[HELP] to decrypt hash of pdf file
#1
Hello,
I have a PDF file that requires a password to open and read.
I used pdf2hashcat.py to extract the hash: 
$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b

When I run the command: 
hashcat -a 3 -m 10500 %HASH% ?a?a?a?a?a?a?a?a?a?a

I get the following error:
Hash '$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b': Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)

No hashes loaded.

whis the hash mod 25400 i get:
hashcat -a 3 -m 25400 %HASH% ?a?a?a?a?a?a?a?a?a?a

Hash '$pdf$2*3*128*-1852*1*16*1dba0d5ebcd9ae5746f179af98e90327*32*7d4ee51a25ea6b8bd843667cda8672eb00000000000000000000000000000000*13*2b33a25dd86545acc70173231b': Separator unmatched
No hashes loaded.


What am I doing wrong?

Thanks
Reply
#2
It looks like hashcat does not support this specific hash format, John The Ripper does however.
When using your hash I get "Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])"
Reply
#3
[quote="DanielG" pid='62471' dateline='1741855810']
Il semble que hashcat ne prenne pas en charge ce format de hachage spécifique, contrairement à John The Ripper.
Lorsque j'utilise votre hachage, j'obtiens « 1 hachage de mot de passe chargé (PDF [MD5 SHA2 RC4/AES 32/64]) »
[/citation]

thanks for your quick answer, i will try to use john the ripper, idk it.
Reply