rar2john works for rar 4.10 multipart rar
so I downloaded rar 4.10 via archive.org image of rarlabs site, and it seems to be problematic for a multipart rar file
I create a 100MB file of 0s
dd if=/dev/zero of=tmp bs=1M count=100I create a multipart rar archive
rar a -m0 -hppassword -v10m test.rar tmpI run rar2john on them which generates this hashes file
test.part01.rar:$RAR3$*0*a2b2dd9f4894c104*6e0306bbc06f4d2160ee0f979b2a86e7:0::::test.part01.rar
test.part02.rar:$RAR3$*0*82a956ec85b7e110*c50b2aa602b45fb804aad0570c894827:0::::test.part02.rar
test.part03.rar:$RAR3$*0*74404479a24aaf24*d8b5eeeda68881ffed4b87dccf33e05e:0::::test.part03.rar
test.part04.rar:$RAR3$*0*ce8c626a7506965c*91e0398fcbaeb02e2b14e5529c6a5969:0::::test.part04.rar
test.part05.rar:$RAR3$*0*e7d3c84afa2ffb9f*f98f1baffacd94d27f01d1f5479b6f22:0::::test.part05.rar
test.part06.rar:$RAR3$*0*c1d2ccee51bf945f*7c71236a43ab772136845b1501ce042b:0::::test.part06.rar
test.part07.rar:$RAR3$*0*b5cecc223b818e94*665528870a54a1ee5244bf6130496b4f:0::::test.part07.rar
test.part08.rar:$RAR3$*0*06ec0d9bcfde0d8e*ac39db7461924d2e21d9a9a8d601a28c:0::::test.part08.rar
test.part09.rar:$RAR3$*0*22969d6c2105e890*91a23aebe5051db072e4ee5a70c9391e:0::::test.part09.rar
test.part10.rar:$RAR3$*0*d47ded8e0793a07d*1e7bcc27b6525d3b2304d6774be2d4c5:0::::test.part10.rar
test.part11.rar:$RAR3$*0*54fea8823a0a9149*bdbb61b6890d67b05bde2b9337f0aa37:0::::test.part11.rarthis is the first clue to me that something isn't right, as the salts are all different, I'd assume they all have to be the same, but I guess it could use the same password for each file with a different salt?
but, when I try to have josh crack it by giving it the password, it fails
$ john hashes --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 11 password hashes with 11 different salts (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
0g 0:00:00:03 0g/s 0.3279p/s 3.607c/s 3.607C/s password
Session completed.now, when I create a single part archive
rar a -m0 -hppassword test.rar tmprar2john generates this hash
test.rar:$RAR3$*0*d0b7fdd315f4057c*8cca0883b93eb951a018365e37ac6306:0::::test.rarthis works as expected
~/git/john/run/john hashes1 --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
password (test.rar)
1g 0:00:00:01 0.5917g/s 0.5917p/s 0.5917c/s 0.5917C/s password
Use the "--show" optone thing I notice when creating these multipart rar file with 4.10, is that after it seemingly finishes that volume, it does some more work, than modern versions of rar don't say they are doing, namely
Calculating the control sumI wonder if this data is unexpected by rar2john and is causing the problems?
Source: openwall/john