pdf2john.py does not extract pdf document with locked printing

[martiGIT]

While extracting password from pdf file with locked printing (only), hash is extracted, but cracking results with empty password (I assume that password hash is taken only form file lock, which in fact is empty). No option to extract printing password.

[magnumripper]

Could you by any chance submit a pdf file which has this problem? Obviously we could produce that ourselves but it would likely speed up the handling of this issue.

http://openwall.info/wiki/john/sample-non-hashes?&#PDF would be a good place.

[kholia]

@magnumripper sometimes, I feel like bringing the old pdf2john.pl back again. I am curious how it handles such files.

@martiGIT it would be awesome to have a sample problematic .pdf file.

[magnumripper]

I can't find any pdf2john.pl in history but we had src/pdf2john.c in 96e20a3^

[kholia]

My bad. I was thinking about the https://github.com/kholia/npdf2john project.

[martiGIT]

@magnumripper I does not have upload access to wiki page, so here is a link:
http://m.zyy.pl/f/0956b2311069c11e13972591a13a9667.pdf

[magnumripper]

Thanks. So @kholia could you take a look at this?

[magnumripper]

Hmm or perhaps @ShaneQful ?

[kholia]

@martiGIT @magnumripper I can print that .pdf file with no problems (using evince).

https://www.cs.cmu.edu/~dst/Adobe/Gallery/anon21jul01-pdf-encryption.txt might come in handy while debugging this problem.

[martiGIT]

@kholia @magnumripper right, this "permission" does not work with linux, I know, that if somebody want to print "print secured" document, there is an easy way to cheat it, but acrobat reader still won't permit printing.

[ShaneQful]

I can have a look at it after work tomorrow, if you'd like ... been meaning to try help out again anyway

[martiGIT]

@kholia great source.

As I marked, print permission is only a flag, which is respected by Adobe Acrobat (also Reader) (and other software as e.g. Finereader). If it is hard to extract this hash, we don't have to reinvent the wheel. The simplest way to remove this flag is to reprint (like print to pdf), or resave this kind of document in software that does not check additional permissions.

[kholia]

@martiGIT @magnumripper The old pdf2john.c had a flag to extract such hashes, IIRC. I haven't looked at it in a while though.

[ShaneQful]

No joy yet, although did find an issue with the last commit on this file not testing against the sample non hashes 292b35c