Session..........: hashcat
Status...........: Exhausted
Hash.Type........: MS Office 2010
Hash.Target......: $office$201010000012816*[removed]
Time.Started.....: Sat Apr 18 09:05:24 2020 (3 mins, 35 secs)
Time.Estimated...: Sat Apr 18 09:08:59 2020 (0 secs)
Guess.Base.......: File (merged.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 92589 H/s (2.67ms) @ Accel:256 Loops:128 Thr:64 Vec:1
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 19922208/19922208 (100.00%)
Rejected.........: 0/19922208 (0.00%)
Restore.Point....: 19922208/19922208 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:99968-100000
Candidates.#1....:
Hardware.Mon.#1..: Temp: 74c Fan: 55% Util: 89% Core:1949MHz Mem:5508MHz Bus:8
Started: Sat Apr 18 09:05:07 2020
Stopped: Sat Apr 18 09:09:00 2020
At work, someone of importance wanted access to a password protected file from an employee that left. I ran it through several wordlists to demonstrate an attempt was made and shared the cost/time required for 100% recovery. Never solved it and the cost/time analysis was enough to make them say oh well!
[0] https://en.m.wikipedia.org/wiki/Microsoft_Office_password_pr... [1] https://en.m.wikipedia.org/wiki/Key_stretching [2] https://hashcat.net/wiki/doku.php?id=example_hashes
75 giga hashes per second for ntlm.