4

New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem.

I have a password protected PDF file that I'm trying to crack to prove to a friend of mine that it can be done (or not as the case may be).

The problem is this:
I run pdf2john.pl on the file and put it out to a .txt or hash file. However, all I get is "name.pdf: " and nothing where the hash should be. Am I doing something wrong, or does pdf2john not work for this instance?

2

Does it work when you try to encrypt and crack a PDF yourself?

Here is a rundown on encrypting and cracking it with the tools you described:

  • Get a sample PDF file sample.pdf.

  • Encrypt it. I'm using qpdf with the password abc123.

    $ qpdf --encrypt abc123 abc123 256 -- sample.pdf sample_encrypted.pdf
    
  • Extract the hash.

    $ ./pdf2john.pl pdf-sample_encrypted.pdf > pass.john   
    

    (I used pdf2john.pl from here.)

  • Crack the hash.

    $ john pass.john
    Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
    Will run 4 OpenMP threads
    Press 'q' or Ctrl-C to abort, almost any other key for status
    abc123           (sample_encrypted.pdf)
    1g 0:00:00:35 DONE 2/3 (2018-04-12 13:37) 0.02787g/s 585.4p/s 585.4c/s 585.4C/s 123456..franklin
    
    Use the "--show" option to display all of the cracked passwords reliably
    Session completed
    

If it works when you encrypt it following these steps, but not with the file you got, consider that the file may be corrupt or encrypted with an unsupported method. Ask your friend how he encrypted it and try to reproduce it with his approach. Ultimately, without access to the file it's hard to pin down out where exactly you went wrong.

| improve this answer | |
  • alright im having trouble posting this comment, so bear with me. worked using those steps. using pdf-parser.py gives me this info about the encryption via obj26 obj 26 0 Type: Referencing: << /Filter /Standard /V 1 /R 2 /O '(\xe0EA\x10\x08\xd1\xa3\xa9KK\xa8\x1e,\x16\xcf\x8ft\x9bR<\xd64\xa0\xeb\x19sd\\r\x98\\(\xe8])' /U '(\xe7\x81\xc9\xc9X\x91\xbd\xf6\xbf:n\x83\xc8\xdc\xee\x11*\xb7\x7fY_\x9f\x8a@C\xf1\x03\xcd\x9c\xf2f\xc8)' /P -60 >> – Baljeet Appleseed Apr 12 '18 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.