(12-25-2015, 09:55 AM)philsmd Wrote: 1. please define "Mac .pdf file". Which software did you use to create the document?
2. what are the steps you followed to extract the information needed ("hash") from the .pdf document?
3. How did you try "all the Adobe PDF hash types"? If you've followed the steps, you should have extracted the "hash" and therefore you should know which hash type it is (also by looking at the example hash page: https://hashcat.net/wiki/doku.php?id=example_hashes ). So trying "all the Adobe PDF hash types" doesn't really make sense and maybe means that you either did not have extracted the "hash" at all and/or you do not know how to match that output to the correct hash type (there are actually 2 things that should make the hash type clear: 1. by identifying the software (version) the pdf was generated, 2. the extracted "hash" information itself).
Also see: https://hashcat.net/wiki/frequently_aske..._documents and the dozens of forum posts that explain it (also use the forum search function).
1. I opened a text file, then Print->PDF->Save as PDF. Select Security Options->Enter passworlds->Save. I'm guessing it is part of the Finder-Print section of the OS.
2. I used pdf2hashcat.py to extract the hash from the pdf document. I opened a terminal window dragged and dropped the pdf2hashcat.py file on the window and then dragged and dropped the pdf file after that.
This is what I got out:
< -m 10500 = PDF 1.4 - 1.6 (Acrobat 5 - 8) hash removed by philsmd >
I put this in a text file and saved it. I then attempted to crack the text file with using the different Adobe pdf hash types, but to no avail.