I have a password protected presentation file (MS office 2003).
My assignment required me to either remove the password or find it.
In my research i found out that presentation use ntlm and/or nt hashes. I also found out that office2john looks like the tool for the job.
Now my questions: How office2john extract the hashes? Where are they in the file? Can you explain to me where are they located? Or can you point me to some documentation that explain it?