VBA/Excel Password minder cracker wanted

Souleh

Souleh

Souleh

Associate
Joined
26 Oct 2006
Posts
1,355
Location
London
Hi all,

Got a wee script to mind passwords and wondering if anyones up for some cracking!

Worthwhile just leaving the file on here?

-Pete
 
1295709238_22-01-2011-15-11-35.jpg


1295709368_22-01-2011_15-15-55.png
 
Last edited:
Did you get the passwords though?

Use the get password method / button to retrieve the de-crypted version
 
Code: 
Sub load()

    UserForm1.Show
    
End Sub
Sub unlockSheet()

    Dim s As String
    
    s = InputBox("Enter Password")
    
    If s = UserForm1.pwtb Then
        Worksheets("pw").Visible = True
        Worksheets("pw").Select
    Else
        MsgBox "Incorrect password - Closing workbook."
        ActiveWorkbook.Close (True)
        Application.Quit
    End If
    
End Sub

Sub hideSheet()

    Worksheets("pw").Visible = xlVeryHidden
    
End Sub
 
Neither of the 3 passwords have been posted on here. He has beaten the first stage of unlocking the encrypted codes

I wouldnt pin my security on VBA's ability to lock code.

This is why I felt it very good for people to beat it - excel is very hard to lock down
 
Last edited:
You're using AES / Blowfish to encrypt the passwords, so excel doesnt really come into the equation :)

Is it worth us brute forcing the password? Or is it of too sensible quality to not bother.
 
tntcoder said:
You're using AES / Blowfish to encrypt the passwords, so excel doesnt really come into the equation :)

Is it worth us brute forcing the password? Or is it of too sensible quality to not bother.
Click to expand...

Was just about to post this - do you actually want us to show the decrypted passwords? Because then we're testing the security of the encryption algorithms rather than your program.
 
Was simply asking if theres any gaping voids in implementation and creation of the tool.

I didnt set out to make any product of types but just a decent password holder for a lot of system passwords I keep that have a very short expiry date and refuse to allow anything similar to the previous 5-10 used.

If you guys think its secure enough then I wont ask you to waste time brute forcing it.
Out of curiosity though how would you be able to brute force this application?
Irrespective of the pass code being correct or incorrect it will return a password. Some sort of semi - intelligent gatherer whereby only logical (defined by coder) outcomes are kept?
 
We shouldn't have really been allowed to see the hashes in the first place :p. But I guess VBA is difficult to protect properly.

Cannot decrypt the passwords, unless you give me some super computers and a few years.

Souleh said:
Was simply asking if theres any gaping voids in implementation and creation of the tool.

I didnt set out to make any product of types but just a decent password holder for a lot of system passwords I keep that have a very short expiry date and refuse to allow anything similar to the previous 5-10 used.

If you guys think its secure enough then I wont ask you to waste time brute forcing it.
Out of curiosity though how would you be able to brute force this application?
Irrespective of the pass code being correct or incorrect it will return a password. Some sort of semi - intelligent gatherer whereby only logical (defined by coder) outcomes are kept?
Click to expand...

I can't see any implementation issues, providing you're not storing the key in plain text or something silly!

It's simple to brute force this application as we have a list of the password hashes, but because of the encryption technique used it's not really something I'd want to wait around for! I guess you mean brute force this application as in getting round the protection all together. I can't see that being possible because of the encryption.

You should see if you can protect the password hashes, seeing them is a step too close for comfort :)
 
Last edited:
Yer you could take the hashes and wrap a brute forcer around them and then you could do a complex search of things like dictionary words, custom word lists etc but once that fails you're out of luck.
 
Craig321 said:
We shouldn't have really been allowed to see the hashes in the first place :p. But I guess VBA is difficult to protect properly.

Cannot decrypt the passwords, unless you give me some super computers and a few years.



I can't see any implementation issues, providing you're not storing the key in plain text or something silly!

It's simple to brute force this application as we have a list of the password hashes, but because of the encryption technique used it's not really something I'd want to wait around for! I guess you mean brute force this application as in getting round the protection all together. I can't see that being possible because of the encryption.

You should see if you can protect the password hashes, and seeing them is a step too close for comfort :)
Click to expand...

Yes its a bit annoying but nothing can be completely hidden. Only thing I can think of is mis-direction or something equally annoying to put people off etc!

Im new to encryption so this is my first shot at it so its good to see I chose a decent enough standard.

FYI. (for those that didnt get it)
The password to unlock the GUI is "hehe" - No quotes.

The passcode to de-crypt is "kawasaki636" - Same, no quotes.

Thanks guys
 
You must log in or register to reply here.
Back
Top Bottom