PDF Hash - Printable Version +- hashcat Forum (https://hashcat.net/forum) +-- Forum: Support (https://hashcat.net/forum/forum-3.html) +--- Forum: hashcat (https://hashcat.net/forum/forum-45.html) +--- Thread: PDF Hash (/thread-7728.html) |
PDF Hash - digidax - 08-08-2018 Hi, I generated the hash from a PDF by using the Perl verion of JohnTheRipper-bleeding-jumbo: Code: perl JohnTheRipper-bleeding-jumbo/run/pdf2john.pl test.pdf > hash.txt Then I want to start hashcat: Code: C:\pdf\hashcat>hashcat64.exe -m 10400 -a 3 "hash.txt" ?a?a?a?a?a?a?a?a?a?a but get the error: Code: C:\pdf\hashcat>hashcat64.exe -m 10400 -a 3 "hash.txt" ?a?a?a?a?a?a?a?a?a?a Thats the hash inside of hash.txt: Code: $pdf$2*3*128*-1028*1*16*1cbbfa9726072cab27c25203533e8f7c*32*b5161fe8b25afcbe69f1c9cdc8445d8c01000000000000000000000000000000*32*f7b4b890408713c4880d202ced4055186a04f3baed07dd91afd5a13afe7ae130 What do I wrong? Was following this tutorial: https://blog.didierstevens.com/2017/12/26/cracking-encrypted-pdfs-part-1/ Thanks for any help and best regards, Frank RE: PDF Hash - atom - 08-08-2018 Wrong mode. For $pdf$2*3 use 10500 RE: PDF Hash - DanielG - 08-08-2018 you are using -m 10400, which on https://hashcat.net/wiki/doku.php?id=example_hashes starts with $pdf$1* But your hash starts with $pdf$2* which looks like -m 10500 RE: PDF Hash - atom - 08-08-2018 On top of that, you may want to use the mask ?l?l?l?l?d?d?d?d and not ?a?a?a?a?a?a?a?a?a?a RE: PDF Hash - digidax - 08-08-2018 Oh yes, sorry my bad, it's PDF-1.6, so 10500 would be correct, have use it and get the output: Code: C:\pdf\hashcat>hashcat64.exe -m 10500 -a 3 "test.hash" ?a?a?a?a?a?a?a?a?a?a What filter I have to use? I know the password lenght is between 9 and 10 chars. Maybe it can be filtered sharper: one "%" is used, one "9" is used and the letters m,v,e,j,s,u,p maybe also in capital letters. Thanks for this ultra fast help. RE: PDF Hash - philsmd - 08-08-2018 the file named test.hash must exist within your file system and the path to that file must be correct. Hashcat can't find your file RE: PDF Hash - digidax - 08-08-2018 Sorry, to warm here in Germany (39 °C), now the correct file is working. Is there a way that I can set a pool like a file with chars that are only be used and a lenght? RE: PDF Hash - atom - 08-08-2018 (08-08-2018, 11:44 AM)digidax Wrote: What filter I have to use? I know the password lenght is between 9 and 10 chars. Check my mask, the password has the length 8 RE: PDF Hash - digidax - 08-08-2018 it's working. Where have you know, that the password matches to the mask ?l?l?l?l?d?d?d?d and have a length of 8 chars? RE: PDF Hash - atom - 08-08-2018 I cracked the hash accidentially. The password was reused in a hash in the linkedin dump. |