12-23-2015, 04:53 AM
(This post was last modified: 12-23-2015, 06:05 AM by OliverWJones.)
I am having difficulty identifying a PDF hash. I used the PDF2HASHCAT.PY approved method to obtain the hash from this file. Yet, OCLHASHCAT cannot identify it, not using any of the PDF modes.
I believe this to be a 40-bit hash, perhaps that's what the *40* means in the hash string. Windows file properties indicate this is a PDF version 1.4 with 40-bit RC4. I'm using a brute-force attack and because it's presumably 40-bits a mask of 5 bytes (?b?b?b?b?b).
Command> oclhashcat64 -m 10500 -a 3 hashfile.hash ?b?b?b?b?b
oclHashcat v2.01 starting...
WARNING: Hashfile 'hashfile.hash' in line 1 ($pdf$1*3*40 ... ): Line-length exception
Parsed Hashes: 1/1 (100.00%)
ERROR: No hashes loaded
I can't seem to figure this out. The hash is obtained from the PDF easy enough. But it doesn't match any of the examples. What am I missing?
Here is the hash, with certain portions redacted according to the forum rules. Thanks for assistance.
$pdf$1*3*40*-4*1*16*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*32*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*13*XXXXXXXXXXXXXXXXXXXXXXXXXX
I believe this to be a 40-bit hash, perhaps that's what the *40* means in the hash string. Windows file properties indicate this is a PDF version 1.4 with 40-bit RC4. I'm using a brute-force attack and because it's presumably 40-bits a mask of 5 bytes (?b?b?b?b?b).
Command> oclhashcat64 -m 10500 -a 3 hashfile.hash ?b?b?b?b?b
oclHashcat v2.01 starting...
WARNING: Hashfile 'hashfile.hash' in line 1 ($pdf$1*3*40 ... ): Line-length exception
Parsed Hashes: 1/1 (100.00%)
ERROR: No hashes loaded
I can't seem to figure this out. The hash is obtained from the PDF easy enough. But it doesn't match any of the examples. What am I missing?
Here is the hash, with certain portions redacted according to the forum rules. Thanks for assistance.
$pdf$1*3*40*-4*1*16*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*32*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*13*XXXXXXXXXXXXXXXXXXXXXXXXXX