+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Rar2John - Salt w/0000000000000000 (/thread-6635.html)
Rar2John - Salt w/0000000000000000 - ag1122 - 06-12-2017
Hello -
Sorry if this is a dumb question, but I've never run across this...
I'm working on a RAR file (with headers encrypted), and I'm seeing (what I believe to be the) salt from rar2john that I haven't seen before, and wanted to ask folks for their thoughts. I've tested with numerous versions of rar going back a few years, but haven't been able to reproduce.
FILENAME:$RAR3$*0*0000000000000000*0d7...<normal rar2john output>
Anyone else see this before?
Thanks,
ag
RE: Rar2John - Salt w/0000000000000000 - magnum - 06-13-2017
That's the salt, yes. I haven't seen anything like that. On a side note I saw many same-salts when I rar'ed a lot of small files in a batch, which led me to believe the salt was somehow correlated to wall clock.
RE: Rar2John - Salt w/0000000000000000 - ag1122 - 06-13-2017
Thanks much, and interesting theory. I'll see if I can test it out a bit. Thanks again!