For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file.
I used pdf2john.pl
to get the password hash and I performed a brute force attack with john
, but I did not find the password.
Here is the result of pdf-parser
PDF Comment '%PDF-1.6\n'
PDF Comment '%\xc3\xa4\xc3\xbc\xc3\xb6\xc3\x9f\n'
obj 2 0
Type:
Referencing: 3 0 R
Contains stream
<<
/Length 3 0 R
/Filter /FlateDecode
>>
obj 3 0
Type:
Referencing:
obj 4 0
Type: /XObject
Referencing:
Contains stream
<<
/Type /XObject
/Subtype /Image
/Width 300
/Height 432
/BitsPerComponent 8
/ColorSpace /DeviceGray
/Filter /DCTDecode
/Length 21223
>>
obj 6 0
Type:
Referencing: 7 0 R
Contains stream
<<
/Length 7 0 R
/Filter /FlateDecode
/Length1 13452
>>
obj 7 0
Type:
Referencing:
obj 8 0
Type: /FontDescriptor
Referencing: 6 0 R
<<
/Type /FontDescriptor
/FontName /BAAAAA+LiberationSerif
/Flags 4
/FontBBox [-543 -303 1277 981]
/ItalicAngle 0
/Ascent 891
/Descent -216
/CapHeight 981
/StemV 80
/FontFile2 6 0 R
>>
obj 9 0
Type:
Referencing:
Contains stream
<<
/Length 327
/Filter /FlateDecode
>>
obj 10 0
Type: /Font
Referencing: 8 0 R, 9 0 R
<<
/Type /Font
/Subtype /TrueType
/BaseFont /BAAAAA+LiberationSerif
/FirstChar 0
/LastChar 23
/Widths '[777 333 722 722 610 889 500 610 610 722 666 556 943 556 556 389\n666 666 722 722 500 722 722 563 ]'
/FontDescriptor 8 0 R
/ToUnicode 9 0 R
>>
obj 11 0
Type:
Referencing: 10 0 R
<<
/F1 10 0 R
>>
obj 12 0
Type:
Referencing: 11 0 R, 4 0 R
<<
/Font 11 0 R
/XObject
<<
/Im4 4 0 R
>>
/ProcSet [/PDF/Text/ImageC/ImageI/ImageB]
>>
obj 1 0
Type: /Page
Referencing: 5 0 R, 12 0 R, 2 0 R
<<
/Type /Page
/Parent 5 0 R
/Resources 12 0 R
/MediaBox [0 0 595.303937007874 841.889763779528]
/Group
<<
/S /Transparency
/CS /DeviceRGB
/I true
>>
/Contents 2 0 R
>>
obj 5 0
Type: /Pages
Referencing: 12 0 R, 1 0 R
<<
/Type /Pages
/Resources 12 0 R
/MediaBox [ 0 0 595 841 ]
/Kids [ 1 0 R ]
/Count 1
>>
obj 13 0
Type: /Catalog
Referencing: 5 0 R, 1 0 R
<<
/Type /Catalog
/Pages 5 0 R
/OpenAction [1 0 R /XYZ null null 0]
/Lang (ÒlSEó)
>>
obj 14 0
Type:
Referencing:
<<
/Creator <B5291DD1E39E8CEEB7BB00DE4727>
/Producer <B5291DCAE3858CE5B7BD00DE471A87BB4B16D789588D1C3A2E816CF0EE06CC2F>
/CreationDate '(\x0fì/¶Ñݼ¿\x87þ1\x83vaµå`@æÇhÞ;)'
>>
obj 15 0
Type:
Referencing:
<<
/Filter /Standard
/V 2
/Length 128
/R 3
/O '(§cØ=§"ÙÅ\\\\3}v¢Æ\x04±·¾\x15Í:²T\x8f¥\x11\x1fV\x0bBD})'
/U '(_Êwùa¡\x0bw\x82\x96 +\x8e>\x11\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)'
/P -1028
>>
xref
trailer
<<
/Size 16
/Root 13 0 R
/Encrypt 15 0 R
/Info 14 0 R
/ID [<D5CD494D0ED81AB6D3B0075801DB17C7><D5CD494D0ED81AB6D3B0075801DB17C7>]
/DocChecksum /AB6CA2DB8FEE301BB454F3A1F8DEA536
>>
startxref 31361
PDF Comment '%%EOF\n'
Here is /Encrypt object
obj 15 0
Type:
Referencing:
<<
/Filter /Standard
/V 2
/Length 128
/R 3
/O '(§cØ=§"ÙÅ\\\\3}v¢Æ\x04±·¾\x15Í:²T\x8f¥\x11\x1fV\x0bBD})'
/U '(_Êwùa¡\x0bw\x82\x96 +\x8e>\x11\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)'
/P -1028
>>
Is there another method to get the password? Is there a way to use folder content to find the password?