If you encounter a password-protected backup, you'll need to recover (or break) the original password in order to decrypt its content. There is no way around the password. Apple's backup encryption is pretty strong by today's standards, which makes it easier to attack the original password rather than attacking the binary encryption key. The password can only be recovered via the usual means (brute force and dictionary or hybrid attacks).
In order to break the password, we'll use in-house Elcomsoft Phone Breaker (formerly Phone Password Breaker). This tool was originally designed to do exactly that: breaking iOS backup passwords. Elcomsoft Phone Breaker will attempt to guess the password by performing several kinds of attacks. How much time it will need to recover the password, and whether or not it'll be able to recover the password at all, depends on how strong the original password was. Short, simple passwords (for example, 4-digit PIN) can be broken extremely...