Link to home
Start Free TrialLog in
Avatar of bolox
bolox

asked on

HELP!!! 300 Points up for grabs

i have taken over as an IT manager in a small travel company, and the IT guy that left thought it was funny to add restrictions to an access database called say database.mdb, on running this file it says the usual "you do not have permission to view this dastabae please contact the admnistrator, "
it will not let me see a thing.
is there anything i can do.
HELP!!!!
Avatar of gyoungAnstar
gyoungAnstar

There's a bunch of pieces to this.  
1. If you are not connected to the correct Workgroup Information File (such as system.mdw), you won't get anywhere.  Try running a search for *.mdw and see what files are available.

2. If you don't have a username and password with permissions, things are going to be really difficult even if you are connected to the correct .mdw file.

3. You could look around on the old IT guy's machine and others for shortcuts to the file.   Any of these may have UID and PWD info included in the shortcut command.  A long shot perhaps, but worth looking.

If all else fails, PKSolutions is a company that specializes in recovering Corrupt mdb files, and files where the password is lost.  Look them up on the web at http://www.pksolutions.com/services.htm
from a module in another database...run the following function:

Public Function GetMDBPassword(sDBName As String) As String
    Dim hFile As Integer
    Dim ich As Integer
    Dim stBuffer As String
    Dim rgbytRaw() As Byte
    Dim rgbytPassword() As Byte
    Dim rgbytNoPassword() As Byte
     
    rgbytNoPassword = ChrB(134) & ChrB(251) & ChrB(236) & ChrB(55) & ChrB(93) & _
                                ChrB(68) & ChrB(156) & ChrB(250) & ChrB(198) & ChrB(94) & _
                                ChrB(40) & ChrB(230) & ChrB(19) & ChrB(182) & ChrB(138) & _
                                ChrB(96) & ChrB(84) & ChrB(148) & ChrB(123) & ChrB(54)
                                 
    hFile = FreeFile
    Open sDBName For Binary As #hFile
    Seek #hFile, 66 + 1
    rgbytRaw = InputB(20, #hFile)
    Close #hFile
     
    ReDim rgbytPassword(0 To 19)
    For ich = 0 To 19
        rgbytPassword(ich) = rgbytRaw(ich) Xor rgbytNoPassword(ich)
    Next ich

    stBuffer = StrConv(rgbytPassword, vbUnicode) & vbNullChar
    GetMDBPassword = Left$(stBuffer, InStr(1, stBuffer, vbNullChar, vbBinaryCompare) - 1)
End Function



you should have the admin password then....when you then open up the db make sure you open it as admin
Avatar of Guy Hengel [angelIII / a3]
That password hack is genius code!!!

He, he, he, he...
I wish I could take credit for it
Check out the topic area!
Hello MikeRenz, who's is the original author of the code?
Avatar of bolox

ASKER

just going to test it tonight, if all is well in the morning you will get the 300 points MikeRenz.

Ta Matey
paasky,
  I'm not sure who the original author is or I would include that.  I do know that I got the code from another thread here on EE, who also said they weren't the originating author.
About password cracking:

This code is fine, but I'm afraid it will not work with Acc2000, because Acc2000 uses longer passwords (40 bytes). It is a result of Unicode.
I've modified a very similar code (in C) to work with Acc97 and Acc2000.
(I'm using Visual C++ 6.0)

Here it is:


// Original code downloaded from http://www.rootshell.com/

// ------------------------------------------------------- //
// "Decrypt" Microsoft Access 97 Database Passwords
//
// Nate Lawson <nate@root.org>
// 2/9/99
//
// XOR sequence taken from a post by Adam Shosthack <adam@homeport.org>
// Access 97 actually allows a user to enter a 14 char password, although
// only the first 13 chars are stored and verified.
// ------------------------------------------------------- //

// Modified by Krzysztof Czurylo
// 08 March 2000
// to use both with MS Access 97 and MS Access 2000


