Hashcat is showing wrong password
#1
Hi,

I'm using hashcat-4.0.1 under windows10.


hashcat64.exe -a 0 -m 10500 ba2.hash rockyou.txt

Same pdf hash different pass 
undefined
undefinedundefined
#2
my hashcat output


Attached Files
.png   2018-02-07 (1).png (Size: 145.84 KB / Downloads: 24)
.png   2018-02-07 (2).png (Size: 192.81 KB / Downloads: 10)
.png   2018-02-07 (3).png (Size: 187.41 KB / Downloads: 10)
#3
Is candidate1 showing my pass?
Is hashcat storing my pass somewhere?
Or do I have to do some other operation based on what hashcat is showing on my screen to see recovered pass?


Attached Files
.png   2018-02-08.png (Size: 96.96 KB / Downloads: 8)
#4
(02-08-2018, 03:36 AM)qpens8 Wrote: Is hashcat storing my pass somewhere?

https://hashcat.net/wiki/doku.php?id=fre..._a_potfile
#5
(02-08-2018, 10:18 AM)DanielG Wrote:
(02-08-2018, 03:36 AM)qpens8 Wrote: Is hashcat storing my pass somewhere?

https://hashcat.net/wiki/doku.php?id=fre..._a_potfile
 

From pot file

$pdf$2*3*128*-1852*1*16*f1f4173270397c3d01e852e2ab17f6af*32*c01bac8ecd6da8e0b43b96edbf280bd000000000000000000000000000000000*32*de6f776e3ca732f474d0760e37e4de5881067d2b53c38f476c24cb650fd83e22:
#6
Maybe the password is blank (my hashcat finds the same empty password for your posted hash). No password on the PDF file, at least not found by the program making the hash?
#7
I tried empty still not working
#8
maybe the document can be opened without problem and without password but there are other protections in place like copy/print protection etc.
#9
(02-08-2018, 06:49 PM)philsmd Wrote: maybe the document can be opened without problem and without password but there are other protections in place like copy/print protection etc.

I can see the document I just want to edit it
#10
hashcat can only be used to recover the password of an encrypted pdf document. There are other tools that can remove restrictions from pdf files without cracking the password.