12-03-2018, 02:58 AM
I'm trying to crack an encrypted to open pdf (demand a key when opening) with hashcat but it seems there is an issue in the hash.
I got the hash using latest pdf2john.pl (from john git-repo), which works in john. So *after* formatting it, the hash looks like:
Here is the input and output from hashcat:
I tried the format 10400 for PDF 1.1 - 1.3 (Acrobat 2 - 4)[1], but I had tried all PDF formats, the error changes to "Separator unmatched".
The same hash, provided as:
Works in John in last commit, so it's a hashcat issue, right?
I'm already read some posts here in this forum, as https://hashcat.net/forum/thread-4105.html, but they were for past versions. So, there's something I can do?
Thanks \o/
[1] https://hashcat.net/wiki/doku.php?id=example_hashes
I got the hash using latest pdf2john.pl (from john git-repo), which works in john. So *after* formatting it, the hash looks like:
Code:
$pdf$1*3*40*-60*1*16*884e1235aa7ee88713d7184e8f203354*32*8bd267f062849e03995f94eff2d47d1f28bf4e5e4e758a4164004e56fffa0108*32*2647bfb697425500f132c2342a8040ae5c6991068eefcaff00fbfc8586b33781
Here is the input and output from hashcat:
Code:
$ hashcat -m 10400 ../ap.hashcat
hashcat (v5.1.0) starting...
OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz, 4083/16335 MB allocatable, 8MCU
./OpenCL/m10400_a0-optimized.cl: Pure OpenCL kernel not found, falling back to optimized OpenCL kernel
Hashfile '../ap.hashcat' on line 1 ($pdf$1...5c6991068eefcaff00fbfc8586b33781): Salt-value exception
No hashes loaded.
Started: Sun Dec 02 22:42:46 2018
Stopped: Sun Dec 02 22:42:46 2018
I tried the format 10400 for PDF 1.1 - 1.3 (Acrobat 2 - 4)[1], but I had tried all PDF formats, the error changes to "Separator unmatched".
The same hash, provided as:
Code:
Ap.pdf:$pdf$1*3*40*-60*1*16*884e1235aa7ee88713d7184e8f203354*32*8bd267f062849e03995f94eff2d47d1f28bf4e5e4e758a4164004e56fffa0108*32*2647bfb697425500f132c2342a8040ae5c6991068eefcaff00fbfc8586b33781
Works in John in last commit, so it's a hashcat issue, right?
I'm already read some posts here in this forum, as https://hashcat.net/forum/thread-4105.html, but they were for past versions. So, there's something I can do?
Thanks \o/
[1] https://hashcat.net/wiki/doku.php?id=example_hashes