RAR3-p (Compressed) - Possible Bug

RAR3-p (Compressed) - Possible Bug - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: RAR3-p (Compressed) - Possible Bug (/thread-13285.html)

RAR3-p (Compressed) - Possible Bug - simcard - 06-08-2025

Hi everyone,
I used hashcat to crack the hash of an old rar archive, which I don't remember the password.

First of all I ran the command:

Code:
rar2john.exe videos.rar

Then I removed on the start the string

Code:
videos.rar:

and at the end the string

Code:
:1::imp\Video0346.mp4 imp\Video0347.mp4 imp\Video0348.mp4 imp\Video0349.mp4 imp\Video0350.mp4 imp\Video0351.mp4 imp\Video0352.mp4 imp\Video0353.mp4 imp\Video0354.mp4 imp\Video0355.mp4 imp

So what remains is

Code:
$RAR3$*1*6e6a5d923bf784d7*bef92221*117232*131815*1*df1f8af8894f8fc833d6e80f61268ebf3195d7a0...800ca89552ec30a7*33

I found the correct hash format and set it, so I launched hashcat:

Code:
hashcat.exe -m 23800 ..\rar3-compressed.hash -a 3 ..\rar.hcmask

The hash is cracked, but the password does not work in the archive. So I also tried with john and the same password inside a wordlist, but it is not detected as cracked. Is it possible that this is a bug? Should I perhaps open a report on github? Do I need to provide the full hash and the detected password? I cannot provide the archive because it contains personal videos.

Thanks