2

When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like:

testing1.pdf:$pdf$2*3*128*-1028*1*16*3ba51ab2b4f9210274ccb07b8da9ec59*32*aba227f510daac66c2d0c7d40684ed8000000000000000000000000000000000*32*f576b0bc14308d979692e71693089bc3f3295620a5b8af07e2e4d1145ec7d77b:::::./testing1.pdf

I would like to know what is the hash format used? I ask because most of the online rainbow table website doesn't accept PDF format, only MD5, SHA1 etc. I wonder if it is possible to extract the non-PDF specific part out to be used in those online rainbow table website?

Improve this question
2
  • Have you tried running john on the output? John will tell you what hash type it is trying.
    – amccormack
    May 21, 2015 at 0:29
  • Read the source code for the tool, pay attention to the imported modules.
    – KDEx
    May 21, 2015 at 6:02

1 Answer 1

Reset to default
1

Hashcat lists a similar looking hash in their example hashes

10500 PDF 1.4 - 1.6 (Acrobat 5 - 8)

$pdf$2*3*128*-1028*1*16*da42ee15d4b3e08fe5b9ecea0e02ad0f*32*c9b59d72c7c670c42eeb4fca1d2ca15000000000000000000000000000000000*32*c4ff3e868dc87604626c2b8c259297a14d58c6309c70b00afdfb1fbba10ee571

On John The Ripper it's also supported as you can see on this walkthrough and on JTRs example hashes. The algorithm is there just called pdf.

I neither found information on extracting an MD5/SHA1 hash etc from the PDF hash nor rainbow tables for PDF. So it's probably not possible since the PDF hash algorithm may use salting and/or iterating. So using Hashcat or John The Ripper is your only option.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .