1、EXCEL密碼破解翻開文件工具-宏錄制新宏-輸入名字如：aa停止錄制(這樣得到一個空宏)工具-宏宏,選aa點編輯按鈕刪除窗口中的所有字符(只有幾個),替換為下面的內(nèi)容：(復(fù)制吧)關(guān)閉編輯窗口工具-宏宏選AlllnternalPasswords,運行,確定兩次,等2分鐘,再確定.OK,沒有密碼了!內(nèi)容如下：PublicSubAllInternalPasswords()'Breaksworksheetandworkbookstructurepasswords.BobMcCormick'probablyoriginatorofbasecodealgorithmmodifiedforc

2、overage'ofworkbookstructure/windowspasswordsandformultiplepasswords''NormanHarkerandJEMcGimpsey27-Dec-2002(Version1.1)'Modified2003-Apr-04byJEM:Allmsgstoconstants,and'eliminateoneExitSub(Version1.1.1)'RevealshashedpasswordsNOToriginalpasswordsConstDBLSPACEAsString=vbNewLine&a

3、mp;vbNewLineConstAUTHORSAsString=DBLSPACE&vbNewLine&_"AdaptedfromBobMcCormickbasecodeby"&_"NormanHarkerandJEMcGimpsey"ConstHEADERAsString="AllInternalPasswordsUserMessage"ConstVERSIONAsString=DBLSPACE&"Version1.1.12003-Apr-04"ConstREPBACKAsStri

4、ng=DBLSPACE&"Pleasereportfailure"&_"grammingnewsgroup."ConstALLCLEARAsString=DBLSPACE&"Theworkbookshould"&_"nowbefreeofallpasswordprotection,somakesureyou:"&_DBLSPACE&"SAVEITNOW!"&DBLSPACE&am

5、p;"andalso"&_DBLSPACE&"BACKUP!,BACKUP!,BACKUP!"&_DBLSPACE&"Also,rememberthatthepasswordwas"&_"putthereforareason.Don'tstuffupcrucialformulas"&_"ordata."&DBLSPACE&"Accessanduseofsomedata"&_"maybea

6、noffense.Ifindoubt,don't."ConstMSGNOPWORDS1AsString="Therewerenopasswordson"&_"sheets,orworkbookstructureorwindows."&AUTHORS&VERSIONConstMSGNOPWORDS2AsString="Therewasnoprotectionto"&_"workbookstructureorwindows."&DBLSPACE&_&qu

7、ot;Proceedingtounprotectsheets."&AUTHORS&VERSIONConstMSGTAKETIMEAsString="AfterpressingOKbuttonthis"&_"willtakesometime."&DBLSPACE&"Amountoftime"&_"dependsonhowmanydifferentpasswords,the"&_"passwords,andyourcomputer'ss

8、pecification."&DBLSPACE&_"Justbepatient!Makemeacoffee!"&AUTHORS&VERSIONConstMSGPWORDFOUND1AsString="YouhadaWorksheet"&_"StructureorWindowsPasswordset."&DBLSPACE&_"Thepasswordfoundwas:"&DBLSPACE&"$"&DBLSPAC

9、E&_"Noteitdownforpotentialfutureuseinotherworkbooksby"&_"thesamepersonwhosetthispassword."&DBLSPACE&_"Nowtocheckandclearotherpasswords."&AUTHORS&VERSIONConstMSGPWORDFOUND2AsString="YouhadaWorksheet"&_"passwordset."&DBL

10、SPACE&"Thepasswordfoundwas:"&_DBLSPACE&"$"&DBLSPACE&"Noteitdownforpotential"&_"futureuseinotherworkbooksbysamepersonwho"&_"setthispassword."&DBLSPACE&"Nowtocheckandclear"&_"otherpasswords."&

11、amp;AUTHORS&VERSIONConstMSGONLYONEAsString="Onlystructure/windows"&_"protectedwiththepasswordthatwasjustfound."&_ALLCLEAR&AUTHORS&VERSION&REPBACKDimw1AsWorksheet,w2AsWorksheetDimiAsInteger,jAsInteger,kAsInteger,lAsIntegerDimmAsInteger,nAsInteger,i1AsIntege

12、r,i2AsIntegerDimi3AsInteger,i4AsInteger,i5AsInteger,i6AsIntegerDimPWord1AsStringDimShTagAsBoolean,WinTagAsBooleanApplication.ScreenUpdating=FalseWithActiveWorkbookWinTag=.ProtectStructureOr.ProtectWindowsEndWithShTag=FalseForEachw1InWorksheetsShTag=ShTagOrw1.ProtectContentsNextw1IfNotShTagAndNotWinT

