+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: PDF Hash (/thread-7728.html)
PDF Hash - digidax - 08-08-2018
Hi,
I generated the hash from a PDF by using the Perl verion of JohnTheRipper-bleeding-jumbo:
Code:
perl JohnTheRipper-bleeding-jumbo/run/pdf2john.pl test.pdf > hash.txtThen I want to start hashcat:
Code:
C:\pdf\hashcat>hashcat64.exe -m 10400 -a 3 "hash.txt" ?a?a?a?a?a?a?a?a?a?abut get the error:
Code:
C:\pdf\hashcat>hashcat64.exe -m 10400 -a 3 "hash.txt" ?a?a?a?a?a?a?a?a?a?a
hashcat (v4.2.1) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 970, 1024/4096 MB allocatable, 13MCU
./OpenCL/m10400_a3-optimized.cl: Pure OpenCL kernel not found, falling back to optimized OpenCL kernel
Hashfile 'hash.txt' on line 1 ($pdf$2...6a04f3baed07dd91afd5a13afe7ae130): Token length exception
No hashes loaded.
Started: Wed Aug 08 11:24:06 2018
Stopped: Wed Aug 08 11:24:06 2018Thats the hash inside of hash.txt:
Code:
$pdf$2*3*128*-1028*1*16*1cbbfa9726072cab27c25203533e8f7c*32*b5161fe8b25afcbe69f1c9cdc8445d8c01000000000000000000000000000000*32*f7b4b890408713c4880d202ced4055186a04f3baed07dd91afd5a13afe7ae130What do I wrong? Was following this tutorial: https://blog.didierstevens.com/2017/12/26/cracking-encrypted-pdfs-part-1/
Thanks for any help and best regards,
Frank
RE: PDF Hash - atom - 08-08-2018
Wrong mode. For $pdf$2*3 use 10500
RE: PDF Hash - DanielG - 08-08-2018
you are using -m 10400, which on https://hashcat.net/wiki/doku.php?id=example_hashes starts with $pdf$1*
But your hash starts with $pdf$2* which looks like -m 10500
RE: PDF Hash - atom - 08-08-2018
On top of that, you may want to use the mask ?l?l?l?l?d?d?d?d and not ?a?a?a?a?a?a?a?a?a?a
RE: PDF Hash - digidax - 08-08-2018
Oh yes, sorry my bad, it's PDF-1.6, so 10500 would be correct, have use it and get the output:
Code:
C:\pdf\hashcat>hashcat64.exe -m 10500 -a 3 "test.hash" ?a?a?a?a?a?a?a?a?a?a
hashcat (v4.2.1) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 970, 1024/4096 MB allocatable, 13MCU
Hash 'test.hash': Separator unmatched
No hashes loaded.
Started: Wed Aug 08 11:37:48 2018
Stopped: Wed Aug 08 11:37:49 2018What filter I have to use? I know the password lenght is between 9 and 10 chars.
Maybe it can be filtered sharper: one "%" is used, one "9" is used and the letters m,v,e,j,s,u,p maybe also in capital letters.
Thanks for this ultra fast help.
RE: PDF Hash - philsmd - 08-08-2018
the file named test.hash must exist within your file system and the path to that file must be correct.
Hashcat can't find your file
RE: PDF Hash - digidax - 08-08-2018
Sorry, to warm here in Germany (39 °C), now the correct file is working.
Is there a way that I can set a pool like a file with chars that are only be used and a lenght?
RE: PDF Hash - atom - 08-08-2018
(08-08-2018, 11:44 AM)digidax Wrote: What filter I have to use? I know the password lenght is between 9 and 10 chars.
Maybe it can be filtered sharper: one "%" is used, one "9" is used and the letters m,v,e,j,s,u,p maybe also in capital letters.
Check my mask, the password has the length 8
RE: PDF Hash - digidax - 08-08-2018
it's working. Where have you know, that the password matches to the mask ?l?l?l?l?d?d?d?d and have a length of 8 chars?
RE: PDF Hash - atom - 08-08-2018
I cracked the hash accidentially. The password was reused in a hash in the linkedin dump.