+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Hashcat outputting blank result (pdf crack)? (/thread-7015.html)
Hashcat outputting blank result (pdf crack)? - staze - 11-13-2017
Hi All,
I'm trying to crack a PDF using Hashcat 4.0.1-4-gfddb66eb (Mac OS X 10.13.1), and giving it a dictionary attack. It quickly finds the password, and reports:
Code:
Session..........: hashcat
Status...........: Cracked
Hash.Type........: PDF 1.4 - 1.6 (Acrobat 5 - 8)
Hash.Target......: $pdf$4*4*128*2052*1*16*00******** (redacted)
Time.Started.....: Mon Nov 13 09:49:19 2017 (1 sec)
Time.Estimated...: Mon Nov 13 09:49:20 2017 (0 secs)
Guess.Base.......: File (~/awesome-wordlist.dict)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#2.....: 3297.2 kH/s (113.82ms)
Speed.Dev.#3.....: 3292.2 kH/s (113.88ms)
Speed.Dev.#*.....: 6589.4 kH/s
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 1603292/1844826117 (0.09%)
Rejected.........: 30428/1603292 (1.90%)
Restore.Point....: 0/1844826117 (0.00%)
Candidates.#2....: -> blahblah
Candidates.#3....: 01731364116 -> 04:01:1351Awesome. Then I look in the output file, or the potfile, and I just see the hash for the pdf, then a colon at the end, then blank. Nothing. Nada.
I've obviously tried a blank password, but it doesn't work. Anyone seen this? am I missing some flag in my hashcat command (./hashcat -m 10500 -a 0 ~/Desktop/pdfhash.txt ~/awesome-wordlist.dict -o ~/Desktop/crackedpdf.txt)?
RE: Hashcat outputting blank result (pdf crack)? - staze - 11-13-2017
Hmm, might have found the answer:
https://hashcat.net/forum/thread-5148.html
But, I don't get why this is the case. The hash was cracked... maybe pdf2john is outputting something wrong. =/
RE: Hashcat outputting blank result (pdf crack)? - staze - 11-13-2017
Yup, I see now that hashcat doesn't crack restriction password if there's no file password.
I'm dumb. Thanks!
RE: Hashcat outputting blank result (pdf crack)? - royce - 11-19-2017
Not dumb - just learning.
Glad you found an answer (from yourself, even!) 