hashcat Forum
Rar2John - Salt w/0000000000000000 - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Rar2John - Salt w/0000000000000000 (/thread-6635.html)

Rar2John - Salt w/0000000000000000 - ag1122 - 06-12-2017

Hello -

Sorry if this is a dumb question, but I've never run across this...

I'm working on a RAR file (with headers encrypted), and I'm seeing (what I believe to be the) salt from rar2john that I haven't seen before, and wanted to ask folks for their thoughts.  I've tested with numerous versions of rar going back a few years, but haven't been able to reproduce.

FILENAME:$RAR3$*0*0000000000000000*0d7...<normal rar2john output>

Anyone else see this before?



RE: Rar2John - Salt w/0000000000000000 - magnum - 06-13-2017

That's the salt, yes. I haven't seen anything like that. On a side note I saw many same-salts when I rar'ed a lot of small files in a batch, which led me to believe the salt was somehow correlated to wall clock.

RE: Rar2John - Salt w/0000000000000000 - ag1122 - 06-13-2017

Thanks much, and interesting theory. I'll see if I can test it out a bit. Thanks again!