> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/offline-attacks/getting-hashes.md).

# Getting Hashes

## Getting the hash from files

### PDF file

Getting the hash from a password encrypted PDF-file

```bash
┌──(kali㉿kali)-[/mnt/…/Wargames/FIRST_CTF/Forensics/pdfcrypt]
└─$ pdf2john encrypted.pdf 
encrypted.pdf:$pdf$4*4*128*-4*1*16*1db41bb48e9dd31ec67a3a29a274480e*32*5bbb29f8836700ad2d4ad9329e76622b00000000000000000000000000000000*32*8911d092254cfa6e8805d444732c3ebcbee4aaf98042d588eeac0e633f7c9ac1
                                                                                                                                                                                        
┌──(kali㉿kali)-[/mnt/…/Wargames/FIRST_CTF/Forensics/pdfcrypt]
└─$ pdf2john encrypted.pdf > encrypted_pdf.hash

```

You will need to remove the first part (`filename.pdf:`) to use the hash with hashcat.

### PGP ASCII armored file

Getting the hash from a PGP ASCII armored file such as `private.asc`

```bash
┌──(kali㉿kali)-[/mnt/…/TryHackMe/CTFs/Easy/Anonforce]
└─$ gpg2john private.asc 

File private.asc
anonforce:$gpg$*17*54*2048*e419ac715ed55197122fd0acc6477832266db83b63a3f0d16b7f5fb3db2b93a6a995013bb1e7aff697e782d505891ee260e957136577*3*254*2*9*16*5d044d82578ecc62baaa15c1bcf1cfdd*65536*d7d11d9bf6d08968:::anonforce <melodias@anonforce.nsa>::private.asc

┌──(kali㉿kali)-[/mnt/…/TryHackMe/CTFs/Easy/Anonforce]
└─$ gpg2john private.asc > hash.txt

File private.asc
```

### SSH private key ([ssh2john](https://raw.githubusercontent.com/openwall/john/refs/heads/bleeding-jumbo/run/ssh2john.py))

Getting the hash from an SSH private key, normally the `id_rsa` file

```bash
ssh2john id_rsa_kay > kay_hash.txt
```

## Resources

John - Kali Tools: <https://www.kali.org/tools/john/>

John-data - Kali Tools: <https://www.kali.org/tools/john/#john-data>

John the Ripper - Homepage: <https://www.openwall.com/john/>