Hack into a protected Excel 2007 Sheet

September 18th, 2009 by datapig Leave a reply »

When Microsoft introduced Excel 2007, they introduced new file types - we all know them by now: xlsx, xlsm, xltx, etc. These file types are often referred to as Open XML. That's because the new file types are essentially packages that contain XML files. If you take an xlsx file and change the extension to zip, you'll be able to see all the xml documents that make up your Excel file.

The new Open XML file types come with lots of benefits. One of the major benefits is that you can change the content and properties of an Excel 2007 file simply by manipulating the XML documents that make it up.

Well, while playing with the Open XML files, I discovered that you can remove spreadsheet protection simply by applying a simple edit to the xml within the Excel file.

 

Say I have a workbook where Sheet1 is password protected. So I think to myself, "the nerve of some people - trying to keep me out of their spreadsheet".

I decide that I want to unprotect this sheet, but I don't know the password. Because this is Excel 2007, I'll hack into the xml and remove the spreadsheet protection.

Step 1: Make a backup of your file in case you really monkey it up.

Step 2: Change the file extension to zip.

Step 3: Extract the contents of the zip file.

Step 4: Go to the extracted files and navigate to the xml for the target sheet (found in the 'xl\worksheets' directory)

Step 5: Open the target sheet's xml document using an XML editor (I use a free editor called XML Marker)

Step 6: Find the 'sheetProtection' tag and remove the entire line.

Step 7: Save the edited xml document and replace the old xml document found in the original zip file.

Step 8: Change the extension back to xlsx.

Step 9: Enjoy your unprotected sheet.

That's right folks; simply removing the sheetProtection element from the xml part negates all protections placed on that sheet. Amazing, right?

A couple of notes:

  1. Any password you see in the XML file is not the real password, nor will it work if you try to use it. It's worthless.
  2. See this link to hack into a protected workbook.
  3. Do I have to even mention that this doesn't apply to any xls files?
  4. Of course, you could do this all programmatically, but this strikes me as a one-off kind of thing. So coding something up is just not worth it to me.
Advertisement

152 comments

  1. Lionel says:

    damn? it won’t work if you lost a password to OPEN spreadsheet!! tried everything but could not do it on my own. had to pay $20 to remove it with online service called http://www.password-find com. it helped in no time fortunately

  2. Chris Sandiford says:

    Struggling here..
    There is no tag in my sheet xml yet they are protected..

  3. DP says:

    I agree with “struggling here”, this ain’t working! I extracted the zip file, located the worksheet, found and removed the “worksheet protection” line, copied the saved – editted file to the zip directory where the original protected worksheet was located, changed the extension, and it is still locked!!!!!!!
    Is there a secret macro somewhere that could be mucking this sheet protection thing up??
    BTW: this is an .xlsm extension.

  4. j1an9 says:

    great bro
    me work …

  5. Prashant says:

    This not work for me

    i cant see any xml file

    just showing folders DataSpaceInfo, TransformInfo etc

    and files DataSpaceMap, Version etc.

    If any other solution then reply

  6. Cade says:

    Awesome!

  7. tijolo says:

    If you open the document in open office, remove the protection and save as word or excel (depending the case), it will work as a charm!

  8. liliandil says:

    great! thanks!!!
    for those with no xml editor, you can simply open it with notepad and remove the line with sheet protection password. just make sure you delete from “”

  9. Brundo says:

    It works, thanks a lot!!!

  10. MVB says:

    How awesome was that!

    @Lionel: If the workbook has a password, just click Save As and remove the password by using the Tools > General Options section and deleting the stars populated there.

  11. Zubair Munir says:

    Sheet Protection line is now showing in the xml, While my sheet is protected with the password properly.

  12. David C says:

    This works great!! Used Notebook to edit and WinZip to save back to zip file. Change file extension back and it works without protection. I am amazed at how little protection the passwords give!

  13. Thanks for sharing your thoughts about excel password remover download.

    Regards

  14. I hardly leave remarks, however i did some searching and wound up here Hack into a protected Excel 2007
    Sheet ? Bacon Bits:. And I do have some questions for you if you usually do not mind.
    Could it be just me or does it seem like a few of these comments come across like coming from brain dead
    folks? :-P And, if you are writing on other places, I would
    like to follow anything fresh you have to post. Could you make a list of every one of your
    communal pages like your Facebook page, twitter feed, or linkedin profile?

    my web blog – http://www.cdaa.com.au

  15. Subrato says:

    thanks Bro…..ultimate working…………..

  16. venn says:

    worked for me ^^
    tnx

  17. HaythamG says:

    I get to step 7 and I get lost. How do I replace xml file inside zip file then change extension back? The xml I edited was already inside the extracted zip file so where should I put it……….lost.

  18. datapig says:

    HaythamG:

    Step 7 assumes that you did the Step 3: Extract the contents out of the zip file.

    It sounds like you just double-clicked the file while in the zip.

    If that’s the case, you merely need to save you changes.

