Help on Encrypted PDF file

[Aiyps]

I have a PDF which has Password protected , when Open with that HEX editor ,I see the Encrypted junk , then I removed the password using tools , now i can open that PDF without password .now......

I still see the encrypted junk only in the new file ( some header of that tool has been added ) , Just want to understand , How the password remover removed password option though it is encrypted ?? if it is decrypted .. why i am not able to see the data in the new file thro hex editor .. How the password option was removed?? ... please help me to understand

[Hemanshu Asolia]

Aiyps, 

I think you tool is not properly decrypting the file.  

 I would suggest first open the pdf file with a good text editor, 
and look a string like "/Encrypt 1 0 R", this would tell you where you encrypt dictionary is. 

Now further looking at the dictionary you'll get the information what filters were used, what encryption algorithms are involved. If the filter is standard then if I remember correctly RC40 would be used, which with the standard password 'should' be brute forcible, I believe that's what your tool is also hoping for however if there is a custom filter involved that you have to decrypt accordingly. 

here some food for your thought.

http://www.cs.cmu.edu/~dst/Adobe/Gallery/anon21jul01-pdf-encryption.txt

 

On Fri, Mar 25, 2011 at 5:46 PM, Aiyps <ctn...@gmail.com> wrote:

I have a PDF which has Password protected , when Open with that HEX editor ,I see the Encrypted junk , then I removed the password using tools , now i can open that PDF without password .now......

I still see the encrypted junk only in the new file ( some header of that tool has been added ) , Just want to understand , How the password remover removed password option though it is encrypted ?? if it is decrypted .. why i am not able to see the data in the new file thro hex editor .. How the password option was removed?? ... please help me to understand

--
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
 
This list is supported by Institute of Information Security http://iisecurity.in
Real-world hackers, real-world training – Certified Professional Hacker at IIS

--
-- hemanshu

[Manthan]

if you still have password protected file, then try this 

import pyPdf                                                                

pdf = pyPdf.PdfFileReader(open("file.pdf"))

pdf.decrypt("password")

this will work fine with 256bit of encrypted password

On Fri, Mar 25, 2011 at 5:46 PM, Aiyps <ctn...@gmail.com> wrote:

I have a PDF which has Password protected , when Open with that HEX editor ,I see the Encrypted junk , then I removed the password using tools , now i can open that PDF without password .now......

I still see the encrypted junk only in the new file ( some header of that tool has been added ) , Just want to understand , How the password remover removed password option though it is encrypted ?? if it is decrypted .. why i am not able to see the data in the new file thro hex editor .. How the password option was removed?? ... please help me to understand

--

null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
 
This list is supported by Institute of Information Security http://iisecurity.in
Real-world hackers, real-world training – Certified Professional Hacker at IIS

--

Thanks & Regards

mhshah

+91-9967771131/ +91-9029092684

My profiles: Facebook LinkedIn
Contact me: shahma...@gmail.com  mhsh...@hotmail.com

[Hemanshu Asolia]

Wait.. you already have the password...then why you need a 'tool' to decrypt it?  Are you using Adobe reading because most of the open-source sol. don't handle encrypted pdfs well. 

On Fri, Mar 25, 2011 at 6:27 PM, Aiyps <ctn...@gmail.com> wrote:

the tool didn't crack it out .. i gave the password of the file , then it removes the password option only ( next time it won't prompt for the password ) , .. the file is my mobile bill statement only .. so when I give the password to open , it is not decrypting completely ??? ,still i see the encrypted junk der ..

if it encrypted how does the tool removes the password option ???

--
-- hemanshu

[Aiyps]

the tool didn't crack it out .. i gave the password of the file , then it removes the password option only ( next time it won't prompt for the password ) , .. the file is my mobile bill statement only .. so when I give the password to open , it is not decrypting completely ??? ,still i see the encrypted junk der ..

if it encrypted how does the tool removes the password option ???

On 25 March 2011 18:13, Hemanshu Asolia <asol...@gmail.com> wrote: