Hex edit word document's password

[kevo]

I recently lost a password to a MSword document i had saved and while
trying to figure out a way to recover the password i came across these
instructions on numerous websites:

1.) Open a protected document in MS Word
2.) Save as "Web Page (*.htm; *.html)", close Word
3.) Open html-document in any Text-Editor
4.) Search "<w:UnprotectPassword>" tag, the line reads something like
that: <w:UnprotectPassword>ABCDEF01</w:UnprotectPassword>
5.) Keep the "password" in mind
6.) Open original document (.doc) with any hex-editor
7.) Search for hex-values of the password (reverse order!)
8.) Overwrite all 4 double-bytes with 0x00, Save, Close
9.) Open document with MS Word, Select "Tools / Unprotect Document"
(password is blank)


Apperently this is a loophole someone discovered that allows anybody to
gain access to a protected word or excel document.
But why the hell would you be hacking into a protected document to
change the password if you can already open it to begin with??
This is so stupid.
If anybody can help me with this, i would be greatly appreciated. I need
a way to regain access to a document and these instructions are not
making sense to me.

kevin

 

[aalaan]

Perhaps I'm slow, kevo (I've just recovered from illness), but these
instructions seem to be exactly what you want to recover your document
(although they are probably unwelcome reading to those who thought their
documents were totally secure). So when you have your own document that you
want to legitimately recover, what is the problem?

 

[kevo]

The problem is that to do this trick, you have to be able to first open
the document, which is exactly the problem i am trying to fix - i cant
open it becuase i dont have the password.In other words, The trick is
supposed to let you change or remove a password that is needed to open a
word document, but the trick requires that you already know the password
so that you can open it. I might me misinterpreting something, but i
havent been able to figure out what.

kevin

 

[Suzanne S. Barnhill]

This "trick" is to find the password that has been used to "protect" a
document for forms or perhaps tracked changes; these documents can be opened
but not edited without being unprotected. Documents protected this way are
not encrypted. Documents that you need a password to open are encrypted, and
nothing but brute force (which can take weeks) will derive the correct
password.

 

[kevo]

oh, well that sucks.