office2john - assertion error in find_table on very old word document
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
I have found very old Microsoft Word documents protected by pass (old letters). They are from years 1998-2000, so I am expecting Microsoft Office 97 format.
When I try:
python3 office2john.py letter.doc
the result is
Traceback (most recent call last):
File "/tmp/john-bleeding-jumbo/run/office2john.py", line 3151, in <module>
ret = process_file(sys.argv[i])
File "/tmp/john-bleeding-jumbo/run/office2john.py", line 3081, in process_file
stream = find_table(filename, sdoc)
File "/tmp/john-bleeding-jumbo/run/office2john.py", line 2461, in find_table
assert(w_ident == b"\xec\xa5")
AssertionError
Looks like this line https://github.com/openwall/john/blob/342364206fa9bfc129c6ef78fd2770f91e137b74/run/office2john.py#L2461 is asserting some header, but it is not there. Unfortunately, those letters are personal, so I cannot post whole file simply here.
xxd -l 208 letter.doc
00000000: d0cf 11e0 a1b1 1ae1 0000 0000 0000 0000 ................
00000010: 0000 0000 0000 0000 3e00 0300 feff 0900 ........>.......
00000020: 0600 0000 0000 0000 0000 0000 0100 0000 ................
00000030: 1f00 0000 0000 0000 0010 0000 2000 0000 ............ ...
00000040: 0100 0000 feff ffff 0000 0000 1e00 0000 ................
00000050: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000060: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000070: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000080: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000090: ffff ffff ffff ffff ffff ffff ffff ffff ................
000000a0: ffff ffff ffff ffff ffff ffff ffff ffff ................
000000b0: ffff ffff ffff ffff ffff ffff ffff ffff ................
000000c0: ffff ffff ffff ffff ffff ffff ffff ffff ................
I was looking if is something is missing (some library) or if office2john is not supporting so old office files, but no luck.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in run/office2john.py at process_file and find_table, especially the assertion around the expected header. Reproduce the failure with an old Microsoft Word document or the supplied initial hex dump, then determine the supported handling for this format. Done means the input no longer triggers an AssertionError and office2john reports an appropriate result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100