mufeedvh / pdfrip

A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.
MIT License
589 stars 67 forks source link

can't crack the aes256 ones #3

Closed canyazbahar closed 7 months ago

canyazbahar commented 1 year ago

I can't crack the pdf i created. and password is 123456. it can only crack acrobat 6 and 7 versions. not X versions.

settings

github59173 commented 1 year ago

Yup, this is a problem with newer PDF formats which is quite annoying. I hoped this would have been updated by now but it hasn't.

mufeedvh commented 7 months ago

This has been implemented in v2.0.0. Thanks for opening this issue! :raised_hands:

Pommaq commented 6 months ago

I did a bit of reading to confirm this.

Reading crypt.rs from "pdf" crate gives me the following snippets of code:

pub enum CryptMethod {
    None,
    V2,
    AESV2,
    AESV3,
}

which appears to be used internally to that crate to represent how the PDF file has been encrypted.

Looking at it's usage we see:

match () { // snipped

            CryptMethod::AESV3 => {
                if data.len() < 16 {
                    return Err(PdfError::DecryptionFailure);
                }
                let (iv, ciphertext) = data.split_at_mut(16);
                let cipher =
                    t!(Aes256CbcDec::new_from_slices(self.key(), iv).map_err(|_| PdfError::DecryptionFailure));
                Ok(t!(cipher
                    .decrypt_padded_mut::<Pkcs7>(ciphertext)
                    .map_err(|_| PdfError::DecryptionFailure)))
            }
}

where the keyword is Aes256CbcDec. Reading this bit of code I make the assumption this issue is properly resolved. Then again, I'm too lazy to verify this by testing