Prev: IZArc update to ver. 4.1
Next: Timed auto-runner (automatically open and run programs)
From: Yuhler G on 12 Dec 2009 13:54

On article <MPG.258dc7e318f0ea109896b2(a)news.eternal-september.org>,
Yuhler G wrote:

>
>
> As I said before, I have a much more efficient tool here.
> Unfortunately it's a commercial tool so I can't send you a copy. BUT,
> if your file(s) have unclassified information, I could use my tool to
> find the password. An alphanumerical password of 5-8 characters
> wouldn't take too long to break. If you think it's fair enough,
> please upload it to http://yuhler-ftp.4shared.com/ or you can use
> Sendspace <http://www.sendspace.com/> service to send it to me (don't
> forget to provide a returning e-mail there). Use efgerman dot usenet
> at mailnull dot com as e-mail address. Maybe we can break it this
> weekend. :)
>
Not sure if I was clear enough, that is, you'll have to actually send
your files to me so I can use my tool on them.
>
I've just remember of a service I used in the past:
http://www.decryptum.com/

It works commercially, off course, but if you upload your file it
breaks up the password in seconds and gives you a file preview (used
to be password few letters) one could use to guess the whole. A file
preview is useful to see it your file is worth decryption:D

Just in case you find my prime offer unsuitable. ;)

--
Best,
Yuhler G.

Reply-To: partially ROT13, invalid=com
Due to spam I'm filtering-out GoogleGroups. Sorry. :(
From: "Dugie" d_fren at hotmail with a dot on 12 Dec 2009 19:05
"Yuhler G" <rstrezna.hfrarg(a)znvyahyy.invalid> wrote in message
news:MPG.258dc7e318f0ea109896b2(a)news.eternal-september.org...
>
> On article <4b23c3a4$0$5348$9a566e8b(a)news.aliant.net>, wrote:
>
> > "Yuhler G" <rstrezna.hfrarg(a)znvyahyy.invalid> wrote in message
> > news:MPG.258c8e7fbe0ff0bf9896b0(a)news.eternal-september.org...
> > >
> > > On article <4b1d5f8d$0$5345$9a566e8b(a)news.aliant.net>, wrote:
> > >
> > > > "Yuhler G" <rstrezna.hfrarg(a)znvyahyy.invalid> wrote in message
> > > > news:MPG.258612edbd568f5a9896ad(a)news.eternal-september.org...
> > > > >
> > > > > On article <4b1c11d8$0$5329$9a566e8b(a)news.aliant.net>, wrote:
> > > > >
> > > > > [...]
> > > > > >
> > > > > > Please post the VBS script. I'll check out that reference too as
> > well.
> > > > Thank
> > > > > > you.
> > > > > >
> > > > > > Dugie
> > > >
> > > > > YW.
> > > > >
> > > > > Get the original from here: http://www.sendspace.com/file/vlq6k1
> > > > >
> > > > > It shall be available for 30 days or so. Let me know if it arrived
> > > > > ok.
> > > > >
> > > > > --
> > > > > Best,
> > > > > Yuhler G.
> > > >
> > > > I have the file. Now what? Scripts are new to me. :)
> > > >
> > > > Dugie
> > > >
> > > Well, I'm sorry I got things wrong. I did test the script here but it
> > > did not work. Well, I thought the error is because I don't have MS-
> > > Office (I'm an OpenOffice guy) installed here and the script needs
> > > its COM objects to work. My bad.
> > >
> > > Good to know that H-Man got things running. BTW, I got your hacked
> > > script H-Man. Maybe I port it to a faster language and a fancy GUI.
> > > ;-)
> > >
> > > --
> > > Best,
> > > Yuhler G.
> >
> > You offered help when I needed it, Yuhler, and things developed from
there.
> > I don't think you 'got things wrong.'
> > I still haven't recovered the password to my Word 2000 DOC file. It
would be
> > interesting to see a ported and fancy GUI recovery tool. :)
> >
> Yeah, I hope so. ;) Anyway, it'll have to wait my vacations. My wife
> and I shall spend some days off at Germany (Berlin) and Portugal
> (Lisbon). Meanwhile I'll think of something.
>
> > This scripting method, from what little I understand, seems compact and
> > efficient.
> >
> It's not that much efficient. In fact, brute-force attack is kind of
> a dumb method. You tell the computer to hit the wall with its "head"
> until it breaks down (the wall, sometimes the head). As long you have
> spare time and CPU it can produce a result in a fair amount of time.
> There are other methods (e.g. cryptanalysis) much more efficient, but
> its engines are more difficult to "point-and-shoot" (try something
> like Ophcrack <http://ophcrack.sourceforge.net/> if you're curious).
> OTOH, using a script (interpreted computer language) isn't the best
> choice for such task. A compiled C (or Assembly) code would run much
> faster.
>
> As I said before, I have a much more efficient tool here.
> Unfortunately it's a commercial tool so I can't send you a copy. BUT,
> if your file(s) have unclassified information, I could use my tool to
> find the password. An alphanumerical password of 5-8 characters
> wouldn't take too long to break. If you think it's fair enough,
> please upload it to http://yuhler-ftp.4shared.com/ or you can use
> Sendspace <http://www.sendspace.com/> service to send it to me (don't
> forget to provide a returning e-mail there). Use efgerman dot usenet
> at mailnull dot com as e-mail address. Maybe we can break it this
> weekend. :)
>
> --
> Best,
> Yuhler G.

