Estate Planning of Credentials

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://pentestpartners.com/security-blog/estate-planning-of-credentials
• Blog Title: Estate Planning of Credentials
• Suggested Section: Generic Hacking > Brute Force - CheatSheet, with a cross-reference from Basic Forensic Methodology > Specific Software/File-Type Tricks > Office file analysis

🎯 Content Summary

Recovering an encrypted Excel credential store through targeted offline password cracking

The post documents an authorized password-recovery operation against an encrypted Excel spreadsheet belonging to a deceased technology enthusiast. The spreadsheet contained unique passwords for critical accounts, smart-home systems, and other infrastructure, but the family did not know its master password. This is not a CVE or a cryptographic break in Microsoft Excel: recovery succeeded by extrac...

🔧 Technical Details

Convert encrypted documents into offline password targets: When an attacker obtains an encrypted Microsoft Office file, a parser such as office2john can extract the document's password-verification material for use by John the Ripper or Hashcat. The encryption itself is not bypassed; password candidates are generated, processed according to the document format, and compared with the extracted verifier. Because all work happens locally, online protections such as MFA, lockout, throttling, and authentication monitoring do not limit the attack.

Model passwords as grammars rather than arbitrary strings: A password that is impractical to brute-force character by character may be easy to enumerate when its construction is known. Intelligence from recovered passwords, password hints, organizational policies, leaks, or people familiar with the user can reveal a structure such as <word><number><optional punctuatio...

🤖 Agent Actions

Implemented the HackTricks update.

Modified

• src/generic-hacking/brute-force.md
  • Added Office hash extraction with office2john.py.
  • Documented format-specific Hashcat modes.
  • Added grammar-driven dictionary generation and combinator attack workflow.
  • Added numbered citations and references.
• src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md
  • Added an internal cross-reference to the recovery workflow.

Validation

• git diff --check passed.
• Internal link and generator script verified.
• Reference URLs responded successfully.
• No forbidden sources added.
• mdbook was unavailable, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://pentestpartners.com/security-blog/estate-planning-of-credentials

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking > Brute Force - CheatSheet, with a cross-reference from Basic Forensic Methodology > Specific Software/File-Type Tricks > Office file analysis".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0