strange password issue

[gchollick]

i'm able to unprotect all the worksheets in a workbook with either of two passwords. the first password we got when we used our electronic discovery software to crack the file; the second was given to us later by the originator of the file. how can this be?

[shg]

Because passwords are hashed; you can use the original, or any other word that has the same hash.

[gchollick]

thx for quick reply. both strings -- the one we got from our processing software, and the one the originator sent -- hash to different values, when i test them in an online md5hash generator.

[Zer0Cool]

To clarify are you talking about Worksheet protection and not workbook protection or password to open/modify?

Do you have a copy of the file prior to using the password cracking software? Its possible it has corrupted the underlying xml (assuming its xlsx/xlsm) leaving the tag for both hashes in.

Is the file macro enabled? Maybe a macro is allowing either password?

Normally what you describe should not be possible. My gut was same hash but thats been ruled out it seems. The only other things I can think of are corruption or macro.

[shg]

... hash to different values, when i test them in an online md5hash generator.

There are a zillion hashing algorithms.

[Zer0Cool]

There are a zillion hashing algorithms.

This too, I think xlsx/xlsm use SHA (2013 and up I beleive SHA-512, prior was SHA-1 I think) for sheet protection. If its xls then I am not sure havent had to mess with an xls for a while.