TL;DR :

John the Ripper does not try to crack hashes in an old format ($pdf$1*2*40*4294967292*1*16*...*). How to crack them?

Long version:

I have a few password-protected PDFs from years ago. Unfortunately, I did not record the password.

I tried to

./pdf2john.pl old.pdf > hash.txt
./john hash.txt

but I get

Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

After some testing, I figured out that this is due to an older hash type.

I created a few password-protected files and submitted it to an online pdf2john service.

They report that the file I created (new.pdf) has the following information:

Detected HashType: PDF 1.4 - 1.6 (Acrobat 5 - 8)
Hashcat Mode: 10500
Hash: $pdf$2*3*128*-1028*1*16*7315fd58cbe087352a67bd87ffb6fd97*

And the file whose password I want to discover (old.pdf) has the following information:

Detected HashType: PDF 1.1 - 1.3 (Acrobat 2 - 4)
Hashcat Mode: 10400
Hash: $pdf$1*2*40*4294967292*1*16*57ca7a373434d062619a543a70b302ad*

Copy-pasting the first hash (new.pdf $pdf$2*3*128*-1028*1*16*7315fd58cbe087352a67bd87ffb6fd97*) to hash.txt then running ./john hash.txt works.

Copy-pasting the second hash (old.pdf $pdf$1*2*40*4294967292*1*16*57ca7a373434d062619a543a70b302ad*) to hash.txt then running ./john hash.txt does not works.

I get

Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

How can I use John the Ripper to crack this hash format?

I downloaded from https://github.com/magnumripper/JohnTheRipper and configured and maked only a few days ago.

  • Here's a cheat sheet for JTR format. Take a look at -format too. – DIDIx13 Mar 8 at 7:10
  • @DIDIx13 I've taken a look through them and tested it. It still doesn't work – cccbhsuo Mar 13 at 4:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.