19

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password.

When auditing security, a good attemp to break PDF files passwords is extracting this hash and bruteforcing it, for example using programs like HashCat.

What is the proper method to extract the hash inside a PDF file in order to auditing it with, say, HashCat?

Answers for John the Ripper could be valid too, but I prefer HashCat format due to the easyness of making GPU computing work in Windows and bruteforce with OCLHashCat (the GPU version of HashCat). John the Ripper has a GPU version too, but JTR has no Windows version, at least with GPU enhancement.

22

UPDATE 21 Dec 2017

The script pdf2john.py doesn't exist anymore. It has been substituted by a perl version, pdf2john.pl.


Extracted from HashCat Forums, this method works for me (requires Perl):

--Download pdf2john.pl from the suite John the Ripper (OCLHashCat works with the same hash format as John the Ripper):

wget https://github.com/magnumripper/JohnTheRipper/archive/bleeding-jumbo.zip  
unzip bleeding-jumbo.zip  

--Use it to extract the hash from your .pdf file:

perl JohnTheRipper-bleeding-jumbo/run/pdf2john.pl MyPDF.pdf > MyPDF-Hash.txt

--Output file MyPDF-Hash.txt must be edited. Original would be something like:

MyPDF.pdf:$pdf$4*4*128*1028*1*16*652fc762fdb12c47a5f90ddd2b99b809*32*dd86d858f914809078a4a47348d32c0fc4e9c08042a10e6434b48b698de7731f*32*3c1e693526d5bc8da15b99eea6cbc6ed2c2397e23e2c39d1974fdc004c588cff:::::MyPDF.pdf

so use your preferred editor:

nano MyPDF-Hash.txt
notepad MyPDF-Hash.txt

and leave only the part inside double colons : :

$pdf$4*4*128*1028*1*16*652fc762fdb12c47a5f90ddd2b99b809*32*dd86d858f914809078a4a47348d32c0fc4e9c08042a10e6434b48b698de7731f*32*3c1e693526d5bc8da15b99eea6cbc6ed2c2397e23e2c39d1974fdc004c588cff

--Hint: you can do the extraction and the edition in one step by using sed (UnxUtils version too, if you are doing it from Windows):

perl JohnTheRipper-bleeding-jumbo/run/pdf2john.pl MyPDF.pdf | sed "s/::.*$//" | sed "s/^.*://" > MyPDF-Hash.txt

--Your MyPDF-Hash.txt file is now ready to use with OCLHashCat (or John the Ripper).

NOTES:

  • Tested working on CygWin (Windows).
  • Tested working on Kali and Ubuntu Linux.
7
  • pdf2john.py doesn't exist anymore. It has been substituted by a perl version Dec 21 '17 at 2:59
  • 1
    Copying the perl file out of the directory does not work. It needs to be where it is, in the "run" directory, otherwise you'll get an error. Jun 10 '18 at 5:50
  • 1
    To get rid of the irrelevante text on the hash, use this perl JohnTheRipper-bleeding-jumbo/run/pdf2john.pl MyPDF.pdf | awk -F":" '{ print $2}' > MyPDF-Hash.txt Jul 31 '18 at 17:36
  • 1
    I must say, this is the first time I've ever seen an application move from python to perl. I wonder... why? Jan 4 '20 at 1:09
  • 1
    FYI there is a site that runs that script for you if you don't mind uploading the pdf. onlinehashcrack.com/tools-pdf-hash-extractor.php
    – Szabolcs
    Jul 8 '20 at 9:30

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .