For more information on macros, see Microsoft Office Macros.
Unprotect document
When a password is asked when trying to remove the document protection.
- Rename file.docx to file.zip
- Delete the file “file.zip/word/settings.xml”
- Rename file.zip to file.docx
Bruteforce the password
For password-protected Word documents. Use John the Ripper (JtR).
python /usr/share/john/office2john.py file.docx > hash.txt Use Hashcat.
9700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Documents
9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Documents
9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Documents
9800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Documents
9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Documents
9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Documents
9400 | MS Office 2007 | Documents
9500 | MS Office 2010 | Documents
9600 | MS Office 2013 | Documents