Why won't pdf2john extract the password hash of this encrypted pdf? Getting blank results

Question

New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem.

I have a password protected PDF file that I'm trying to crack to prove to a friend of mine that it can be done (or not as the case may be).

The problem is this:
I run pdf2john.pl on the file and put it out to a .txt or hash file. However, all I get is "name.pdf: " and nothing where the hash should be. Am I doing something wrong, or does pdf2john not work for this instance?

Answer 1

Does it work when you try to encrypt and crack a PDF yourself?

Here is a rundown on encrypting and cracking it with the tools you described:

• Get a sample PDF file sample.pdf.

• Encrypt it. I'm using qpdf with the password abc123.

  $ qpdf --encrypt abc123 abc123 256 -- sample.pdf sample_encrypted.pdf
  

• Extract the hash.

  $ ./pdf2john.pl pdf-sample_encrypted.pdf > pass.john   
  

  (I used pdf2john.pl from here.)

• Crack the hash.

  $ john pass.john
  Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
  Will run 4 OpenMP threads
  Press 'q' or Ctrl-C to abort, almost any other key for status
  abc123           (sample_encrypted.pdf)
  1g 0:00:00:35 DONE 2/3 (2018-04-12 13:37) 0.02787g/s 585.4p/s 585.4c/s 585.4C/s 123456..franklin
  
  Use the "--show" option to display all of the cracked passwords reliably
  Session completed
  

If it works when you encrypt it following these steps, but not with the file you got, consider that the file may be corrupt or encrypted with an unsupported method. Ask your friend how he encrypted it and try to reproduce it with his approach. Ultimately, without access to the file it's hard to pin down out where exactly you went wrong.