13、agThenMsgBoxMSGNOPWORDS1,vbInformation,HEADERExitSubEndIfMsgBoxMSGTAKETIME,vbInformation,HEADERIfNotWinTagThenMsgBoxMSGNOPWORDS2,vbInformation,HEADERElseOnErrorResumeNextDo'dummydoloopFori=65To66:Forj=65To66:Fork=65To66Forl=65To66:Form=65To66:Fori1=65To66Fori2=65To66:Fori3=65To66:Fori4=65To66For

14、i5=65To66:Fori6=65To66:Forn=32To126WithActiveWorkbook.UnprotectChr(i)&Chr(j)&Chr(k)&_Chr(l)&Chr(m)&Chr(i1)&Chr(i2)&_Chr(i3)&Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)If.ProtectStructure=FalseAnd_.ProtectWindows=FalseThenPWord1=Chr(i)&Chr(j)&Chr(k)&Chr(l)&a

15、mp;_Chr(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)MsgBoxApplication.Substitute(MSGPWORDFOUND1,_"$",PWord1),vbInformation,HEADERExitDo'Bypassallfor.nextsEndIfEndWithNext:Next:Next:Next:Next:NextNext:Next:Next:Next:Next:NextLoopUntilTrueOnError

16、GoTo0EndIfIfWinTagAndNotShTagThenMsgBoxMSGONLYONE,vbInformation,HEADERExitSubEndIfOnErrorResumeNextForEachw1InWorksheets'AttemptclearancewithPWord1w1.UnprotectPWord1Nextw1OnErrorGoTo0ShTag=FalseForEachw1InWorksheets'ChecksforallclearShTagtriggeredto1ifnot.ShTag=ShTagOrw1.ProtectContentsNextw

17、1IfShTagThenForEachw1InWorksheetsWithw1If.ProtectContentsThenOnErrorResumeNextDo'DummydoloopFori=65To66:Forj=65To66:Fork=65To66Forl=65To66:Form=65To66:Fori1=65To66Fori2=65To66:Fori3=65To66:Fori4=65To66Fori5=65To66:Fori6=65To66:Forn=32To126.UnprotectChr(i)&Chr(j)&Chr(k)&_Chr(l)&Ch

18、r(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)IfNot.ProtectContentsThenPWord1=Chr(i)&Chr(j)&Chr(k)&Chr(l)&_Chr(m)&Chr(i1)&Chr(i2)&Chr(i3)&_Chr(i4)&Chr(i5)&Chr(i6)&Chr(n)MsgBoxApplication.Substitute(MSGPWORDFOUND2,_

19、"$",PWord1),vbInformation,HEADER'leveragefindingPwordbytryingonothersheetsForEachw2InWorksheetsw2.UnprotectPWord1Nextw2ExitDo'Bypassallfor.nextsEndIfNext:Next:Next:Next:Next:NextNext:Next:Next:Next:Next:NextLoopUntilTrueOnErrorGoTo0EndIfEndWithNextw1EndIfMsgBoxALLCLEAR&AUTHORS&

20、amp;VERSION&REPBACK,vbInformation,HEADEREndSub窮舉破解EXCEL、WORD文檔密碼摘要：本文討論了如何使用VB編程,通過窮舉法解除EXCEL文檔和WORD文檔的密碼.并在破解過程中參加了中斷,以方便用戶隨時中斷破解過程.關(guān)鍵字：窮舉法、解密、EXCEL文檔、WORD文檔、密碼Excel和Word提供了多種方法限制訪問用戶文檔,以免未經(jīng)授權(quán)者的查看和更改.但在信息化的今天,用戶需要記憶的密碼太多,一旦密碼喪失,用戶將無法翻開或訪問該文檔,給用戶造成很大的損失.能否借助計算機的高速運行,解開密碼呢？通過嘗試,筆者認為：在無法弄清Excel和Wo

21、rd加密算法的情況下,利用窮舉法嘗試解密文檔,是解密唯一的選擇.1 .實現(xiàn)原理本程序選用VB6.0編寫,并充分利用了Office組件中的對象庫,窮舉嘗試各種口令,到達解密文檔的目的.巧用整數(shù)的取整及取余,產(chǎn)生密碼字符串Excel和Word文檔密碼可以是字母、數(shù)字、空格以及符號的任意組合,最長可達15個字符,且區(qū)分大小寫.本程序的破解過程利用一個兩層循環(huán),產(chǎn)生選定字符的排列組合嘗試密碼,其中外層循環(huán)限制密碼的位數(shù),內(nèi)層循環(huán)生成N位密碼的所有排列組合.產(chǎn)生嘗試密碼的方法是：將一個N位字符串密碼password作為一個數(shù)值",該數(shù)值每個位上的數(shù)字屬于選定字符范圍,且該數(shù)值與一個整數(shù)X一對應(yīng)

