Perl script pdf2john delivered with John does not work as expected despite the presence of the ExifTool module

[patatetom]

hi,

Steps to reproduce

$ perl --version | grep version
This is perl 5, version 30, subversion 0 (v5.30.0) built for x86_64-linux-thread-multi

$ (
perl <<end_of_test
use Image::ExifTool qw(:Public);
end_of_test
) && echo ok
ok

$ pdf2john /tmp/test.pdf > /tmp/pdf
Can't locate ExifTool.pm in @inc (you may need to install the ExifTool module) (@inc contains: /bin/lib /home/user/perl5/lib/perl5/5.30.0/x86_64-linux-thread-multi /home/user/perl5/lib/perl5/5.30.0 /home/user/perl5/lib/perl5/x86_64-linux-thread-multi /home/user/perl5/lib/perl5 /usr/lib/perl5/5.30/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/5.30/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/5.30/core_perl /usr/share/perl5/core_perl) at /bin/pdf2john line 39.
BEGIN failed--compilation aborted at /bin/pdf2john line 39.

System configuration

$ john --list=build-info
Version: 1.9.0-jumbo-1
Build: linux-gnu 64-bit x86_64 SSE2 AC MPI + OMP
SIMD: SSE2, interleaving: MD4:3 MD5:3 SHA1:1 SHA256:1 SHA512:1
System-wide exec: /usr/lib/john
System-wide home: /usr/share/john
Private home: ~/.john
$JOHN is /usr/share/john/
Format interface version: 14
Max. number of reported tunable costs: 4
Rec file version: REC4
Charset file version: CHR3
CHARSET_MIN: 1 (0x01)
CHARSET_MAX: 255 (0xff)
CHARSET_LENGTH: 24
SALT_HASH_SIZE: 1048576
SINGLE_IDX_MAX: 2147483648
SINGLE_BUF_MAX: 4294967295
Effective limit: Number of salts vs. SingleMaxBufferSize
Max. Markov mode level: 400
Max. Markov mode password length: 30
gcc version: 9.1.0
GNU libc version: 2.29 (loaded: 2.29)
OpenCL headers version: 2.2
Crypto library: OpenSSL
OpenSSL library version: 01010103f
OpenSSL 1.1.1c 28 May 2019
GMP library version: 6.1.2
File locking: fcntl()
fseek(): fseek
ftell(): ftell
fopen(): fopen
memmem(): System's

regards, lacsaP.

[magnumripper]

This is not a support forum but here's a hint (I bet):

$ which perl

vs.

$ head -1 pdf2john

and if I'm right you should be able to bypass the shebang line like this:

$ perl pdf2john /tmp/test.pdf > /tmp/pdf

[magnumripper]

Hm, no that's probably not it. I see now we use a local ExifTool lib, not sure if it's customized in some way. Anyway so I believe the problem is you didn't copy the run/lib directory when you moved/copied the pdf2john script to /bin

[patatetom]

hi,
I've installed JTR with pacman, the package manager of ArchLinux.

$ which perl
/bin/perl

$ which pdf2john 
/bin/pdf2john

$ head -1 /bin/pdf2john
#!/usr/bin/env perl

$ perl /bin/pdf2john
Can't locate ExifTool.pm in @INC (you may need to install the ExifTool module) (@INC contains: /bin/lib /home/use/perl5/lib/perl5/5.30.0/x86_64-linux-thread-multi /home/user/perl5/lib/perl5/5.30.0 /home/user/perl5/lib/perl5/x86_64-linux-thread-multi /home/user/perl5/lib/perl5 /usr/lib/perl5/5.30/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/5.30/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/5.30/core_perl /usr/share/perl5/core_perl) at /bin/pdf2john line 39.
BEGIN failed--compilation aborted at /bin/pdf2john line 39.

note that the script fails if Image::ExifTool is installed in system space or user space.

also note that the script indicates to install ExifTool module, but cpan does not find any such packages.

regards, lacsaP.

[magnumripper]

You should probably open an issue with ArchLinux instead. Do you have a /bin/lib directory, containing ExifTool.pm?

[patatetom]

this is done here.

I've no /bin/lib/ directory, but ExifTool.pm is installed in /usr/share/perl5/vendor_perl/Image/ExifTool.pm.

