Getting a weird hash from PDF?

Getting a weird hash from PDF? - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Getting a weird hash from PDF? (/thread-7004.html)

Getting a weird hash from PDF? - Zeppelin1007 - 11-10-2017

Hey Guys,

Been reading through the wikis and the list of examples. Ive got a few PDF's I'm trying to unlock, and I'm getting the dreaded "Line Length Exception"

Upon comparing it to what's in the wiki, the hash's im getting from pdf2john.py arent long enough?

Also I get different hash lengths depending which version of python i use.

What I first got with Python 3

Code:
$pdf$2*3*128*-4*1*16*89d0837390dd128f3499d68850d989ed

Then when i ran it under python 2.7.2

Code:
$pdf$2*3*128*-4*1*16*89d0837390dd128f3499d68850d989ed*32*57f20e3fb8cd1ff174a743f42566293900000000000000000000000000000000

my syntax is

Code:
C:\Hashcat\hashcat64.exe -m 10500 -a 3 2010.Hash ?b?b?b?b?b

I'm startinig to wonder if this is locked in a way hashcat isn't meant to crack? IE I'm over complicating this?

Yes. i'm a newb. I figured one of you pros might look at it and go "yup. You sir are doing it wrong"
I'm on windows 10 pro, python 3.6 and 2.7.2 installed. Wondering if life will be easier to install linux alongside...

Thanks guys.

RE: Getting a weird hash from PDF? - Jiminy - 11-10-2017

Have you tried pdf2hashcat.py ? By the way, posting hashes on the board are not permitted unless directed by one of the administrators. It's in the rules. You risk getting banned for a week. PDF2hashcat.py can be found by doing a search on the FAQ page.
/r

(11-10-2017, 09:18 PM)Zeppelin1007 Wrote: Hey Guys,

Been reading through the wikis and the list of examples. Ive got a few PDF's I'm trying to unlock, and I'm getting the dreaded "Line Length Exception"

Upon comparing it to what's in the wiki, the hash's im getting from pdf2john.py arent long enough?

Also I get different hash lengths depending which version of python i use.

What I first got with Python 3

Code:
$pdf$2*3*128*-4*1*16*89d0837390dd128f3499d68850d989ed

Then when i ran it under python 2.7.2

Code:
$pdf$2*3*128*-4*1*16*89d0837390dd128f3499d68850d989ed*32*57f20e3fb8cd1ff174a743f42566293900000000000000000000000000000000

my syntax is

Code:
C:\Hashcat\hashcat64.exe -m 10500 -a 3 2010.Hash ?b?b?b?b?b

I'm startinig to wonder if this is locked in a way hashcat isn't meant to crack? IE I'm over complicating this?

Yes. i'm a newb. I figured one of you pros might look at it and go "yup. You sir are doing it wrong"
I'm on windows 10 pro, python 3.6 and 2.7.2 installed. Wondering if life will be easier to install linux alongside...

Thanks guys.

RE: Getting a weird hash from PDF? - philsmd - 11-10-2017

As far as I know the current up-to-date script to extract the info from .pdf files is pdf2john.pl (a perl file not a python file):
https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/pdf2john.pl

I would give this up-to-date script a try (running it with the perl interpreter)