+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: Mac .pdf hash type (/thread-4938.html)
Mac .pdf hash type - simplyslow - 12-25-2015
I created a test .pdf file on OS X 10.11.2 with a password. I've tried all the Adobe PDF hash types, but they didn't work. Is there one that will work for the OS X pdf files? Thanks.
RE: Mac .pdf hash type - philsmd - 12-25-2015
1. please define "Mac .pdf file". Which software did you use to create the document?
2. what are the steps you followed to extract the information needed ("hash") from the .pdf document?
3. How did you try "all the Adobe PDF hash types"? If you've followed the steps, you should have extracted the "hash" and therefore you should know which hash type it is (also by looking at the example hash page: https://hashcat.net/wiki/doku.php?id=example_hashes ). So trying "all the Adobe PDF hash types" doesn't really make sense and maybe means that you either did not have extracted the "hash" at all and/or you do not know how to match that output to the correct hash type (there are actually 2 things that should make the hash type clear: 1. by identifying the software (version) the pdf was generated, 2. the extracted "hash" information itself).
Also see: https://hashcat.net/wiki/frequently_asked_questions#how_do_i_extract_the_hashes_from_pdf_documents and the dozens of forum posts that explain it (also use the forum search function).
RE: Mac .pdf hash type - simplyslow - 12-26-2015
(12-25-2015, 09:55 AM)philsmd Wrote: 1. please define "Mac .pdf file". Which software did you use to create the document?
2. what are the steps you followed to extract the information needed ("hash") from the .pdf document?
3. How did you try "all the Adobe PDF hash types"? If you've followed the steps, you should have extracted the "hash" and therefore you should know which hash type it is (also by looking at the example hash page: https://hashcat.net/wiki/doku.php?id=example_hashes ). So trying "all the Adobe PDF hash types" doesn't really make sense and maybe means that you either did not have extracted the "hash" at all and/or you do not know how to match that output to the correct hash type (there are actually 2 things that should make the hash type clear: 1. by identifying the software (version) the pdf was generated, 2. the extracted "hash" information itself).
Also see: https://hashcat.net/wiki/frequently_asked_questions#how_do_i_extract_the_hashes_from_pdf_documents and the dozens of forum posts that explain it (also use the forum search function).
1. I opened a text file, then Print->PDF->Save as PDF. Select Security Options->Enter passworlds->Save. I'm guessing it is part of the Finder-Print section of the OS.
2. I used pdf2hashcat.py to extract the hash from the pdf document. I opened a terminal window dragged and dropped the pdf2hashcat.py file on the window and then dragged and dropped the pdf file after that.
This is what I got out:
< -m 10500 = PDF 1.4 - 1.6 (Acrobat 5 - 8) hash removed by philsmd >
I put this in a text file and saved it. I then attempted to crack the text file with using the different Adobe pdf hash types, but to no avail.
RE: Mac .pdf hash type - philsmd - 12-26-2015
@simplyslow I had to ban you for posting hashes (without permission; not even the corresponding password was mentioned): please use the 7 days off to read the forum rules again ( https://hashcat.net/forum/announcement-2.html )
BTW: the hash of course was -m 10500 because it even exactly matches the signature from the example -m 10500 hash here: https://hashcat.net/wiki/doku.php?id=example_hashes
It cracks with amd/nv and different versions (also older versions) of oclHashcat just perfectly fine:
$pdf$2*3*128*-2584*1*16*76.....*32*e1.....*32*....e83....:lockeduptight