$ pacman -Ql | grep -i exiftool.pm
perl-image-exiftool /usr/share/perl5/vendor_perl/Image/ExifTool.pm

$ ls -l /usr/share/perl5/vendor_perl/Image/ExifTool.pm
-r--r--r-- 1 root root 357323 12 juin  20:44 /usr/share/perl5/vendor_perl/Image/ExifTool.pm

$ file /usr/share/perl5/vendor_perl/Image/ExifTool.pm
/usr/share/perl5/vendor_perl/Image/ExifTool.pm: Perl5 module source, UTF-8 Unicode text

I don't know Perl, but /usr/share/perl5/vendor_perl is in @inc and /usr/share/perl5/vendor_perl/Image is not in @inc...

[anthraxx]

@patatetom Its not really nice to open the same issue for investigation on multiple places at the very same time (yesterday). While its correct that upstream issues should be reported upstream, this is primarily a packaging issue which I already started investigating and the proper place would be exclusively on the Arch bug tracker.

Yes, the exif lib distributed with john isn't anything similar or compatible to the latest official Image::ExifTool module, in fact it was never meant to be compatible as the use statement explicitly just includes ExifTool instead of Image::ExifTool.

However, there is a non-nice handling of @inc in the script (which makes import from local lib work) that doesn't allow using the script as a symlinked target anywhere in $PATH. I already have a patch present and just go through some testing before opening a PR.

[patatetom]

thanks @anthraxx and sorry for duplicate issue (my goal was simply to speed up the resolution of the problem by knocking on several doors, eg. package maintainers and developers).

[mb720]

Is this fix part of John the Ripper 1.9.0-jumbo-1 MPI + OMP [linux-gnu 64-bit x86_64 AVX AC] on Arch Linux?

Because I just ran into this with pdf2john encrypted.pdf:

Can't locate ExifTool.pm in @INC (you may need to install the ExifTool module) (@INC contains: /usr/bin/lib /usr/lib/perl5/5.32/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/5.32/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/5.32/core_perl /usr/share/perl5/core_perl) at /usr/bin/pdf2john line 39.
BEGIN failed--compilation aborted at /usr/bin/pdf2john line 39.

ExifTool.pm is at /usr/share/perl5/vendor_perl/Image/ExifTool.pm.

/usr/bin/pdf2john contains this line:

my $version = '8.99';

[solardiz]

@mb720 We're developers of JtR jumbo, we're not that familiar with its packaging by Arch Linux to reliably know the answer to your question. However, the fact that https://bugs.archlinux.org/task/63626 is not closed suggests the bug is not fixed. @anthraxx might want to say more, or just count this as another vote for getting that bug fixed. Edit: especially as he apparently got the bug fixed for us upstream in #4091 (thanks!) and just needs to include that fix in the Arch Linux package?

I would also appreciate distro packagers' comments on #4281. I realize that part of the reason this bug even exists is that JtR is such a mix of different programs, scripts, and libraries that the scripts use that it's difficult to package right. Historically, it wasn't intended to be packaged at all, but we'd like to become more packaging-friendly over time.

[mb720]

@solardiz: When I said "this fix" I was referring to commit 66cf12d that was merged.

Upon comparing the commit and my local /usr/bin/pdf2john, I can see that the fix has not landed in current Arch, since this line is still here:

$exeDir = ($0 =~ /(.*)[\\\/]/) ? $1 : '.';

(Instead of the commit's $exeDir = (realpath($0) =~ /(.*)[\\\/]/) ? $1 : '.';

I didn't want to suggest that you are responsible for Arch Linux packaging. I'm very glad to hear that you want to get packaging-friendly, though. 👍

[patatetom]

it's a simple packaging problem : the perl modules present in the run/lib/ folder are not included in the package and therefore missing at the time of running pdf2john.

https://bugs.archlinux.org/task/63626

thanks for your help and, of course, for JtR :-).

[anthraxx]

@solardiz @mb720 @patatetom I've tested and authored this patch to fix this issue but then simply forgot to release it in the Arch package as well. 🙈 I will push an update in the evening, thanks for pinging again and sorry for the delay.

[steffen678]

So, any news about the update? :/

[claudioandre-br]

So, any news about the update? :/

As solar said here #4089 (comment), JtR developers can't really help.

[steffen678]

My question was directed @anthraxx, who said he would push an update that evening, but the package is still broken as of now. Thanks for your reply though!