Cracking a password-protected PDF

A "password-protected" PDF does not store the key in cleartext: it derives an encryption key from it to protect the content, and stores in the file the parameters of that derivation (algorithm, salt, iteration count and a verification value). That is, in practice, a crackable hash: you do not need to break the encryption, just try dictionary passwords, derive the key from each and see which validates.

Extract the hash and crack

The standard flow in Kali uses pdf2john (from John the Ripper) to extract that material into a hash format, and then john or hashcat (mode 10500 for PDF) for the dictionary attack:

pdf2john Infrastructure.pdf > hash
john --wordlist=/usr/share/wordlists/rockyou.txt hash
john --show hash
# hashcat alternative:
hashcat -m 10500 hash /usr/share/wordlists/rockyou.txt

If the password is in rockyou or a reasonable dictionary, it falls in seconds. The pace depends on the PDF's iteration count (modern PDFs with AES-256 and many iterations are much slower than old RC4 ones).

Open the document

Once the password is recovered, generate a decrypted copy to read it comfortably:

qpdf --password='<found>' --decrypt Infrastructure.pdf clear.pdf

Requirements

Having the PDF (it appears in a resource you already have access to: an FTP, a share, an attachment) and its password being weak or in a dictionary. It is a post-exploitation technique: its content (infrastructure notes, credentials, an internal endpoint) feeds the next step, and the PDF's own password may be reused (credential reuse) on another service.

How to detect it. The crack is offline and local, undetectable on the victim by design. The signal is the file access (a download of the PDF from a share or FTP: 5145/4663 on Windows, auditd on Linux) and, afterward, the reuse of whatever the PDF reveals. Watching who copies sensitive documents from shares is the detection route.

Defence. Document passwords must be long and unique; for sensitive material, use real encryption with key management instead of a document password, and do not distribute protected documents through services accessible to low-privilege users. It is a sibling of cracking protected files.