22、,并滿足以下條件：0<XwArrayLenN-1ArrayLen是選定密碼字符范圍的總字符數(shù),如：僅選定數(shù)字時,ArrayLen=10;僅選定數(shù)字和小寫字母時,ArrayLen=10+26=36;對X整除、取余N-1次,對每次的余數(shù)Y做以下操作：password=password+CharArrayY注：CharArray是存放選定字符的一維數(shù)組,最后做以下操作：password=CharArrayXMODArrayLen+password,產(chǎn)生的password就是整數(shù)X對應(yīng)的N位字符串.利用VB的錯誤處理功能,嘗試口令破解當(dāng)運行程序嘗試一個密碼時用該密碼翻開文檔,假設(shè)密碼錯誤,那么會

23、產(chǎn)生運行錯誤.為此,必須在嘗試口令前,使用OnError語句翻開一個錯誤處理程序；由于本程序是嘗試各種口令,當(dāng)一個口令錯誤時,直接嘗試下一個口令即可,因此,應(yīng)使用"OnErrorResumeNext語句.那么,如何得知找到口令了呢？VB有一個內(nèi)部錯誤對象Err,它的Number屬性中的值是用來確定發(fā)生錯誤的原因.在嘗試一個口令后,檢查Err.Number中的值,以確定該口令是否正確.破解過程中的中斷利用窮舉法解密對系統(tǒng)資源的占用是十分驚人的,在解密的過程中CPU的利用率幾乎是100%,假設(shè)不參加解密過程中的中斷,計算機系統(tǒng)會處于一種假死機狀態(tài).為此,在破解過程的內(nèi)循環(huán)中參加了DoEv

24、ents函數(shù).DoEvents函數(shù)提供了一種取消任務(wù)的簡便方法,它將限制切換到操作環(huán)境內(nèi)核.只要此環(huán)境中的所有應(yīng)用程序都有時機響應(yīng)待處理事件,應(yīng)用程序就又恢復(fù)限制.使用該函數(shù)的優(yōu)點是：不會使應(yīng)用程序放棄焦點,且后臺事件能夠得到有效處理.2 .具體實現(xiàn)過程編程實現(xiàn)時,需要機器安裝有VB應(yīng)用程序及MicrosoftOffice組件.新建VB工程,并對其初始化新建一個VB工程,取名Get_Password,將啟動窗體命名為FrmMain.首先選擇工程菜單中的引用,在引用“對話框中選擇"MicrosoftExcel10.0ObjectLibrary和“MicrOsoftWord10.0Obj

25、ectLibrary(注意：如果安裝的是Office2000或Office97,應(yīng)該選擇Excel對象庫和Word對象庫的9.0版或8.0版).其次在工程菜單中部件對話框中,選擇添加"MicrosoftWindowscommoncontrols-2.5(sp2)和aMicrosoftCommonDialogcontrol6.0,以便在窗體設(shè)計中使用微調(diào)控件和對話框控件.在FrmMain窗體上添加控件在FrmMain窗體上,根據(jù)以下圖的位置添加表1中的控件,然后根據(jù)表1修改每個對象的屬性.表1:序號控件名稱控件屬性及其屬性值1 FrameName=Frame1,Caption=選擇加密

26、文件*.DOC、*.XLS2 FrameName=Frame2,Caption=選定密碼字符范圍：3 FrameName=Frame3,Caption=選擇密碼的長度：4 ComboBowName=Combo15CommandButton6CommandButtonName=CmdBrowse,Caption=i|LName=CmdStartCrack,Caption=開始破解7CommandButtonName=CmdQuit,Caption=退出系統(tǒng)8CheckBoxName=ChkDigital,Caption=數(shù)字109CheckBoxName=ChkLowercase,Caption

27、j、寫字母2610CheckBoxName=ChkUppercase,Caption=大寫字母2611CheckBox12CheckBox13CheckBox14TextBox15TextBox16TextBoxName=ChkSpace,Caption=空格1Name=ChkBracket,Caption=括號6Name=ChkOthers,Caption=其他OEM字符26Name=txtPasswordStartLong,Text=2Name=txtPasswordEndLong,Text=2Name=Text117UpDownName=UpDown1,BuddyProperty=Tex

28、t,Wrap=TRUE,Increment=1BuddyControl=txtPasswordStartLong,Max=15,Min=18 UpDownName=UpDown2,BuddyProperty=Text,Wrap=TRUE,Increment=1BuddyControl=txtPasswordEndLong,Max=15,Min=119 CommonDialogName=Dialog,DialogTitle=請選擇加密的Excel或Word文檔Filter=Excel*.xlsWord*.doc|*.xls;*.doc20 LabelName=Label1,Caption=破解進

