How to crack a dBase file password?

Asked 18/5, 2011 at 12:54 Answered 27/5, 2011 at 17:0

I've inherited a bunch of dBase (.dbf) files from a legacy application, and I need to import the data into MS SQL or MS Access. I know these programs have built in "import" functions, but the dBase files are protected with a password, which nobody around here seems to know.

Anyone know of any way around the password, or of cracking the password?

(Edit: added C# tag bc that's the language I'll likely use for any programmatic solution)

Bounty awarded: I don't really have a good solution yet, but it's only 2 hours till the bounty closes, so I guess I should award it to the most useful answer thus far. And in that respect, I think the $75 paid solution is probably the most time and energy efficient, even if it doesn't give me the intellectual satisfaction of cracking it myself! :)

I'm going to leave the question "unanswered" for the meantime, until I see if any of the solutions actually work...

Myrlemyrlene answered 18/5, 2011 at 12:54 Comment(6)

Are the files currently in use or are they just archives? – Outherod 18/5, 2011 at 19:39

What is the source of these files, do they come from FoxPro? How are the files encrypted? – Outherod 20/5, 2011 at 22:6

They are from 3rd party software that my client has installed. My client wants me to export the data from this program into a SQL database. I have no idea what kind of encryption the 3rd party vendor used; all I know is that the files are .dbf, and when I try open them using MS Access, it asks me for a password... – Myrlemyrlene 22/5, 2011 at 8:32

If this is still unsolved, can you look into the dBase file (in a HEX editor as Jeff suggested) and glean any details whatsoever? The dBase file format is pretty basic, but it depends on the version you are using. Having written some code related to reading and writing basic dBase files (version 4, I believe), I remember the format being incredibly basic and it looks like the dBase version 7 format is just as basic. This is for dBase version 3-5. – Feoff 29/5, 2011 at 3:37

Just out of curiosity, how did this end up working out for you? – Sisterly 12/4, 2013 at 18:18

@Sisterly - Never managed to find a solution. The project got canned anyway... :-/ – Myrlemyrlene 14/4, 2013 at 6:53

There is probably a way around the password, and there is certainly a way to brute force access if the password cannot be bypassed. One site offers the a tip about changing certain binary data within your file using a hex editor to disable password protection: http://www.antionline.com/archive/index.php/t-218086.html. Test that on a copy.

It is still not wholly uncommon to see instances where an application respects a security setting, but the security is not particularly relevant. Cases would include where the file has a flag designating protection, but the data is not actually encrypted. If the above doesn't solve your problem, open the file in a hex editor and see if information is recognizable in plain text.

If that doesn't work, I'd suggest grabbing a copy of John the Ripper and writing some bridge code to use the output of JTR's guesses as input for a dbase library's open calls.

Cartierbresson answered 18/5, 2011 at 15:32 Comment(1)

Thanks @Jeff. The link is for MS Access, not dBase. There are much easier ways of cracking MS access passwords, e.g. mustap.com/databasezone_post_165_crack-access-databases – Myrlemyrlene 19/5, 2011 at 7:29

Just found this: http://www.pwcrack.com/dbase.shtml

They want $75 for cracking a dBase password, website seems legitimate.

(I am not affiliated)

Pietro answered 26/5, 2011 at 13:2 Comment(7)

+1 Very useful - which tells me that there has got to be a way to do this without paying $75. – Myrlemyrlene 26/5, 2011 at 13:14

Maybe Mr Weiss linkedin.com/pub/robert-weiss/4/88a/b92 tells you, but I fear he wants to keep his tricks to himself ;) – Pietro 26/5, 2011 at 13:42

@Pietro & @Philip - unless it's $75 per dbf file, in which case the time & effort start looking a lot more attractive... each dbf file is just one table, and there's a whole database to decode! – Myrlemyrlene 27/5, 2011 at 8:26

In this case maybe you contact them as told on pwcrack.com/instructions.shtml as for example on MDBs they "are quoted individually based on format and size." Chances are you will get an individual quote on the whole bundle of your dBase files. – Pietro 27/5, 2011 at 12:36

@shaul does each dbf have it's own individual password? – Ordinand 29/5, 2011 at 5:37

Bounty awarded - though I can't as yet vouch for the efficacy of the proposed solution - see edit to my question. – Myrlemyrlene 29/5, 2011 at 6:31

Thx @Shaul, would be really nice if you update us how you worked it out in the end – Pietro 30/5, 2011 at 7:54

Cain and Abel may be useful. It is free.

Ephor answered 27/5, 2011 at 17:0 Comment(0)

Recommended topics

Hot tags