+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: $RAR3$*1* hash issue (/thread-11451.html)
$RAR3$*1* hash issue - Alexander Mak - 06-03-2023
I have a RAR3 hash from a winrar archive. Hashcat does not identify it with the --identify command and refuses to regenerate it (Error "No hash-mode matches the structure of the input hash.")
My hash starts with $RAR3$*1*81d3764c67e6e46e*6ba386d2*25952*5006154*1*7feaae5df85b61442591... and ends with c07abc24e18d6d61e18*34
This error also occurs when restoring another hash that starts with $RAR3$*1*7dace4a10add1054*05fd7be7*972160*981537*1*e0346f3570baad1178...
and ends with 66312b619ac542378e4797*35
Please help me solve this problem
RE: $RAR3$*1* hash issue - lapsikmees - 06-03-2023
23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
RE: $RAR3$*1* hash issue - Alexander Mak - 06-03-2023
(06-03-2023, 05:06 PM)aikiuslik Wrote: 23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
RE: $RAR3$*1* hash issue - marc1n - 06-03-2023
(06-03-2023, 05:36 PM)Alexander Mak Wrote:(06-03-2023, 05:06 PM)aikiuslik Wrote: 23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
These hashes are not compatible you must try john the ripper
RE: $RAR3$*1* hash issue - Alexander Mak - 06-03-2023
(06-03-2023, 05:59 PM)marc1n Wrote:(06-03-2023, 05:36 PM)Alexander Mak Wrote:(06-03-2023, 05:06 PM)aikiuslik Wrote: 23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
These hashes are not compatible you must try john the ripper
I extracted these hashes with john the ripper using the rar2john 25.rar > 25.hash and rar2john 26.rar > 26.hash commands. Files with these hashes are created, then I delete the archive name and symbols :1:: in these files, leaving the beginning with $RAR3$*1*81d3764... and the end 61e18*34 (also with the second hash) in the last line. What else do I need to do with these hashes using john the ripper?
RE: $RAR3$*1* hash issue - marc1n - 06-03-2023
(06-03-2023, 06:17 PM)Alexander Mak Wrote:(06-03-2023, 05:59 PM)marc1n Wrote:(06-03-2023, 05:36 PM)Alexander Mak Wrote:(06-03-2023, 05:06 PM)aikiuslik Wrote: 23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
These hashes are not compatible you must try john the ripper
I extracted these hashes with john the ripper using the rar2john 25.rar > 25.hash and rar2john 26.rar > 26.hash commands. Files with these hashes are created, then I delete the archive name and symbols :1:: in these files, leaving the beginning with $RAR3$*1*81d3764... and the end 61e18*34 (also with the second hash) in the last line. What else do I need to do with these hashes using john the ripper?
Nothing you need to use rar2john your_file.rar > output_file next command john output_file
RE: $RAR3$*1* hash issue - Alexander Mak - 06-03-2023
(06-03-2023, 06:35 PM)marc1n Wrote:(06-03-2023, 06:17 PM)Alexander Mak Wrote:(06-03-2023, 05:59 PM)marc1n Wrote:(06-03-2023, 05:36 PM)Alexander Mak Wrote:(06-03-2023, 05:06 PM)aikiuslik Wrote: 23700 RAR3-p (Uncompressed) $RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30
23800 RAR3-p (Compressed) $RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33
Examples.
I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
These hashes are not compatible you must try john the ripper
I extracted these hashes with john the ripper using the rar2john 25.rar > 25.hash and rar2john 26.rar > 26.hash commands. Files with these hashes are created, then I delete the archive name and symbols :1:: in these files, leaving the beginning with $RAR3$*1*81d3764... and the end 61e18*34 (also with the second hash) in the last line. What else do I need to do with these hashes using john the ripper?
Nothing you need to use rar2john your_file.rar > output_file next command john output_file
In this case, recovery starts with the help of john the ripper.
As I understand it, my hashes are not compatible with hashcat and I won't be able to restore them using it
RE: $RAR3$*1* hash issue - lapsikmees - 06-03-2023
You can try crark.
RE: $RAR3$*1* hash issue - b8vr - 06-04-2023
(06-03-2023, 07:12 PM)Alexander Mak Wrote:(06-03-2023, 06:35 PM)marc1n Wrote:(06-03-2023, 06:17 PM)Alexander Mak Wrote:(06-03-2023, 05:59 PM)marc1n Wrote:(06-03-2023, 05:36 PM)Alexander Mak Wrote: I have seen examples of compressed and uncompressed hashes, but this does not solve my problem in any way. I know that both of these hashes are from compressed archives and that's why I used the 23800 mode. But hashcat still throws an error, you know? Maybe my hashes are not compatible with hashcat because they end in 34 and 35?
Using rar2john
These hashes are not compatible you must try john the ripper
I extracted these hashes with john the ripper using the rar2john 25.rar > 25.hash and rar2john 26.rar > 26.hash commands. Files with these hashes are created, then I delete the archive name and symbols :1:: in these files, leaving the beginning with $RAR3$*1*81d3764... and the end 61e18*34 (also with the second hash) in the last line. What else do I need to do with these hashes using john the ripper?
Nothing you need to use rar2john your_file.rar > output_file next command john output_file
In this case, recovery starts with the help of john the ripper.
As I understand it, my hashes are not compatible with hashcat and I won't be able to restore them using it
Rar2john is not John the Ripper, it's an external tool for hash extraction.
What marc1n is trying to tell you, is that you need to use john, as in the command just named "john". Like hashcat, that has a lot of options, but a very basic command would be to just run "john rar2john_output_file".