• VBA passwords are recovered instantly, regardless of the password length. Apasscracker supports Microsoft Office 95 to 2013, but only for Excel, Powerpoint and Word. Now, both of these programs do a great job at being able to get through VBA passwords.
• Protect Excel VBA code and lock VBA project, Unviewable VBA. By default, Microsoft Excel offers VBA project password protection as a way to protect VBA code. This method of VBA code protection is weak and can be easily cracked. The DoneEx XCell Compiler provides a much better and much stronger solution to protect your VBA code from being stolen.

Cracking VBA Project Passwords

VBA projects can be protected with a password. The password is not used to encrypt the content of the VBA project, it is just used as protection by the VBA IDE: when the password is set, you will be prompted for the password.

Tools like oledump.py are not hindered by a VBA password, they can extract VBA code without problem, as it is not encrypted.

This advance utility is capable to unlock VBA project excel quickly, and from any type of file i.e.xlam,.xls,.doc, etc. Apart from this, it is a brilliant tool which eliminates the old lost or forgotten VBA password of any length and rests a new password. I recently needed to unlock an Access VBA Project for which my client had lost the password. I was surprised to find that there was an incredibly simple hack that can unlock any Access password protected VBA project and I figured I’d share in case it could help others. Make a copy of the database in question and only work with the copy. If you just want to unprotect excel worksheet after forgot sheet password, this freeway is worth trying. Step 1: Open VBA. Open the worksheet you forgot password to unprotect. Then enter Macro editor with Alt +F11. In VBA project, double click the sheet you need to unprotect from the menu listing in the left or on the top.

The VBA password is stored as the DPB value of the PROJECT stream:

Password Protected Vba Project

You can remove password protection by replacing the values of ID, CMG, DPB and GC with the values of an unprotected VBA Project.

Thus a VBA password is no hindrance for staticanalysis.

However, we might still want to recover the password, just for the fun of it. How do we proceed?

The password itself is not stored inside the PROJECT stream. In stead, a hash is stored: the SHA1 hash of the password (MBCS representation) + 4 byte salt.

Unlock Password Protected Vba Project

Then, this hash is encrypted (data encryption as described in MS-OVBA 2.4.3.2) and the hexadecimal representation of this encrypted hash is the value of DPB.

Crack Vba Project Password

This data encryption is done according to an algorithm that does not use a secret key. I wrote an oledump.py plugin (plugin_vbaproject.py) to decrypt the hash and display it in a format suitable for John the Ripper and Hashcat:

The SHA1 of a password + salt is a dynamic format in John the Ripper: dynamic_24.

For Hashcat, it is mode 110 and you also need to use option –hex-salt.

Remark that the password passed as argument to the SHA1 function is represented in Multi Byte Character Set format. This means that ASCII characters are represented as bytes, but that non-ASCII characters might be represented with more than one byte, depending on the VBA project’s code page.