openwall / openwall/john

rar2john works for rar 4.10 multipart rar

Open
#5,817 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement question
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

so I downloaded rar 4.10 via archive.org image of rarlabs site, and it seems to be problematic for a multipart rar file

I create a 100MB file of 0s

dd if=/dev/zero of=tmp bs=1M count=100

I create a multipart rar archive

rar a -m0 -hppassword -v10m test.rar tmp

I run rar2john on them which generates this hashes file

test.part01.rar:$RAR3$*0*a2b2dd9f4894c104*6e0306bbc06f4d2160ee0f979b2a86e7:0::::test.part01.rar
test.part02.rar:$RAR3$*0*82a956ec85b7e110*c50b2aa602b45fb804aad0570c894827:0::::test.part02.rar
test.part03.rar:$RAR3$*0*74404479a24aaf24*d8b5eeeda68881ffed4b87dccf33e05e:0::::test.part03.rar
test.part04.rar:$RAR3$*0*ce8c626a7506965c*91e0398fcbaeb02e2b14e5529c6a5969:0::::test.part04.rar
test.part05.rar:$RAR3$*0*e7d3c84afa2ffb9f*f98f1baffacd94d27f01d1f5479b6f22:0::::test.part05.rar
test.part06.rar:$RAR3$*0*c1d2ccee51bf945f*7c71236a43ab772136845b1501ce042b:0::::test.part06.rar
test.part07.rar:$RAR3$*0*b5cecc223b818e94*665528870a54a1ee5244bf6130496b4f:0::::test.part07.rar
test.part08.rar:$RAR3$*0*06ec0d9bcfde0d8e*ac39db7461924d2e21d9a9a8d601a28c:0::::test.part08.rar
test.part09.rar:$RAR3$*0*22969d6c2105e890*91a23aebe5051db072e4ee5a70c9391e:0::::test.part09.rar
test.part10.rar:$RAR3$*0*d47ded8e0793a07d*1e7bcc27b6525d3b2304d6774be2d4c5:0::::test.part10.rar
test.part11.rar:$RAR3$*0*54fea8823a0a9149*bdbb61b6890d67b05bde2b9337f0aa37:0::::test.part11.rar

this is the first clue to me that something isn't right, as the salts are all different, I'd assume they all have to be the same, but I guess it could use the same password for each file with a different salt?

but, when I try to have josh crack it by giving it the password, it fails

$ john hashes --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 11 password hashes with 11 different salts (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
0g 0:00:00:03  0g/s 0.3279p/s 3.607c/s 3.607C/s password
Session completed.

now, when I create a single part archive

rar a -m0 -hppassword test.rar tmp

rar2john generates this hash

test.rar:$RAR3$*0*d0b7fdd315f4057c*8cca0883b93eb951a018365e37ac6306:0::::test.rar

this works as expected

~/git/john/run/john hashes1 --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
password         (test.rar)
1g 0:00:00:01  0.5917g/s 0.5917p/s 0.5917c/s 0.5917C/s password
Use the "--show" opt

one thing I notice when creating these multipart rar file with 4.10, is that after it seemingly finishes that volume, it does some more work, than modern versions of rar don't say they are doing, namely

Calculating the control sum

I wonder if this data is unexpected by rar2john and is causing the problems?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at rar2john and reproduce the reported RAR 4.10 multipart and single-part commands, then compare the extracted RAR3 hashes and John results. Investigate whether the multipart volume data, including the reported “Calculating the control sum” step, is handled correctly; done means the multipart hash set accepts the known password as the single-part case does.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.