Tested working on Kali and Ubuntu Linux.

Your MyPDF-Hash.txt file is now ready to use with OCLHashCat (or John the Ripper).

Hint: you can do the extraction and the edition in one step by using sed (UnxUtils version too, if you are doing it from Windows): perl JohnTheRipper-bleeding-jumbo/run/ MyPDF.pdf | sed 's/.*$//' | sed 's/^.*://' > MyPDF-Hash.txt txt Using default input encoding: UTF- 8 Loaded 1 password hash (PKZIP 32 / 64 ) No password hashes left to crack (see FAQ) This means that the password has already been ripped, to print password check. So use your preferred editor: nano MyPDF-Hash.txtĪnd leave only the part inside double colons : : $pdf$4*4*128*1028*1*16*652fc762fdb12c47a5f90ddd2b99b809*32*dd86d858f914809078a4a47348d32c0fc4e9c08042a10e6434b48b698de7731f*32*3c1e693526d5bc8da15b99eea6cbc6ed2c2397e23e2c39d1974fdc004c588cff John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), Windows, DOS, BeOS, and OpenVMS (the latter requires a contributed patch). If you run john again, you will get: john hash. Output file MyPDF-Hash.txt must be edited. pdf file: perl JohnTheRipper-bleeding-jumbo/run/ MyPDF.pdf > MyPDF-Hash.txt Download from the suite John the Ripper ( OCLHashCat works with the same hash format as John the Ripper): wget It has been substituted by a perl version, .Įxtracted from HashCat Forums, this method works for me ( requires Perl): The script pdf2john.py doesn't exist anymore.

John the ripper github