(12-30-2024, 06:20 PM)ox1d Wrote: Hashcat returning multiple incorrect answers for a PDF hash hashcat.exe -m 25400 -a 3 hashfile ?a?a?a?a --force --potfile-disable
i get: $pdf$4*4*128*-4*1*16*35851ee76af82bbcxxxx40cf9e5de8c3*32*1fd3a5cc45cfd678673c09f9e8ee791828bf4e5e4e758a4164004e56fffa0108*32*b15c9e6311acf6d9ec6398f07f613bf4710e91e57b9e11887d6c3f2b6a410f16:$HEX[723263652020202028757365722070617373776f72643d61411a256a667555261c543f437b6d4f29]
hex decode > r2ce (user password=aA%jfuU& T?C{mO)
command > hashcat.exe -m 25400 h.hash -a 3 --force --potfile-disable
i get: $pdf$4*4*128*-4*1*16*35851ee76af82bbcxxxx40cf9e5de8c3*32*1fd3a5cc45cfd678673c09f9e8ee791828bf4e5e4e758a4164004e56fffa0108*32*b15c9e6311acf6d9ec6398f07f613bf4710e91e57b9e11887d6c3f2b6a410f16:$HEX[6d6433612020202028757365722070617373776f72643d7c6c703a377c2b5f76244120761b393829]
hex decode > md3a (user password=|lp:7|+_v$A v98)
What am I doing wrong?
It does look weird. But I'm not sure if the (user password) part is intended. I haven't cracked pdf's for ages.
But some hashing algos - and pdf could be one of them I think - have a lot of false positives. You should run hashcat with
--keep-guessing