+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Unsupported PDF hash (/thread-12117.html)
Unsupported PDF hash - viperxp - 08-17-2024
Hello.
I've got a pdf I received from my employer that I actually have a password for, that is in strange status.
If I generate a hash using John - John can crack it.
If I take the hash to hashcat - it can't crack it, and in fact it does not look exactly like any of the supported hashes.
the hash starts with "$pdf$2*3*128*4294967292*1*16*"
This is the error I am getting when trying to crack it
"Hashfile 'd:\hash' on line 1 ($pdf$2...XXX): Token length exception
* Token length exception: 1/1 hashes
This error happens if the wrong hash type is specified, if the hashes are
malformed, or if input is otherwise not as expected (for example, if the
--username option is used but no username is present)
No hashes loaded."
** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it (I know for a fact that the password is a part of the wordlist). I use "10500" mode , the process just ends without result. I tried other "pdf" related modes - no success.
** Of course I remove the pdf filename from beginning of the hash
-1028"
RE: Unsupported PDF hash - lapsikmees - 08-17-2024
Hi,
what gpu you have?
RE: Unsupported PDF hash - viperxp - 08-17-2024
(08-17-2024, 08:34 PM)lapsikmees Wrote: Hi,
what gpu you have?
3070ti laptop . Unsure if it's related.
Ah, and using the latest hashcat (6.2.6)
RE: Unsupported PDF hash - lapsikmees - 08-17-2024
Intel ones seems to have a problem with these.
You can try hashcat beta or build latest from github.
RE: Unsupported PDF hash - viperxp - 08-17-2024
(08-17-2024, 09:04 PM)lapsikmees Wrote: Intel ones seems to have a problem with these.
You can try hashcat beta or build latest from github.
I don't think it's related to the GPU/CPU. The format is the issue....
RE: Unsupported PDF hash - lapsikmees - 08-17-2024
Whats your full command without hash?
RE: Unsupported PDF hash - viperxp - 08-18-2024
(08-17-2024, 09:16 PM)lapsikmees Wrote: Whats your full command without hash?
hashcat.exe -m 10500 -d 2 d:\01\hash2 -a 0 d:\01\list.txt
or the similar on linux
the result is exactly the same ..
RE: Unsupported PDF hash - nick8606 - 08-18-2024
(08-17-2024, 08:09 PM)viperxp Wrote: ** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it
Signed value of 4294967292 is -4 (not -1028).
P. S. The same problem was recently discussed here.
RE: Unsupported PDF hash - viperxp - 08-18-2024
(08-18-2024, 05:41 AM)nick8606 Wrote:(08-17-2024, 08:09 PM)viperxp Wrote: ** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it
Signed value of 4294967292 is -4 (not -1028).
P. S. The same problem was recently discussed here.
Thanks, changed the " 4294967292" to "-4" and successfully cracked the file