Bruteforce unknown encryption of expired PDF

3

I have an encrypted PDF. I have the password for it. 8 alphanumeric characters. But I think when you open it, it makes a connection to a DRM server to check if the content has expired, which it has.

I don't know what type of encryption is used.

I tried the tool pdfcrack which said the type was not supported. I tried pdfcrack.com which said it's a third party encryption.

I find it hard to believe that a university is employing custom encryption schemes. So how do I use a list of known encryption schemes to bruteforce the file until I get a valid PDF out?

Vernon

Posted 2015-12-29T02:17:42.560

Reputation: 39

So when you decrypt, it opens? Or you decrypt and then open the file? If the second, have you run the pdf through a hex editor? – moonbutt74 – 2015-12-29T02:35:02.133

1If the DRM says the content is expired, then you are legally not entitled to read it anymore. Trying to bypass this limitation would be violating laws, so you will have a hard time to get help with it (Jail, anyone?). I recommend you focus on verifying what really is the problem, and maybe it is not DRM. – Aganju – 2015-12-29T02:37:52.030

1@Anganju, You presume legal context which OP has not provided. OP may very well be entitled to break the DRM employed. – ebpa – 2015-12-29T04:01:45.673

The owner/author apparently went to considerable lengths to create and enforce a limitation on the content. You may be entitled to access it, but the way to do that is not to hack the encryption. The owner/author should be more than happy to provide you the means of access. – fixer1234 – 2015-12-29T06:47:12.887

Unless the owner/author has been swallowed by a whale and is dead. xD – moonbutt74 – 2015-12-29T07:07:30.800

With Adobe PDF Creator, it is trivial to add encryption. Infact many users often do so unwittingly. Anytime you add limitation PDF creator actually encrypts the content. The OP maybe well within his rights to decrypt the PDF, or he may not; it depends on his jurisdiction, as much as his circumstance surrounding his use the of the document. – David – 2015-12-30T17:11:24.783

I believe some of our security contractors have used elcom in the past: http://www.elcomsoft.co.uk/edpr.html#formats and here is their pdf password recovery tool: http://www.elcomsoft.co.uk/apdfpr.html

– David – 2015-12-30T17:21:32.133

Answers

1

The PDF standard includes 40/128 bit ARC4 and 128/256 bit AES. Unless the PDF was created a very long time ago or by someone very stupid, it is not using 40-bit ARC4 and you are not going to be able to brute-force the encryption.

Brian Duddy

Posted 2015-12-29T02:17:42.560

Reputation: 364