Thanks for your offer, it's definitely fair enough. The file contains
private data.

- Dugie


From: "Dugie" d_fren at hotmail with a dot on 13 Dec 2009 22:20
"H-Man" <Spam(a)bites.fs> wrote in message
news:4b1fc299$0$65849$892e0abb(a)auth.newsreader.octanews.com...
> On Tue, 8 Dec 2009 14:29:29 -0400, Dugie wrote:
>
> > "H-Man" <Spam(a)bites.fs> wrote in message
> > news:4b1e8f5a$0$65839$892e0abb(a)auth.newsreader.octanews.com...
> >> On Mon, 7 Dec 2009 16:03:23 -0400, Dugie wrote:
> >>
> >>> "Yuhler G" <rstrezna.hfrarg(a)znvyahyy.invalid> wrote in message
> >>> news:MPG.258612edbd568f5a9896ad(a)news.eternal-september.org...
> >>>>
> >>>> On article <4b1c11d8$0$5329$9a566e8b(a)news.aliant.net>, wrote:
> >>>>
> >>>> [...]
> >>>>>
> >>>>> Please post the VBS script. I'll check out that reference too as
well.
> >>> Thank
> >>>>> you.
> >>>>>
> >>>>> Dugie
> >>>
> >>>> YW.
> >>>>
> >>>> Get the original from here: http://www.sendspace.com/file/vlq6k1
> >>>>
> >>>> It shall be available for 30 days or so. Let me know if it arrived
> >>>> ok.
> >>>>
> >>>> --
> >>>> Best,
> >>>> Yuhler G.
> >>>
> >>> I have the file. Now what? Scripts are new to me. :)
> >>>
> >>> Dugie
> >>
> >> In the script there's a couple of things you'll want to look at.
> >>
> >> 1) The line where it says strFilePath = "c:\Run.xls"
> >> "c:\Run.xls" is the name of the file it's looking for so either change
> >> this path and filename to reflect the file you want to decrypt or
simply
> >> put a copy of your file in the C:\ path and rename it to Run.xls.
> >>
> >> 2) on the line wscript.echo strCPWD you'll want to put a single quote
in
> >> front of that line, otherwise you'll have to acknowledge every password
> >> tried.
> >>
> >> There are further limitations to this script. The script only checks
> > <snip>
> >> I'm including my 'fixed' version of this script here, if you would like
to
> >> include additional characters, post back here and I can open it up a
bit.
> >> I would have completely rewritten the NextPW function to make it a
little
> >> less, well awkward, but this works, (watch for line wrap)
> > <snip>
> >> --
> >> HK
> >
> > I appreciate your effort, explanations and modified script, H-Man!
> >
> > My original post states this is for a WORD file, ie. .DOC. Yesterday I
> > noticed the original script called for "c:\Run.xls" so I did copy &
rename
> > the doc file to that location. Got an error: "file format it not valid."
> >
> > Word wrap is a problem: scripting is new to me, so I don't always
recognize
> > a wrapped line.
> >
> > After spending some time trying to modifying the script, I've given up.
:)
> >
> > Dugie
>
> Okay, no sweat Dugie. I've hacked it up a bit to do the same for a Word
> file. So there are 2 versions, one for an Excel file, and one for a Word
<snip>
> I've uploaded the files in a .zip to
> http://www.badongo.com/file/18937499
> If you have any further problems, please post back.
>
> --
> HK

I should mention that I just did a test with a .DOC file, using a simple
password of hi, then another of hello.
The script didn't find the password. :(

Thanks to both you and Yuhler for your efforts. I actually have a few files
I need recovered.

