{"id":1090,"date":"2016-09-07T18:37:16","date_gmt":"2016-09-07T18:37:16","guid":{"rendered":"http:\/\/blog.paranoidprofessor.com\/?p=1090"},"modified":"2017-07-27T16:14:35","modified_gmt":"2017-07-27T16:14:35","slug":"security-through-obscurity-pdf-removing-passwords","status":"publish","type":"post","link":"https:\/\/blog.paranoidprofessor.com\/index.php\/2016\/09\/07\/security-through-obscurity-pdf-removing-passwords\/","title":{"rendered":"Security through obscurity – pdf removing passwords"},"content":{"rendered":"

Initially I was not planning on writing about how to crack pdf passwords. \u00a0After all, that would be irresponsible much in the way giving a knife to a small child is irresponsible – right?<\/p>\n

Well, simply typing in the following three words into your search engine.<\/p>\n

pdf password recovery<\/strong><\/p><\/blockquote>\n

This search will return quite a few entries that can be purchased or downloaded for free. \u00a0This blog posting will help you most with pdf’s you created with a password that wasn’t overly strong. \u00a0If you are looking strong passwords you might be taking months or centuries to crack your password<\/a>.<\/p>\n

I received a pdf file that was protected with a password. \u00a0Apparently there was a slight miscommunication of what the password was and so I couldn’t open the file that was intended for me.<\/p>\n

Guessing passwords, especially if you have no idea about the length or how secure the password is – is foolish.\u00a0\u00a0Despite how fast the computers are today they are not fast enough to break an arbitrarily long and complex password.<\/p>\n

A four character password actually can be brute force broken without any real effort in less than 2 minutes<\/p>\n

>echo 23:31:42,30
\n23:31:42,30<\/p>\n

>..\\pdfcrack file-4char.pdf
\nPDF version 1.4
\nSecurity Handler: Standard
\nV: 2
\nR: 3
\nP: -3904
\nLength: 128
\nEncrypted Metadata: True
\nFileID: ee806bec8c858dd1bdd1575322c0202b
\nU: 5a1e5f56878012e4b920c42d2616f85900000000000000000000000000000000
\nO: 18512d0db798a3154a508336074c85f9171b9147980a8a2a48009fc1a1cf91aa
\nAverage Speed: 42185.4 w\/s. Current Word: ‘lDGc’
\nAverage Speed: 42201.3 w\/s. Current Word: ‘Gceg’
\nAverage Speed: 42447.3 w\/s. Current Word: ‘m3Mj’
\nAverage Speed: 42391.4 w\/s. Current Word: ‘1Bln’
\nAverage Speed: 42208.1 w\/s. Current Word: ‘xdTq’
\nfound user-password: ‘Pass’<\/p>\n

>echo 23:33:31,21
\n23:33:31,21<\/p><\/blockquote>\n

If you can narrow down the composition of\u00a0the password it is even faster at about a minute.<\/p>\n

>echo 22:56:23,41
\n22:56:23,41<\/p>\n

>..\\pdfcrack file-4char.pdf -c abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ -n 4
\nPDF version 1.4
\nSecurity Handler: Standard
\nV: 2
\nR: 3
\nP: -3904
\nLength: 128
\nEncrypted Metadata: True
\nFileID: ee806bec8c858dd1bdd1575322c0202b
\nU: 5a1e5f56878012e4b920c42d2616f85900000000000000000000000000000000
\nO: 18512d0db798a3154a508336074c85f9171b9147980a8a2a48009fc1a1cf91aa
\nAverage Speed: 42185.2 w\/s. Current Word: ‘ebag’
\nAverage Speed: 42079.4 w\/s. Current Word: ‘znZl’
\nAverage Speed: 42294.0 w\/s. Current Word: ‘veas’
\nfound user-password: ‘Pass’<\/p>\n

echo 22:57:24,61
\n22:57:24,61<\/p><\/blockquote>\n

Just extending the password by one more character moves the task from the minutes to the hours.<\/p>\n

I was lucky because the document wasn’t that important and the password was all lowercase letters (and not too long).<\/p>\n

Had the task been a bit more complex I\u00a0never could have managed to crack the code that fast. \u00a0Had it taken longer, the time from that timezone would have changed\u00a0and I would have been able to pick up the phone and get a new file.<\/p>\n

The pdfcrack utility doesn’t take full advantage of multi threading on modern computers. \u00a0This is actually the only serious drawback for this program. \u00a0The task of brute forcing passwords while using it is less of a slam dunk with one thread versus four\u00a0or more.<\/p>\n

pdfcrack -t 4 receipe128.pdf<\/strong><\/p>\n

1:13:24,60
\nPDF version 1.4
\nSecurity Handler: Standard
\nV: 2
\nR: 3
\nP: -1852
\nLength: 128
\nEncrypted Metadata: True
\nFileID: 2625660821a90493e6068fab2aae37c8
\nU: 4e25fb3aea8995c47eed5bcafb67bc0300000000000000000000000000000000
\nO: 793706a064e35128a24bb79929a29805a1b0e20163d8edcf431da912648bdcae
\nthread 0 started
\nthread 1 started
\nthread 2 started
\nthread 3 started
\nAverage Speed: 161666.2 w\/s. Current Word: ‘3Jxc’
\nAverage Speed: 161633.8 w\/s. Current Word: ‘7iWf’
\nAverage Speed: 162077.2 w\/s. Current Word: ‘zslj’
\nAverage Speed: 162074.8 w\/s. Current Word: ‘5DKm’
\nThread 3 found password: ‘Pass’
\njoined thread 0
\njoined thread 1
\njoined thread 2
\njoined thread 3
\nfound user-password: ‘Pass’
\n1:13:53,10<\/p><\/blockquote>\n

The changes to support multi threading don’t appear to be base build of the pdfcrack tool but it is possible to get a copy that does from the following site.<\/p>\n

http:\/\/andi.flowrider.ch\/research\/pdfcrack.html<\/a><\/p>\n

Source code<\/strong><\/p>\n

http:\/\/andi.flowrider.ch\/research\/public\/pdfcrack\/pdfcrack.tar<\/a><\/p>\n

Windows binary<\/strong><\/p>\n

http:\/\/andi.flowrider.ch\/research\/public\/pdfcrack\/pdfcrack_windows.zip<\/a><\/p><\/blockquote>\n

During my testing I had a chance to experiment more with PDF’s. \u00a0It is a lot easier during testing if you can easily add and remove passwords.<\/p>\n

The PDFTK tool does offer a number of different abilities to manipulate pdf files including both adding and removing passwords.<\/p>\n

 <\/p>\n

Secure PDF with password<\/h2>\n

The entire reason I became familiar with the PDFTK tool was because it was a command line program that could be used to encrypt pdf files.\u00a0 It is much easier to quickly type up the following command to “lock up” your pdf.<\/p>\n

pdftk <source pdf> output <encrypted pdf> owner_pw <owner pass> user_pw <user pass> allow printing\r\n\r\npdftk receipe.pdf output receipe-encr128.pdf owner_pw secretpw user_pw pass6\r\n<\/code><\/pre>\n
The owner password is required for setting or clearing the password to prevent people from reading your document. \u00a0The user password is that password. \u00a0It is the user password that you are prompted for when opening up your encrypted PDF file.<\/p>\n
The last two parameters on the command line actually are very self explanatory. \u00a0When you add “allow printing” you can also print the PDF file once you enter your password. \u00a0It is not clear if every open source PDF viewer respects that flag but Adobe reader certainly does.<\/p>\n
There are a few other permissions you can grant.<\/p>\n