0

I had some questions about why my post was closed and I thought I would come here for answers and clarification of site rules and closing criteria.

My question,How to "unprotect" malicious workbook without knowing password was closed with the following feedback:

"Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."

And the following comment:

"Despite the context and your intent, you basically want to know how to unprotect an Excel spreadsheet without knowing the password. There are lots of approaches to this, depending on the version of Excel used. As we are not a "hacking" website, this is off-topic here."

Looking at https://security.stackexchange.com/help/on-topic it seemed as though my question fell under the category of subjects that were considered valid, specifically identifying vulnerabilities (and malware analysis, if that could be considered within InfoSec).

I know that communities determine what questions are acceptable within their own walls, without necessarily referring to an overarching document, but based on the private feedback

"... unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."

I think that my question would be suitable: I have a specific use case/problem for this knowledge, and I believe I possess an understanding of the concepts involved. I'm concerned about posting more details about my research while my question is closed since I want to avoid mod censure.

In short, how does my question fail to "... demonstrate an understanding of the concepts involved and clearly identify a specific problem."? Also, can someone link me to documentation on this closing criteria?

| |
3

The canned close reason is to prevent people from asking plain hacking questions. Things like:

  • I want to hack a site, can someone show me how?
  • I want to break into a Facebook account, how do I do that?
  • How do I root my friend's phone?

We are happy to help with the technical details, but the asker needs to explain the specific problem they are having in their process of bypassing controls. We don't just provide steps to break controls.

Your question boils down to just such a question. You have a file that does weird things and you want to inspect it further. But that's tangential context and does not affect the question. Your reasons for wanting to unprotect the file don't matter. Your question as asked is:

How do I remove the "protection" from the workbook so I can save it without knowing the password?

You have not shown an understanding of the protection mechanisms nor indicated that you've tried or understood how standard processes to crack the password on xls files work. In fact, seeing the question evolve, it's not clear if you understand what type of file it actually is. You say that you've tried crackers and they "work" but it ends up garbled. That means they did not work because the file ended up encrypted.

So, from the question asked, and the facts you've provided, this is, in essence, a "how do I hack this protected file?"

Also of note, the mods were alerted to the question by others and this wasn't a mod making this decision alone.

| |
  • The file is a MS compound file, not a zip. I know that it's possible to access the internals of the file without knowing the password because olevba can do it, but MS Office internals are not my specialty: I do disassembly and scripting languages. The first page of results were not relevant to my needs, they either depended on the file being a PK zip file, or they were VBA scripts that were supposed to unprotect the workbook while it's live. – solumnant Jan 28 at 21:23
  • I think the file is an RTF file based on it popping equation editor, but I'm not well versed in Office internals or exploits. I probably should have tried the rest of OLEtools at first, but it none of the tools yielded what I needed. – solumnant Jan 28 at 21:49
  • I also didn't say that the file was scrambled, I said I could open the file after applying some of the techniques but I couldn't save it since they corrupted the file. I should have mentioned that I tried VBA scripts and editing the file internals in a hex editor. – solumnant Jan 28 at 21:49
  • Details are useful to tell people when you are in a troubleshooting scenario. We are not mind readers, we need to know what you have tried and what you know about the file. Outputs of tools, and specifics are useful, too. It sounds like there are still more details you could be providing. As I said, as asked this is "how do I crack this file?" – schroeder Jan 28 at 23:01
  • I agree, I did get lazy with my question/rush it and it's description (SOC life :/) and it did make me sound like a scipt kiddie. I'll go ahead and update my original post when I get a chance and come back here when I'm done. If I revise the post as requested with the technical details of the file would that be sufficient to reopen? – solumnant Jan 29 at 16:13
  • I can't provide identifying information about the file itself because the file may be targeted, but that wasn't an excuse to be lazy with non-identifying information. – solumnant Jan 29 at 16:15
  • I will be happy to take a look at a new version – schroeder Jan 29 at 16:15
  • I've added additional details to my question. I found that VT actually had the answer this time, but the question still stands since I need to be able to do my job if the file isn't already in the public domain. – solumnant Jan 29 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .