rar2john works for rar 4.10 multipart rar
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
so I downloaded rar 4.10 via archive.org image of rarlabs site, and it seems to be problematic for a multipart rar file
I create a 100MB file of 0s
dd if=/dev/zero of=tmp bs=1M count=100
I create a multipart rar archive
rar a -m0 -hppassword -v10m test.rar tmp
I run rar2john on them which generates this hashes file
test.part01.rar:$RAR3$*0*a2b2dd9f4894c104*6e0306bbc06f4d2160ee0f979b2a86e7:0::::test.part01.rar
test.part02.rar:$RAR3$*0*82a956ec85b7e110*c50b2aa602b45fb804aad0570c894827:0::::test.part02.rar
test.part03.rar:$RAR3$*0*74404479a24aaf24*d8b5eeeda68881ffed4b87dccf33e05e:0::::test.part03.rar
test.part04.rar:$RAR3$*0*ce8c626a7506965c*91e0398fcbaeb02e2b14e5529c6a5969:0::::test.part04.rar
test.part05.rar:$RAR3$*0*e7d3c84afa2ffb9f*f98f1baffacd94d27f01d1f5479b6f22:0::::test.part05.rar
test.part06.rar:$RAR3$*0*c1d2ccee51bf945f*7c71236a43ab772136845b1501ce042b:0::::test.part06.rar
test.part07.rar:$RAR3$*0*b5cecc223b818e94*665528870a54a1ee5244bf6130496b4f:0::::test.part07.rar
test.part08.rar:$RAR3$*0*06ec0d9bcfde0d8e*ac39db7461924d2e21d9a9a8d601a28c:0::::test.part08.rar
test.part09.rar:$RAR3$*0*22969d6c2105e890*91a23aebe5051db072e4ee5a70c9391e:0::::test.part09.rar
test.part10.rar:$RAR3$*0*d47ded8e0793a07d*1e7bcc27b6525d3b2304d6774be2d4c5:0::::test.part10.rar
test.part11.rar:$RAR3$*0*54fea8823a0a9149*bdbb61b6890d67b05bde2b9337f0aa37:0::::test.part11.rar
this is the first clue to me that something isn't right, as the salts are all different, I'd assume they all have to be the same, but I guess it could use the same password for each file with a different salt?
but, when I try to have josh crack it by giving it the password, it fails
$ john hashes --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 11 password hashes with 11 different salts (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
0g 0:00:00:03 0g/s 0.3279p/s 3.607c/s 3.607C/s password
Session completed.
now, when I create a single part archive
rar a -m0 -hppassword test.rar tmp
rar2john generates this hash
test.rar:$RAR3$*0*d0b7fdd315f4057c*8cca0883b93eb951a018365e37ac6306:0::::test.rar
this works as expected
~/git/john/run/john hashes1 --mask=password
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (rar, RAR3 [SHA1 128/128 AVX 4x AES])
Will run 48 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1 candidate buffered, minimum 192 needed for performance.
password (test.rar)
1g 0:00:00:01 0.5917g/s 0.5917p/s 0.5917c/s 0.5917C/s password
Use the "--show" opt
one thing I notice when creating these multipart rar file with 4.10, is that after it seemingly finishes that volume, it does some more work, than modern versions of rar don't say they are doing, namely
Calculating the control sum
I wonder if this data is unexpected by rar2john and is causing the problems?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at rar2john and reproduce the reported RAR 4.10 multipart and single-part commands, then compare the extracted RAR3 hashes and John results. Investigate whether the multipart volume data, including the reported “Calculating the control sum” step, is handled correctly; done means the multipart hash set accepts the known password as the single-part case does.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100