hashcat Forum
Using cracked RC4 key to read a PDF - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Using cracked RC4 key to read a PDF (/thread-11517.html)



Using cracked RC4 key to read a PDF - nullptr - 07-21-2023

I recently wanted crack an old PDF to see what was inside, so I searched around a bit and found out I could crack RC4 encrypted PDFs very quickly. After cracking the key I tried both writing a Python script to decrypt the streams inside the PDF using PyPDF2 and decrypting some streams by hand but PyPDF2 returned an error and my manual tries yielded invalid results.

Am I doing something wrong? How would I use this key to decrypt the PDF file?
Both an owner and user password is set btw

Code:
Session..........: hashpdftests
Status...........: Cracked
Hash.Mode........: 10410 (PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1)
Hash.Target......: $pdf$1*2*40*-28*1*16*xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...f9157c
Time.Started.....: Fri Jul 21 08:26:22 2023, (47 mins, 55 secs)
Time.Estimated...: Fri Jul 21 09:14:17 2023, (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Mask.......: ?b?b?b?b?b [5]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  293.3 MH/s (105.93ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 840475607040/1099511627776 (76.44%)
Rejected.........: 0/840475607040 (0.00%)
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[c8611bacc3] -> $HEX[ffff3faec0]



RE: Using cracked RC4 key to read a PDF - marc1n - 07-23-2023

https://github.com/openwall/john/blob/bleeding-jumbo/run/pdf2john.pl