Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.


Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.


Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.


Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Security

Using JTR to Crack Office Documents

Submitted by on April 22, 2016 – 5:35 pm

John the Ripper is a free multi-platform password-cracking software. This article is not intended to be a comprehensive guide to jtr, rather a quick how-to. Starting with version 1.7.9, jumbo patch 6, jtr supports password recovery for Office 2007/2010. In the example below, I will compile jtr from source with OpenMP support to take advantage of a multi-CPU server running CentOS 6.

Install OpenMP support and some useful performance-monitoring tools:

yum -y install openmpi openmpi-devel htop nmon openssl openssl-devel

Download and compile jtr version 1.7.9, jumbo patch 7:
cd /tmp
tar -xvzf john-1.7.9-jumbo-7.tar.gz
/bin/mv john-1.7.9-jumbo-7 /opt/john
/bin/rm john-1.7.9-jumbo-7.tar.gz
cd /opt/john/src

vi Makefile
# Uncomment "OMPFLAGS = -fopenmp" and "OMPFLAGS = -fopenmp -msse2"

make clean linux-x86-64

Install jtr from standard CentOS repo and copy some missing files:
yum -y install john
rsync -av /usr/share/john/ /opt/john/
vi /etc/john.conf
# Comment out: .include <dynamic.conf>
cd /opt/john
/opt/john/run/john |grep ^John
/opt/john/run/john --test

# Run htop in another window to verify that all CPUs are being utilized

# Adjust number of threads:
OMP_NUM_THREADS=4 /opt/john/run/john --test

Install office2john Python script to extract hashes from Office files:
mkdir -p /var/adm/bin
wget --no-check-certificate -q -O /var/adm/bin/
chmod 755 /var/adm/bin/
ln -s /var/adm/bin/ /usr/bin/office2john

Process an Office file:
office2john /var/tmp/your_file.xlsx | awk -F: '{print $2}' > /var/tmp/your_file.hash
cd /opt/john/run
/opt/john/run/john /var/tmp/your_file.hash &disown
/opt/john/run/john --status


Print Friendly, PDF & Email

Leave a Reply