#include <stdio.h>
#include "stdafx.h"
#include <tchar.h>


int main (int ac, char *av[])
{
    FILE *fp;
    int i;
    unsigned char passBuf[42];
    unsigned char xorString97[] =
      { 0x86, 0xFB, 0xEC, 0x37, 0x5D, 0x44, 0x9C, 0xFA, 0xC6, 0x5E,
      0x28, 0xE6, 0x13, 0xC4 };
    unsigned char xorString2K[] =
    { 0x77, 0x75, 0xEC, 0x37, 0xAC, 0xCA, 0x9C, 0xFA, 0x37, 0xD0,
      0x28, 0xE6, 0xE2, 0x38, 0x8A, 0x60, 0xA5, 0x1A, 0x7B, 0x36,
      0x04, 0xFC, 0xDF, 0xB1, 0x86, 0x7A, 0x13, 0x43, 0x3E, 0x21,
      0xB1, 0x33, 0xC5, 0xEF, 0x79, 0x5B, 0x63, 0x3B, 0x7C, 0x2A };

    if (ac != 3) {
        fprintf(stderr, "Usage: %s {97|2K} filename.mdb\n", av[0]);
        return(1);
    }

    /* Open file, read password into buffer */
    if ((fp = fopen(av[2], "rb")) == NULL) {
        fprintf(stderr, "Unable to open %s\n", av[2]);
        return(1);
    }
    if ((fseek(fp, 0x42, SEEK_SET)) < 0) {
        fprintf(stderr, "Unable to seek.  File truncated?\n");
        return(1);
    }
    if ((fread(passBuf, sizeof(passBuf) - 1, 1, fp)) < 0) {
        fprintf(stderr, "Cannot read file: %s\n", av[2]);
        return(1);
    }

    /* Unmask password and print out results */
    if (!strcmp(av[1],"97"))
    {
      for (i = 0; i < 14; i++)
          passBuf[i] ^= xorString97[i];
      passBuf[14] = '\0';
      printf("Password is:\n   %s (ascii)\n   ", passBuf);
        for (i = 0; i < 14; i++)
      printf("0x%x ", passBuf[i]);
      printf("(hex)\n");
    }
  else
    {
      for (i = 0; i < 40; i++)
        passBuf[i] ^= xorString2K[i];
      passBuf[40] = '\0';
      passBuf[41] = '\0';
      printf("Password is:\n   %S (ascii)\n   ", passBuf);
      for (i = 0; i < 40; i++)
        printf("0x%x ", passBuf[i]);
      printf("(hex)\n");
    }
    return(0);
}




MikeRenz, original author must have got inside-information...

krzycz, nice piece of code. =)

That code works very well...

I am now a little concerned about the security of my databases.  



Bolox:  Did the old IT manager use an mdw file to cause this trouble, or are you just using a password on the database?

Everyone:  Does code exist to do the same to .mdw files?  
Oh, no!!!
It's so easy ONLY for database password not when using mdw files (user accounts and passwords)!!!

But there is also a program "GetAccess" which can crack user protected databases, but it doesn't reveal user passwords, just give all permissions to all users. It doesn't crack _encrypted_ databases!!!
Demo can crack databases not bigger than 500KB.

And there's also a program which can reveal user passwords from mdw file. Very strong crack tool!!!
Demo reveals only two first chars of the user password with given id.

Yes, MS Access databases are not absolutely safe!!! :-(((


I would be interested in testing my databases with the program krzycz was discussing (assuming it is a legal program!).  Where can the demo be found, or does any one have any idea how this is being accomplished?  Perhaps I could write my own code to crack my security!

Oh well, this has been a very interesting discussion...
Here's more fun stuff...


/*
 * "Decrypt" Microsoft Access 97 Database Passwords
 *
 *
 *  
 * Access 97 actually allows a user to enter a 14 char password, although
 * only the first 13 chars are stored and verified.
 */

#ifdef WIN32
#include <windows.h>
#endif
#include <stdio.h>

main (int ac, char *av[])
{
    FILE *fp;
    int i;
    unsigned char passBuf[14], xorString[] = { 0x86, 0xFB, 0xEC, 0x37,
        0x5D, 0x44, 0x9C, 0xFA, 0xC6, 0x5E, 0x28, 0xE6, 0x13 };

    if (ac != 2) {
        fprintf(stderr, "Usage: %s filename.mdb\n", av[0]);
        exit(1);
    }

    /* Open file, read password into buffer */
    if ((fp = fopen(av[1], "rb")) == NULL) {
        fprintf(stderr, "Unable to open %s\n", av[1]);
        exit(1);
    }
    if ((fseek(fp, 0x42, SEEK_SET)) < 0) {
        fprintf(stderr, "Unable to seek.  File truncated?\n");
        exit(1);
    }
    if ((fread(passBuf, sizeof(passBuf) - 1, 1, fp)) < 0) {
        fprintf(stderr, "Cannot read file: %s\n", av[1]);
        exit(1);
    }

    /* Unmask password and print out results */
    for (i = 0; i < sizeof(passBuf) - 1; i++)
        passBuf[i] ^= xorString[i];
    passBuf[sizeof(passBuf) - 1] = '\0';

    printf("Password is:\n   %s (ascii)\n   ", passBuf);
    for (i = 0; i < sizeof(passBuf) - 1; i++)
        printf("0x%x ", passBuf[i]);
    printf("(hex)\n");

    exit(0);
}


One day I may need this.




Avatar of bolox

ASKER

just going to test it tonight, if all is well in the morning you will get the 300 points MikeRenz.

Ta Matey
Avatar of bolox

ASKER

great resp[onses guys (and gals if you are?)  i wish i could split up the points because you all deserve them for your speedy and very helpful answers
Avatar of bolox

ASKER

mike i have made the module, but it will not run, the run button i greyed out, (sorry to be dumb i have never used modules)
bolox,
  open up the immediate window (ctrl-g) and just type in :


? GetMDBPassword("c:\path to your mdb")


Avatar of bolox

ASKER

i just get garbage on thje screen after pressing enter.
bolox,

I have an application that I can send to you via email that implements MikeRenz code.  It works very well.
One day I may need this too... "Just listening"... ROFL!
"I am now a little concerned about the security of my databases."
and
"Yes, MS Access databases are not absolutely safe!!!"

Just earlier today I told a client that this is only one of a few valid reasons for developing in VB vs Access...

(Uh-oh, I feel another war coming on... Hope there ain't none of them VB guys in here...)
believer,
  I'm an avid fan of vb front-ends....but access is just so damn cheap!
$ to develop in Access, $$$ in VB, $$$$$$$$$$$$$$$$$$ in C


Decision ----> $
Avatar of bolox

ASKER

tnewc59 my email is gavin@commodore.co.uk

ta matey

ozphil: You hit it right on the head.  Recently found out that my former employer has instructed the co-workers I left behind that they they are to direct all new projects towards VB instead of Access.  What a lame brain.  S'okay, more work for me, and less competition!!
Access requires special skills and experience developed over a long period which a lot of VB people haven't acquired. VB takes longer but doesnt require the same innovative ability as an Access programmer.

I've always wanted to make this statement lol.





LOL!
That can be read a couple different ways (and might even be true in all of them).
  - VB is more intuitive than Access.
  - VB is easier for inexperienced "hack" developers to pick up (which makes maintenance a nightmare for those of us who are "structured" developers)
  - others?
ozophil,
   what do you think that access requires that vb does not?  special work arounds so that it doesn't crash and so it works as it should?  I don't see how anyone can truely say that access is a better development platform in any way.  Its a database first.

believer,
  how do you think vb is easier than access to pick up?  
Uh-oh, I feel a war coming on... <g>

brb... I'm going to see if I can dig up an old Q on this topic instead of spending time on it here...
Ah yes, here it is:
https://www.experts-exchange.com/jsp/qShow.jsp?ta=msaccess&qid=10316893 

That was a few months ago and I didn't take the time to re-read it and see if I need to re-think anything I said, but it's a good starting point.  Might be a good idea to resume this discussion over there, too, just to keep from cluttering up this thread...
Interesting page Believer :).

I'm just dying to do a front end in VB -i'm just too intelligent to justify it lol.
no where else to post this...don't feel like starting a thread...but I just found another interesting quirk/bug/nuance of Access (97 anyway)

in code of a form I had this line:

   currentdb.execute "SELECT * FROM [my table].[id] where [my table].[id]=5;"


looks fine if you glance over it real quick, but notice that FROM portion.  The .[id] in there cuases access to look for a database called "my table.mdb" in "c:\my documents\" (I assume to find a table in it called [id])

Has anyone else ever seen this?  Is this normal/supposed to happen?
Strange I just tried it and looks for my table.mdb in the same directory as the the application. Yuu wouldnt want to use [my table].[id]  for a table name anyway would you?
news to me.
From: MikeRenz
>in code of a form I had this line:

>   currentdb.execute "SELECT * FROM [my table].[id] where [my table].[id]=5;"
>
>
>looks fine if you glance over it real quick, but
>notice that FROM portion.  The .[id] in there
>cuases access to look for a database called
>"my table.mdb" in "c:\my documents\" (I assume
>to find a table in it called [id])

The "C:\My Documents" should be coming from your Default Directory, as configured in Access (Tools / Options)

The problem is not a bug in Accesss, it is a logical error in your SQL Statement. The FROM clause is expecting you to name a table or query. However, you are giving it a name of a *FIELD* instead (.[id]); so, the Jet DB Engine is trying to make sense of your "table name" the best it can.

The SELECT statement *should* read:

  SELECT * FROM [My Table] WHERE [My Table].[ID]=5

cool catch!
Incidently, as a side note, when you are composing a SQL statement, it is not necessary to specify the table/query name that the field belongs to, unless the field name by itself is ambiguous.

So the SQL I listed above could also read:

   SELECT * FROM [My Table] WHERE [ID]=5;
OR
   SELECT * FROM [My Table] WHERE ID=5;

Now, if you were joining two or more tables/queries, and the fields by that name appear in two or more tables/queries, then you must use the table name to clarify the ambiguity.

For example, if [My Table] and [My Other Table] *both* contained a field by the same name (e.g. ID), then we would have to use the table name to specify which field (both named 'ID') we're referring to.

Hi bolox, what's the status here?
this doesn't look so good...
Dear bolox, if you got the answer, please accept the propriate comment as answer. If not, then delete this question or you lose all 300 QP's when Auto-Deletion kicks this into eternity after 21 inactive days - or ask CS to refund the points and move this question to PAQ with zero points.

Regards,
paasky

Or autodecrement the askers EE points by 50 points/day until the points reach 0, at which time the member himslef is autodeleted from the system.

....or is discarding chaff not good for sponsorship revenue.
Where we at with this Q?
Looks like Bolox has left the building
Avatar of bolox

ASKER

sorry for the LOOOOOONNNNNNGGGGGGGG  delay getting back everyone.

I am sorry but i cannot decide who the points should goto. I have come to a conclution.

I am out of the UK for a week and when i get back i will check this question again, The person that sends in the best joke will get the full 300 points

Hows that

G
I'm game - I'll have to loko through my archives.
However... if/when EE gets wind of this, it may get shot down and/or un-answered.  I tried to award points to someone for a good idea they had and EE stepped in an un-awarded the points, referring to the Q as something like "inappropriate."  Grrr...  Try to reward someone for a job wel done and that's the thanks you get from Big Brother. >8^[
Tight Skirt
In a crowded city at a crowded bus stop, a beautiful young woman was waiting for the bus. She was decked out in a tight leather miniskirt with matching tight leather boots and jacket.

As the bus rolled up and it became her turn to get on, she became aware that her skirt was too tight to allow her leg to come up to the height of the first step on the bus.

Slightly embarrassed and with a quick smile to the bus driver she reached behind her to unzip her skirt a little thinking that this would give her enough slack to raise her leg.  Again she tried to make the step onto the bus only to discover she still couldn't!

So, a little more embarrassed she once again reached behind her to unzip her skirt a little more and for a second time attempted the step and once again, much to her chagrin she could not raise her leg because of the tight skirt.

So, with a coy little smile to the driver she again to unzip the offending skirt to give a little more slack and again was unable to make the step. About this time the big Texan that was behind her in the line picked her up easily from the waist and placed her lightly on the step of the bus.

Well, she went ballistic and turned on the would-be hero, screeching at him, "How dare you touch my body!! I don't even know who you are!"

At this the Texan drawled, "Well ma'am normally I would agree with you but after you unzipped my fly three times, I kinda figured that we was friends."
TO WOMEN EVERYWHERE FROM MEN WHO'VE HAD ENOUGH

Learn to work the toilet seat. If it's up, put it down.

Birthdays, Valentines, and Anniversaries are not quests to see if we can find the perfect present yet again!

If you ask a question you don't want an answer to, expect an answer you don't want to hear.

Sometimes we're not thinking about you. Live with it. Don't ask us what we're thinking about unless you are prepared to discuss such topics as navel lint, the shotgun formation, or monster trucks.

Sunday equals sports. It's like the full moon or the changing of the tides.   Let it be.

Shopping is not a sport, and no, we're never going to think of it that way.

When we have to go somewhere, absolutely anything you wear is fine.

Really! You have enough clothes. You have too many shoes.

Crying is blackmail.

Ask for what you want. Let's be clear on this one. Subtle hints don't work. Strong hints don't work. Really obvious hints don't work.  Just say it!

No, we don't know what day it is. We never will.  Mark anniversaries on the calendar.

Peeing standing up is more difficult.  We're  bound to miss sometimes.

Most guys own three pairs of shoes. What makes you think we'd be any good at choosing which pair, out of thirty, would look good with your dress.

Yes and no are perfectly acceptable answers to almost every question.

Come to us with a problem only if you want help solving it.  That's what we do.

Sympathy is what your girl friends are for.

If you think you're fat, you probably are. Don't ask us. We refuse to answer.

A headache that lasts for 17 months is a problem. See a doctor.

Foreign films are best left to foreigners.

Check your own damn oil.

It is neither in your best interest or ours to take the quiz together.   No, it doesn't matter which quiz.

If you won't dress like the Victoria's Secret girls, don't expect us to act like soap opera guys.

Anything we said six months ago is inadmissible in an argument.

ALL comments are null and void in 7 days.

If something we said can be interpreted in two ways, and one of the ways makes you sad or angry, we meant the other one.

Let us ogle. We're going to look anyway, it's genetic.

You can either tell us to do something OR tell us how to do something, but not both.

Whenever possible, please say whatever you have to say during commercials.

ALL men see in only 16 colors. Peach is a fruit, not a color.

If it itches, it will be scratched.

If we ask what's wrong and you say "nothing," we will act like nothing's wrong. We know you're lying, but it's just not worth the hassle.
Top 10 Reasons....
...... To Go To Work Naked!

1. Your boss is always yelling, "I wanna see your ass in here by 8:00!"

2. Inventive way to finally meet that special person in Human Resources.

3. "I'd love to chip in, but I left my wallet in my pants."

