New PDF Hash [SOLVED]

[libre]

I extracted the hash of a password protected PDF and am trying to crack it with hashcat, but I get this error:

Code:

Hashfile 'hash.txt' on line 1 ($pdf$5...248b12eae2eb429ce9c4a7f46c9ad209): Token length exception

This is the hash obtained with JohnTheRipper:

Code:

$pdf$5*6*256*-4*1*16*xxxxxxxxxxxxxxxxxxxxxxxx

Is the hash really invalid or simply an unsupported new hash?

I also tried cracking it with pdfcrack but got the error:

Code:

The specific version is not supported (Standard - 6)

[Snoopy]

what version of hashcat do u use? fast try with 6.2.3 works fine

plz remove your hash now

[libre]

what version of hashcat do u use? fast try with 6.2.3 works fine

plz remove your hash now

v6.1.1 , the one available in Ubuntu repos.

It's not allowed to publish hashs? I don't mind having it public, it's a simple password not used anywhere else and only protects a harmless PDF.

[Xanadrel]

what version of hashcat do u use? fast try with 6.2.3 works fine

plz remove your hash now

v6.1.1 , the one available in Ubuntu repos.

It's not allowed to publish hashs? I don't mind having it public, it's a simple password not used anywhere else and only protects a harmless PDF.

Snoopy is right (either don't post it or mask it), it is advised to read a forum's rules before posting something, consider this a polite warning.

[libre]

Snoopy is right (either don't post it or mask it), it is advised to read a forum's rules before posting something, consider this a polite warning.

Done.

Which mode I should use for my hash type though? $pdf$5*6*256

[Xanadrel]

If you use latest version of hashcat you would have the automatic analysis of hashes, so if you don't use -m and there is a single possible mode it will use it.

You can also use this wiki page as reference: https://hashcat.net/wiki/doku.php?id=example_hashes

(And there are these options in hashcat itself too: --identify and --example-hashes)

[libre]

If you use latest version of hashcat you would have the automatic analysis of hashes, so if you don't use -m and there is a single possible mode it will use it.

You can also use this wiki page as reference: https://hashcat.net/wiki/doku.php?id=example_hashes

(And there are these options in hashcat itself too: --identify and --example-hashes)

I'm running latest now but I'm getting an error:

Code:

User:Laptop~/Desktop$ hashcat -b --benchmark-all
hashcat (v6.2.3) starting in benchmark mode

Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.

OpenCL API (OpenCL 1.2 pocl 1.6, None+Asserts, LLVM 9.0.1, RELOC, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=============================================================================================================================
* Device #1: pthread-11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz, 13579/13643 MB (4096 MB allocatable), 8MCU

Benchmark relevant options:
===========================
* --benchmark-all
* --optimized-kernel-enable

Hashmode: 0 - MD5

1 error generated.
clCompileProgram(): CL_COMPILE_PROGRAM_FAILURE

error: /home/rafael/.cache/pocl/kcache/tempfile-80-07-bf-14-03.cl:7:10: 'inc_vendor.h' file not found

* Device #1: Kernel /usr/local/share/hashcat/OpenCL/shared.cl build failed.

Started: Fri Jul 23 15:27:44 2021
Stopped: Fri Jul 23 15:27:44 2021

I have a laptop without a powerful GPU. I downloaded the latest version and installed with make && sudo make install on my Ubuntu 21.04.

CL_COMPILE_PROGRAM_FAILURE

What went wrong?

[Snoopy]

plz try uninstalling pocl and switch to the intel opencl runtime provided directly by intel

sudo apt-get remove pocl-opencl-icd

https://software.intel.com/content/www/u...pu-section
or
try to search for the intel-opencl in your package manager

pocl seems to "misbehave" sometimes

[libre]

plz try uninstalling pocl and switch to the intel opencl runtime provided directly by intel



sudo apt-get remove pocl-opencl-icd



https://software.intel.com/content/www/u...pu-section

or

try to search for the intel-opencl in your package manager



pocl seems to "misbehave" sometimes

I did:

Code:

sudo apt-fast remove pocl-opencl-icd

sudo apt-fast install intel-opencl-icd

Package was replaced successfully. Then I retried:

Code:

User@Laptop:~$ hashcat -b --benchmark-all
hashcat (v6.2.3-37-gedab99cdf) starting in benchmark mode

Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.

* Device #1: Unstable OpenCL driver detected!

This OpenCL driver may fail kernel compilation or produce false negatives.
You can use --force to override, but do not report related errors.

No devices found/left.

Started: Fri Jul 23 18:16:18 2021
Stopped: Fri Jul 23 18:16:18 2021

Should I recompile hashcat?

[libre]

Got it working, password cracked =D

What solved the error, in case someone else has same issue:

Code:

sudo apt-fast remove pocl-opencl-icd
sudo apt-fast remove intel-opencl-icd

Then downloaded this directly from Intel:

https://registrationcenter.intel.com/en/...uctid=3206

Had to register and submit to their terms though =/

Then:

Code:

sudo apt-fast install lsb-core
tar -vzxf l_opencl_p_18.1.0.015.tgz
cd l_opencl_p_18.1.0.015
sudo ./install_GUI.sh

And hashcat finally worked. Password was quite simple and cracked in a matter of minutes with:

Code:

hashcat -a 3 -m 10700 hash.txt -O

Thanks guys!