex

28、t,Wrap=TRUE,Increment=1BuddyControl=txtPasswordStartLong,Max=15,Min=18 UpDownName=UpDown2,BuddyProperty=Text,Wrap=TRUE,Increment=1BuddyControl=txtPasswordEndLong,Max=15,Min=119 CommonDialogName=Dialog,DialogTitle=请选择加密的Excel或Word文档Filter=Excel*.xlsWord*.doc|*.xls;*.doc20 LabelName=Label1,Caption=破解进

29、度：21 LabelName=Label3,Caption=从：22 LabelName=Label5,Caption=到：为以上对象编写以下代码为了便于理解,程序中增加了适当的注释.OptionExplicitPrivateSubCmdBrowse_Click()Dialog.ShowOpen'showthedialogCombo1.Text=Dialog.FileName'settheFilenametextboxtotheselectedfileCombo1.RefreshEndSubPrivateSubCmdQuit_Click()EndEndSubPrivateSub

30、CmdStartCrack_Click()StaticblnProcessingAsBooleanDimwdAsNewWord.Application,xlsAsNewExcel.ApplicationDimOpenReturnDimstrpath,pass,StrTemp,all_char(100)AsStringDimJ,K,Password_Start_Long,Password_End_Long,ArrayLenAsIntegerDimI,TempAsLongArrayLen=0'数组初始化IfChkDigital.Value=1ThenForJ=ArrayLenToArray

31、Len+9all_char(J)=Chr(Asc("0")+J-ArrayLen)NextJArrayLen=ArrayLen+10EndIfIfChkLowercase.Value=1ThenForJ=ArrayLenToArrayLen+25all_char(J)=Chr(Asc("a")+J-ArrayLen)NextJArrayLen=ArrayLen+26EndIfIfChkUppercase.Value=1ThenForJ=ArrayLenToArrayLen+25all_char(J)=Chr(Asc("A")+J-Ar

32、rayLen)NextJArrayLen=ArrayLen+26EndIfIfChkSpace.Value=1Thenall_char(ArrayLen)=""ArrayLen=ArrayLen+1EndIfIfChkBracket.Value=1Thenall_char(ArrayLen)="("all_char(ArrayLen+1)=")"all_char(ArrayLen+2)=""all_char(ArrayLen+3)=""all_char(ArrayLen+4)="&qu

33、ot;all_char(ArrayLen+5)=""ArrayLen=ArrayLen+6EndIfIfChkOthers.Value=1ThenForJ=ArrayLenToArrayLen+6'33to39all_char(J)=Chr(33+J-ArrayLen)NextArrayLen=ArrayLen+7ForJ=ArrayLenToArrayLen+5'42to47all_char(J)=Chr(42+J-ArrayLen)NextJArrayLen=ArrayLen+6ForJ=ArrayLenToArrayLen+6'58to64al

34、l_char(J)=Chr(58+J-ArrayLen)NextJArrayLen=ArrayLen+7all_char(ArrayLen)=Chr(92)ArrayLen=ArrayLen+1ForJ=ArrayLenToArrayLen+2'94to96all_char(J)=Chr(94+J-ArrayLen)NextJArrayLen=ArrayLen+3all_char(ArrayLen)=Chr(124)all_char(ArrayLen+1)=Chr(126)ArrayLen=ArrayLen+2EndIfIfArrayLen=0ThenMsgBox"错误：没有

35、选择密码使用的字符二,"请选择密码使用的字符范围."ExitSubEndIfIfblnProcessingThenIfMsgBox("真的要中断解密过程吗？",vbYesNo,"用户中断任务")=vbYesThenblnProcessing=FalseElseCmdStartCrack.Caption="中断破解"blnProcessing=Truestrpath=Combol.TextIfstrpath=""ThenMsgBox"错误：没有选择需要解密的文件二,"请选择需要

36、解密的文件"ExitSubEndIfstrpath=Trim(strpath)Password_Start_Long=Val(txtPasswordStartLong.Text)Password_End_Long=Val(txtPasswordEndLong.Text)IfPassword_Start_Long>Password_End_LongThenPassword_Start_Long=Val(txtPasswordEndLong.Text)Password_End_Long=Val(txtPasswordStartLong.Text)EndIfLabel1.Captio

37、n="破解进度："Label1.RefreshOnErrorResumeNextIfUCase(Right(strpath,3)="XLS"ThenForK=Password_Start_LongToPassword_End_Long'破解excel开始ForI=0ToArrayLenAK-1pass=Temp=IForJ=1ToK-1Temp=TempArrayLepass=all_char(TempModArrayLen)+passNextJpass=pass+all_char(IModArrayLen)SetOpenReturn=xls.W

38、orkbooks.Open(FileName:=strpath,Password:=pass)Textl.Text=pass'显示破解进度Textl.RefreshIfErr.Number<>0Then'如果解密成功翻开文档,显示密码,退出过程Err.ClearElseLabell.Caption="文档密码："Textl.Text=passMe.Refreshxls.Visible=TrueCmdStartCrack.MousePointer=0CmdStartCrack.Caption="开始破解"blnProcessing=FalseSetxls=NothingExitSubEndIfDoEvent