  19. Fahim says:

    Its not work here because when i change file extension ‘XLSX’ to ‘zip’.after that i open zip file it gives error “file is damage”

  20. Kemikal says:

    Poor explanation. it assumes one knows how to: “Step 7: Save the edited xml document and replace the old xml document found in the original zip file.” Literally makes one want to cuss in anger! How does one “replace the “old” xml document found in the ORIGINAL zip file “old” “original”?

    After I edit then save the sheet1.xml document in that folder, where do I go to replace the “old one” with this? “OLD” & “ORIGINAL” means nothing to me!

  21. Jona says:

    great Tipp, it worked for me.

    However I was even more successful by just opening a file with password protected sheets in Libre Office Version 4.0.3.3. (tested it with 2010 *.xlms files and old *.xls files). I was able to open all sheets without any restrictions.

  22. datapig says:

    Kemikal: Not sure what you mean. Other folks were able to make it work.

    Let’s see….how else can I say it.

    Save the altered XML document (the one you just changed).
    Copy the saved XML document.
    Double click into the original ZIP file.
    Navigate to the xl\worksheets directory in the zip file.
    press CTRL+V to paste. This overwrites the XML document in the zip file.

  23. Yuda says:

    Work for me….thx a lot datapig

    a bit tricky at first try, what i’ve done and work
    1. rename it into zip.
    2. extract zip file into a folder (don’t delete the original zip file).
    3. find sheet1.xml in extracted zip folder (exactly like describe above)
    4. edit the tag line (exactly like describe above)
    5. save it, and copy-paste the edited sheet1.xml file to original zip file
    6. rename the original zip file back into xlsx

    then you got your excel back without protection

  24. Lawrence says:

    Worked a charm. Thank you.

  25. Nick says:

    renamed zip file is not working … it’s pop up message that it is corrupted … Help me

  26. Will says:

    I change the .xlsx to .zip and converts it to a zip file- when I go to extract it says it’s not a valid zip file. Any idea??

  27. datapig says:

    Will: Looks like your workbook has Workbook structure protection on it; not sheet level protection. You can’t use this technique on your particular workbook.

  28. doru says:

    it work fine, thanks

  29. kirthika says:

    It doesnt work for me…
    That xml format only not visible…

  30. Nad33m says:

    How to recover XLMS excel Worksheet password in Excel 2010

    First make a copy of your target file. and open it
    goto File , Save & Send , change file type, and select excel 97 – 2003 and save it… dont worry it will ask so many things So answer them according to your wish, and of course it will mess up your file but as u have original file backup..
    Now the important part… download any demo version Excel password cracker software and recover the passwords..

    worked for like charm…

  31. Partha Chowdhury says:

    I am not seeing any xml file please give me solution.

  32. Kahar says:

    It’s work so far. Thank’s admin…

  33. Adalberto says:

    Someone has a VBA macro to “read” the contents of the password in the workbook? No wonder the password to be entered, but the recorded content. If possible, for 2003 and 2007.

  34. Adalberto says:

    Someone has a VBA macro to “read” the contents of the password in the workbook? No wonder the password to be entered, but the recorded content.

  35. Tarik says:

    It worked perfectly. Only you have to copy the edited xml files by winzip/winrar using ‘add files to archive’ command.

  36. Peter says:

    Do you know how to remove the time limit of a xlxs file?
    I have one spreadsheet that has a time lapse on it. It will stop working in 30 days. How can I remove this?

  37. datapig says:

    Peter: Sounds like the workbook has some VBA that’s shutting it down after 30 minutes. Can you look at the code? Press Alt+F11 to see it.

  38. Fernando says:

    The instruction works. However no way to replace a xml file into the original zip will. You need the password any way.
    Zip again the all the unziped files, which should contain the xml modified file into a NEW zip file. Then, change the file extension back to xml.

    It worked for me.

  39. Fernando says:

    Related to my last post.
    There is an error: say:
    “change the file extension back to xml.”
    should be: “…. back to .xlsx”
    Sorry!!

  40. Nour says:

    This process stop directly when we do the extract of the zip file !???

  41. Sivasson says:

    Worked like a charm on my *.xlsx spreadsheet. copy xml file to desktop, open with the suggested trial copy of XML marker (not free but you have 30 days) edit as directed.

  42. Jeckyl says:

    WOW… AMAZING… IT WORK.. thx for sharing ^.^

  43. Biswajit says:

    Any idea how to hack into a .PCXM file(Password Protected) ? Help! I am in a big trouble out here.
    My number is 09864354355

  44. masoud bagherpoor says:

    thank uuuuuuuuuuuuuuuuuuuuuuuuuuu
    or
    bravooooooooooooooooo

  45. nigel says:

    Excellent, worked a treat!

  46. Hello there, simply has been alert to your blog site by using The search engines, and discovered that it must be really useful. We will be careful to get brussels. I will take pleasure in whenever you continue this particular from now on. All kinds of other men and women might be achieved positive results from the composing. Regards!

  47. kaymakamsken says:

    worked, thank you so much… excellent…

  48. EL says:

    When I change the extension of the Excel file to Zip, instead of creating a file it creates a folder. I found the file no problem within the folder but when I right click it doesn’t give me an edit option.

  49. Kayam says:

    Brother i cant extract zip folder …..what is next?

Leave a Reply