4. To stop those creepy guys in Marketing from looking down your blouse.

5. You want to see if it's like the dream.

6. You can make cool farting noises on those vinyl-covered chairs

7. People stop stealing your pens after they've seen where you keep them.

8. Diverts attention from the fact that you also came to work drunk.

9. Gives "bad hair day" a whole new meaning.

10. No one ever steals your chair.
This one ain't a joke, but sure is funny... I re-typed it from a newspaper article:

A man from Charlotte, North Carolina, having purchased a case of very expensive cigars, insured them against, among other things, fire.  Within a month, having smoked his entire stockpile, the man filed a claim against the insurance company, stating that the cigars were lost "in a series of small fires."
The insurance company refused to pay, citing the obvious reason that the man had consumed the cigars in the normal fashion.  The man sued - and won.
In delivering the ruling the judge, agreeing that the claim was frivolous, stated nevertheless that the man held a policy from the company in which it had warranted that the cigars were insurable and also guaranteed that it would insure against fire, without defining what it considered to be "unacceptable fire," and was obliged to pay the claim.  Rather than endure a lengthy and costly appeal process the insurance company accepted the ruling and paid the man $15,000 for the rare cigars he lost in "the fires."
After he cashed the cheque, however, the company had him arrested on 24 counts of arson.  With his own insurance claim and testimony from the previous case being used against him, the man was convicted of intentionally burning his insured property and sentenced to 24 months in jail and a $24,000 fine.
oops.. here's a URL to the article: http://www.funstun.com/fpic38.htm
TOP 10 SIGNS OF "JOB BURNOUT"

10. You're so tired, you now answer the phone with "Go to Hell."

9. Your friends call to ask how you've been, and you immediately scream, "Stop asking me all these damn questions!"

8. Your garbage can IS your "In" box.

7. You wake up to discover your house is on fire, but go back to sleep because you just don't care.

6. You consider a 40 hour week a vacation.

5. Visions of the upcoming weekend help you make it through Monday.

4. You don't set your alarm anymore because you know your pager will go off before your alarm does.

3. You leave for a party and instinctively bring your ID badge.

2. Your DayTimer/Work Planner exploded a week ago.

And the NUMBER ONE sign that you are burned out because of work.....

1. You think about how relaxing it would be if you were in jail right now.
I'm not usually into bashing MS, but this is too funny to pass up:

Some years ago, the Sultan of Brunei was becoming angry as he had 6 children, all girls, and therefore had no son and heir.  Imagine his joy when one of his wives finally presented him with his only son and heir.

Just before his son's sixth birthday, the Sultan took him to one side and said, "Son, I am very proud of you. Anything you want, I shall get for you."  His son replied, "Daddy, I would like to have my own airplane."  Not wanting to do anything halfway, his father bought him American Airlines.

Just before his son's seventh birthday, the Sultan took him to one side. "Son, you are my pride and joy. Anything you want, I shall get for you."  His son replied, "Daddy, I would like a boat."  Not wanting to do anything halfway, his father bought him The Princess Cruise Lines.

Just before his son's eighth birthday, the Sultan took him to one side. "Son, you bring so much happiness into my life. Anything you want, I shall get for you."  His son replied, "Daddy, I would like to be able to watch cartoons."  Not wanting to do anything halfway, his father bought him Disney Studios and their theaters, where he watched all his favorite cartoons.

Just before his son's ninth birthday, the Sultan took him to one side. "Son, you are an inspiration to us all. Anything you want, I shall get for you."  His son, who had really gotten into the Disney cartoons, replied,
"Daddy, I would like a Mickey Mouse outfit."  Not wanting to do anything halfway, his father went and bought him Microsoft.
ASKER CERTIFIED SOLUTION
Avatar of Believer
Believer

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I was going to quit (for now), then I saw this one... it's a pic so I'll hafta explain it.

You're probably all too familiar with Windows' GP Fault message box (with the red-circled X), right?  This GP Fault message box looks like this:

=======================
Tile bar: "AOL"

Window Text: "This program has performed an illegal operation and will be shut down.  If the problem persists, contact the program vendor."

Under the "Details>>" button: "AOL caused a general stupidity fault in module METOO.DLL at 0666:00069abc.  Why don't you get a real ISP account and dump this crappy excuse for an online service?  Stop being one of the 12 million-plus sheep who wallow in lameness by staying on AOL.  Repent now and cancel your AOL account or be eternally damned to everlasting lameness."
=======================
(E-mail me if you want me to send you the .gif)
Okay, I'll quit for now on the condition that you tell me if I'm gonna be beat, that way I can whip out some more guns... <g>
Avatar of bolox

ASKER

well seing as you are the only contestant here you are the winner.

PS I would like the gif of the AOL error. gavin@commodore.co.uk

Thanx again

BYE
That's too funny.
Okay, it's on its way...