PDF 1.1 - 1.3 no ID part
#1
Could it be that the ID part is empty?
Okay from the beginning:
pdf2john.py => File not encrypted
pdf2john.pl => $pdf$1*2*40*4294967239*1*0**32* ....
pdfinfo     => $pdf$1*2*40*-57*1*0**32* ....


hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*0**32*...'
=> Token length exception

Regarding the source code module_10400.c

token.len_min[6] = 2;
token.len_max[6] = 2;

token.len_min[7] = 32;
token.len_max[7] = 32;


Is that a failure inside the source code? What would be the salt if this is correct?
hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*00*00000000000000000000000000000000*32*....'
=> Salt value exception

hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*16*00000000000000000000000000000000*32*....'
=> is currently running. If this is intended should the "module_10[467][012]0.c" be modified or pdf2john?

I know the user_pw if it helps.
Reply