vba - 用VBA破解Sheet密码

Question

我发现这个 VBA 代码可以在不知道密码的情况下解锁工作表:

Sub PasswordBreaker()

  Dim i As Integer, j As Integer, k As Integer
  Dim l As Integer, m As Integer, n As Integer
  Dim i1 As Integer, i2 As Integer, i3 As Integer
  Dim i4 As Integer, i5 As Integer, i6 As Integer
  On Error Resume Next
  For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
  For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
  For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
  For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126


 ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
      Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
      Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
  If ActiveSheet.ProtectContents = False Then
      MsgBox "One usable password is "& Chr(i) & Chr(j) & _
          Chr(k) & Chr(l)& Chr(m) & Chr(i1) & Chr(i2) & _
          Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
   ActiveWorkbook.Sheets(1).Select
   Range("a1").FormulaR1C1 = Chr(i) & Chr(j) & _
          Chr(k) & Chr(l)& Chr(m) & Chr(i1) & Chr(i2) & _
          Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
       Exit Sub
  End If
  Next: Next: Next: Next: Next: Next
  Next: Next: Next: Next: Next: Next
End Sub

我的问题是:它使用什么样的漏洞来发挥作用？

换句话说，为什么生成的 A 和 B 字符串可以用作特定工作簿内工作表的密码？

Answer 1

Excel 工作表密码保护的工作原理是将输入密码转换为哈希值并存储它。哈希是一种单向算法，它会压缩比特，沿途丢失一些信息，但会生成原始数据的指纹。由于数据丢失，不可能反转哈希来获取原始密码，但将来如果有人输入密码，可以对其进行哈希处理并与存储的哈希进行比较。这(通常)比简单地将密码存储为字符串进行比较更安全。

best description by far I've encountered有关暴力破解 Excel 哈希算法如何工作的信息，请参阅 Torben Klein 发布的@mehow 链接页面。他的回答可以概括为:

1. Excel 哈希函数将大空间的可能密码映射到小空间的可能哈希。
2. 由于哈希算法生成的哈希值非常小(15 位)，因此可能的哈希数为 2^15 = 32768 个哈希值。
3. 32768 是应用计算能力时需要尝试的一小部分。 Klein 导出输入密码的子集，涵盖所有可能的哈希值。

基于this description of Excel's hashing function ，以下代码生成与 Excel 相同的哈希，您可以使用它来测试 Klein 函数。

Option Explicit
'mdlExcelHash

Public Function getExcelPasswordHash(Pass As String)
    Dim PassBytes() As Byte
    PassBytes = StrConv(Pass, vbFromUnicode)
    Dim cchPassword As Long
    cchPassword = UBound(PassBytes) + 1
    Dim wPasswordHash As Long
    If cchPassword = 0 Then
        getExcelPasswordHash = wPasswordHash
        Exit Function
    End If

    Dim pch As Long
    pch = cchPassword - 1
    While pch >= 0
        wPasswordHash = wPasswordHash Xor PassBytes(pch)
        wPasswordHash = RotateLeft_15bit(wPasswordHash, 1)
        pch = pch - 1
    Wend

    wPasswordHash = wPasswordHash Xor cchPassword
    wPasswordHash = wPasswordHash Xor &HCE4B&
    getExcelPasswordHash = wPasswordHash
End Function

Private Function RotateLeft_15bit(num As Long, Count As Long) As Long
    Dim outLong As Long
    Dim i As Long
    outLong = num
    For i = 0 To Count - 1
        outLong = ((outLong \ 2 ^ 14) And &H1) Or ((outLong * 2) And &H7FFF) 'Rotates left around 15 bits, kind of a signed rotateleft
    Next
    RotateLeft_15bit = outLong
End Function