The OOXML specification for hashValue says 'This value shallīe compared with the resulting hash value after hashing the user-supplied password # 7YpVVKy6la5CEYWmfbUbF6BFgeopeT/Uh52as+I+NVYqFRqVFvSUWfdCP1J5dUGeWB圓cJHan+i/IZieabrGGw= # L69ms0LAD5mz5M8RdRtcn1UTSXWSfX9YI9hK9mPW1n4eW6I8ilTLi6el6LafMj2RVsxjg2aumqSeIfFk25drVw= This doesn't produce the right answer with what you posted, though: # 5l3mgNHXpWiFaBPv5Yso1Xd/UifWvQWmlDnl/hsCYbFT2sJCzorjRmBCQ/3qeDu6Q/4+GIE8a1DsdaTwYh1q2g= Result = hash(result + struct.pack('is designed for encrypted files, not files that just have an easily-removable snake-oil protection field. I followed the instructions in john/doc/INSTALL-UBUNTU which explicitly tell how to grab the bleeding distribution they're probably a good starting point for Kali (although the names of some prerequisite packages may differ). 'Run the latest bleeding edge' is a standard prescription for fixing issues with John the Ripper. Use the '-show' option to display all of the cracked passwords reliably Press 'q' or Ctrl-C to abort, almost any other key for statusĪlmost done: Processing the remaining buffered candidate passwords, if any.ġg 0:00:00:00 DONE 2/3 ( 16:44) 20.00g/s 1298Kp/s 1298Kc/s 1298KC/s frodo.barbara Warning: OpenMP is disabled a non-OpenMP build may be faster I experienced the same error as you with john 1.8.0 but when I downloaded the latest bleeding edge release from Github (1.9.0-jumbo-1+bleeding-d29f456a4 ) I was able to crack the same file: $. You need to update to the latest John the Ripper.

John the ripper linux password