08-17-2024, 08:09 PM
Hello.
I've got a pdf I received from my employer that I actually have a password for, that is in strange status.
If I generate a hash using John - John can crack it.
If I take the hash to hashcat - it can't crack it, and in fact it does not look exactly like any of the supported hashes.
the hash starts with "$pdf$2*3*128*4294967292*1*16*"
This is the error I am getting when trying to crack it
"Hashfile 'd:\hash' on line 1 ($pdf$2...XXX): Token length exception
* Token length exception: 1/1 hashes
This error happens if the wrong hash type is specified, if the hashes are
malformed, or if input is otherwise not as expected (for example, if the
--username option is used but no username is present)
No hashes loaded."
** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it (I know for a fact that the password is a part of the wordlist). I use "10500" mode , the process just ends without result. I tried other "pdf" related modes - no success.
** Of course I remove the pdf filename from beginning of the hash
-1028"
I've got a pdf I received from my employer that I actually have a password for, that is in strange status.
If I generate a hash using John - John can crack it.
If I take the hash to hashcat - it can't crack it, and in fact it does not look exactly like any of the supported hashes.
the hash starts with "$pdf$2*3*128*4294967292*1*16*"
This is the error I am getting when trying to crack it
"Hashfile 'd:\hash' on line 1 ($pdf$2...XXX): Token length exception
* Token length exception: 1/1 hashes
This error happens if the wrong hash type is specified, if the hashes are
malformed, or if input is otherwise not as expected (for example, if the
--username option is used but no username is present)
No hashes loaded."
** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it (I know for a fact that the password is a part of the wordlist). I use "10500" mode , the process just ends without result. I tried other "pdf" related modes - no success.
** Of course I remove the pdf filename from beginning of the hash
-1028"