Dugie


From: H-Man on 14 Dec 2009 13:51
On Sun, 13 Dec 2009 23:20:06 -0400, Dugie wrote:

> "H-Man" <Spam(a)bites.fs> wrote in message
> news:4b1fc299$0$65849$892e0abb(a)auth.newsreader.octanews.com...
>> On Tue, 8 Dec 2009 14:29:29 -0400, Dugie wrote:
>>
>>> "H-Man" <Spam(a)bites.fs> wrote in message
>>> news:4b1e8f5a$0$65839$892e0abb(a)auth.newsreader.octanews.com...
>>>> On Mon, 7 Dec 2009 16:03:23 -0400, Dugie wrote:
>>>>
>>>>> "Yuhler G" <rstrezna.hfrarg(a)znvyahyy.invalid> wrote in message
>>>>> news:MPG.258612edbd568f5a9896ad(a)news.eternal-september.org...
>>>>>>
>>>>>> On article <4b1c11d8$0$5329$9a566e8b(a)news.aliant.net>, wrote:
>>>>>>
>>>>>> [...]
>>>>>>>
>>>>>>> Please post the VBS script. I'll check out that reference too as
> well.
>>>>> Thank
>>>>>>> you.
>>>>>>>
>>>>>>> Dugie
>>>>>
>>>>>> YW.
>>>>>>
>>>>>> Get the original from here: http://www.sendspace.com/file/vlq6k1
>>>>>>
>>>>>> It shall be available for 30 days or so. Let me know if it arrived
>>>>>> ok.
>>>>>>
>>>>>> --
>>>>>> Best,
>>>>>> Yuhler G.
>>>>>
>>>>> I have the file. Now what? Scripts are new to me. :)
>>>>>
>>>>> Dugie
>>>>
>>>> In the script there's a couple of things you'll want to look at.
>>>>
>>>> 1) The line where it says strFilePath = "c:\Run.xls"
>>>> "c:\Run.xls" is the name of the file it's looking for so either change
>>>> this path and filename to reflect the file you want to decrypt or
> simply
>>>> put a copy of your file in the C:\ path and rename it to Run.xls.
>>>>
>>>> 2) on the line wscript.echo strCPWD you'll want to put a single quote
> in
>>>> front of that line, otherwise you'll have to acknowledge every password
>>>> tried.
>>>>
>>>> There are further limitations to this script. The script only checks
>>> <snip>
>>>> I'm including my 'fixed' version of this script here, if you would like
> to
>>>> include additional characters, post back here and I can open it up a
> bit.
>>>> I would have completely rewritten the NextPW function to make it a
> little
>>>> less, well awkward, but this works, (watch for line wrap)
>>> <snip>
>>>> --
>>>> HK
>>>
>>> I appreciate your effort, explanations and modified script, H-Man!
>>>
>>> My original post states this is for a WORD file, ie. .DOC. Yesterday I
>>> noticed the original script called for "c:\Run.xls" so I did copy &
> rename
>>> the doc file to that location. Got an error: "file format it not valid."
>>>
>>> Word wrap is a problem: scripting is new to me, so I don't always
> recognize
>>> a wrapped line.
>>>
>>> After spending some time trying to modifying the script, I've given up.
> :)
>>>
>>> Dugie
>>
>> Okay, no sweat Dugie. I've hacked it up a bit to do the same for a Word
>> file. So there are 2 versions, one for an Excel file, and one for a Word
> <snip>
>> I've uploaded the files in a .zip to
>> http://www.badongo.com/file/18937499
>> If you have any further problems, please post back.
>>
>> --
>> HK
>
> I should mention that I just did a test with a .DOC file, using a simple
> password of hi, then another of hello.
> The script didn't find the password. :(
>
> Thanks to both you and Yuhler for your efforts. I actually have a few files
> I need recovered.
>
> Dugie

Dugie, sorry for the delay in getting back here. Looking at some other
posts you are using Word 2000, and that's what I'm using so that's good. I
saved the script as a .doc file as follows. In word, I clicked on Save As,
and then selected the root folder on drive C: and called the file Run.doc.
I then clicked on the Tools pull down and then General Options and then
typed in "hi" (no quotes), as a password to open. I completed the save
function. To test this I opened the file in Word 2000 and Word asked for
the password, entering "hi" (no quotes), got the file opened. I closed Word
(leaving Word open generates a different error message, but the password is
still reported. Then I ran the script and after about 20 seconds it popped
up the password. I'm running XP Pro, it is possible that if you are running
Vista, this may not work.

The error you are showing here is one from WSH, and is not scripted. It
looks like Word is returning an error to WSH. The script looks for an error
from Word. A wrong password should return error number 5408. Any other
error should return where the password was left at. Did the error pop up
right away or was it after several seconds?

Also, I did notice that the script leaves the Winword process open. After
you run the script you can kill the process by using task manager. I did
fix this in the script, but the first priority should be getting this
working for you. Maybe we could take this to email so that you can share a
file you have mocked up so that I can test it here and figure this out for
you.

--
HK
First  |  Prev  | 
Pages: 1 2 3 4
Prev: IZArc update to ver. 4.1
Next: Timed auto-runner (automatically open and run programs)