+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: [HELP] to decrypt hash of pdf file (/thread-12525.html)
[HELP] to decrypt hash of pdf file - Th3Heavy - 03-12-2025
Hello,
I have a PDF file that requires a password to open and read.
I used pdf2hashcat.py to extract the hash:
$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b
When I run the command:
hashcat -a 3 -m 10500 %HASH% ?a?a?a?a?a?a?a?a?a?a
I get the following error:
Hash '$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b': Token length exception
* Token length exception: 1/1 hashes
This error happens if the wrong hash type is specified, if the hashes are
malformed, or if input is otherwise not as expected (for example, if the
--username option is used but no username is present)
No hashes loaded.
whis the hash mod 25400 i get:
hashcat -a 3 -m 25400 %HASH% ?a?a?a?a?a?a?a?a?a?a
Hash '$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b': Separator unmatched
No hashes loaded.
What am I doing wrong?
Thanks
RE: [HELP] to decrypt hash of pdf file - DanielG - 03-13-2025
It looks like hashcat does not support this specific hash format, John The Ripper does however.
When using your hash I get "Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])"
RE: [HELP] to decrypt hash of pdf file - Th3Heavy - 03-13-2025
[quote="DanielG" pid='62471' dateline='1741855810']
Il semble que hashcat ne prenne pas en charge ce format de hachage spécifique, contrairement à John The Ripper.
Lorsque j'utilise votre hachage, j'obtiens « 1 hachage de mot de passe chargé (PDF [MD5 SHA2 RC4/AES 32/64]) »
[/citation]
thanks for your quick answer, i will try to use john the ripper, idk it.