I had been previously asked to crack passwords for Microsoft Office Word files and was able to do so on some older versions < 2007 because of the weak hashing algorithms. To do that, I used tools found in Kali Linux to retrieve the hash and run it against a word list.
In this new scenario, I was asked to remove the sheet protection from an Excel workbook. The Excel workbook could be opened and viewed, but could not be edited without unlocking the sheets using a password.
Because there was no password protecting the document from being opened, I could not resort to my first method of password cracking.
The following method I used to unlock password protected Excel spreadsheets comes from this tutorial by ExcelSuperSite: http://www.excelsupersite.com/how-to-remove-an-excel-spreadsheet-password-in-6-easy-steps/
This tutorial by Brian Krisanski was simple and easy to follow. I had a single misstep which caused the copies of my file to corrupt, but I found the problem which I will explain in my write up.
If you want to view the entire tutorial, please visit his post at: http://www.excelsupersite.com/how-to-remove-an-excel-spreadsheet-password-in-6-easy-steps/
My post will be a brief overview with a solution to a problem I had.
Step 1
Make a copy of your original file and work on the copy. This should go without saying, but always make copies and backups before you do anything that might corrupt a file of any kind.
Step 2
Ensure you have (or download if you don’t) a file compression software like 7-Zip which is what we used.
Rename the file extension from .xlsx to .zip
Step 3
DO NOT UNZIP the contents! Enter into the zipped folder through 7-Zip. Navigate to the xl folder and then to the worksheets folder.
Inside the worksheets folder, you will see .xml files of each of your sheets in the workbook.
This is where I made my original mistake.
Using 7-Zip, Copy those original files outside to another directory or your desktop so you can edit them. I edited the files within the zipped folder and my spreadsheet was corrupted. Make copies and bring them outside.
Step 4
Open a text editor like Notepad, Atom, or Sublime Text to see the contents of each .xml file. In the .xml file, you will see a single tag that looks like this (with the hashValue and saltValue being different for you). It is found near the bottom of the file.
< sheetProtection algorithmName="SHA-512" hashValue="NZjuCK43FilmgSqO3koaNEMoEEns4ZeRG9dCx52qXcT+O0h4/wOhwUbKXuo+bE6IHrNE0CTIVhFhpbW+p85qUA==" saltValue="Gg+1Rdrt9MS24uz+heHBzQ==" spinCount="100000" sheet="1" objects="1" scenarios="1"/ >Once you find this <tag>, simply delete it from the file. Don’t delete anything else except this one tag.
Step 5
Save your edited .xml files in your outside directory. Selecting all the files, simply drag and drop them over the 7-Zip folder interface and it will ask you to overwrite. Choose yes to overwrite the files within the zipped folder.
This is the crucial part that you are not supposed to extract any files. You simply copy out and paste edited content back in. Do not extract anything.
Step 6
Once you paste the edited files back into the zipped folder, you can close the 7-Zip interface.
Now change the file extension back to .xlsx from .zip and you should be able to open the spreadsheet without any protection or password.
Conclusion
This process worked for me in June 2019 using Office 365 Excel, latest version. It was simple and straightforward.
I use Sublime Text 3 as my text editor and the color-coded text and search features made it simple for me to find the tag. If you are using Windows Notepad, you might have a more difficult time finding the sheetProtection tag. Start at the bottom of the file and work up to find it quicker.