29、度：21 LabelName=Label3,Caption=從：22 LabelName=Label5,Caption=到：為以上對象編寫以下代碼為了便于理解,程序中增加了適當(dāng)?shù)淖⑨?OptionExplicitPrivateSubCmdBrowse_Click()Dialog.ShowOpen'showthedialogCombo1.Text=Dialog.FileName'settheFilenametextboxtotheselectedfileCombo1.RefreshEndSubPrivateSubCmdQuit_Click()EndEndSubPrivateSub

30、CmdStartCrack_Click()StaticblnProcessingAsBooleanDimwdAsNewWord.Application,xlsAsNewExcel.ApplicationDimOpenReturnDimstrpath,pass,StrTemp,all_char(100)AsStringDimJ,K,Password_Start_Long,Password_End_Long,ArrayLenAsIntegerDimI,TempAsLongArrayLen=0'數(shù)組初始化IfChkDigital.Value=1ThenForJ=ArrayLenToArray

31、Len+9all_char(J)=Chr(Asc("0")+J-ArrayLen)NextJArrayLen=ArrayLen+10EndIfIfChkLowercase.Value=1ThenForJ=ArrayLenToArrayLen+25all_char(J)=Chr(Asc("a")+J-ArrayLen)NextJArrayLen=ArrayLen+26EndIfIfChkUppercase.Value=1ThenForJ=ArrayLenToArrayLen+25all_char(J)=Chr(Asc("A")+J-Ar

32、rayLen)NextJArrayLen=ArrayLen+26EndIfIfChkSpace.Value=1Thenall_char(ArrayLen)=""ArrayLen=ArrayLen+1EndIfIfChkBracket.Value=1Thenall_char(ArrayLen)="("all_char(ArrayLen+1)=")"all_char(ArrayLen+2)=""all_char(ArrayLen+3)=""all_char(ArrayLen+4)="&qu

33、ot;all_char(ArrayLen+5)=""ArrayLen=ArrayLen+6EndIfIfChkOthers.Value=1ThenForJ=ArrayLenToArrayLen+6'33to39all_char(J)=Chr(33+J-ArrayLen)NextArrayLen=ArrayLen+7ForJ=ArrayLenToArrayLen+5'42to47all_char(J)=Chr(42+J-ArrayLen)NextJArrayLen=ArrayLen+6ForJ=ArrayLenToArrayLen+6'58to64al

34、l_char(J)=Chr(58+J-ArrayLen)NextJArrayLen=ArrayLen+7all_char(ArrayLen)=Chr(92)ArrayLen=ArrayLen+1ForJ=ArrayLenToArrayLen+2'94to96all_char(J)=Chr(94+J-ArrayLen)NextJArrayLen=ArrayLen+3all_char(ArrayLen)=Chr(124)all_char(ArrayLen+1)=Chr(126)ArrayLen=ArrayLen+2EndIfIfArrayLen=0ThenMsgBox"錯誤：沒有

35、選擇密碼使用的字符二,"請選擇密碼使用的字符范圍."ExitSubEndIfIfblnProcessingThenIfMsgBox("真的要中斷解密過程嗎？",vbYesNo,"用戶中斷任務(wù)")=vbYesThenblnProcessing=FalseElseCmdStartCrack.Caption="中斷破解"blnProcessing=Truestrpath=Combol.TextIfstrpath=""ThenMsgBox"錯誤：沒有選擇需要解密的文件二,"請選擇需要

36、解密的文件"ExitSubEndIfstrpath=Trim(strpath)Password_Start_Long=Val(txtPasswordStartLong.Text)Password_End_Long=Val(txtPasswordEndLong.Text)IfPassword_Start_Long>Password_End_LongThenPassword_Start_Long=Val(txtPasswordEndLong.Text)Password_End_Long=Val(txtPasswordStartLong.Text)EndIfLabel1.Captio

37、n="破解進度："Label1.RefreshOnErrorResumeNextIfUCase(Right(strpath,3)="XLS"ThenForK=Password_Start_LongToPassword_End_Long'破解excel開始ForI=0ToArrayLenAK-1pass=Temp=IForJ=1ToK-1Temp=TempArrayLepass=all_char(TempModArrayLen)+passNextJpass=pass+all_char(IModArrayLen)SetOpenReturn=xls.W

38、orkbooks.Open(FileName:=strpath,Password:=pass)Textl.Text=pass'顯示破解進度Textl.RefreshIfErr.Number<>0Then'如果解密成功翻開文檔,顯示密碼,退出過程Err.ClearElseLabell.Caption="文檔密碼："Textl.Text=passMe.Refreshxls.Visible=TrueCmdStartCrack.MousePointer=0CmdStartCrack.Caption="開始破解"blnProcessing=FalseSetxls=NothingExitSubEndIfDoEvent