Rar - one hash
#1
Why hashcat is taking only one WinRAR 5.0 hash for its work?
I've given file with 4 hashes...
Reply
#2
(12-10-2022, 10:05 PM)marc1n Wrote: There could be many reasons, the same hash or different ones? Show this list (censored)

Attached.

4 files in archive, maybe 4 different passwords?


Attached Files
.png   2022-12-10 21-06-55-840 sublime_text.png (Size: 18.69 KB / Downloads: 12)
Reply
#3
(12-10-2022, 10:24 PM)marc1n Wrote: This is a fake archive of 420 BTC

So why hashcat is taking only one hash?

File is not relevant here.
Reply
#4
(12-10-2022, 10:28 PM)marc1n Wrote:
(12-10-2022, 10:26 PM)pbies Wrote:
(12-10-2022, 10:24 PM)marc1n Wrote: This is a fake archive of 420 BTC

So why hashcat is taking only one hash?

File is not relevant here.

By the way of compression of this rar archive

And what is that?
Each file with separate password?
Reply
#5
(12-10-2022, 10:40 PM)marc1n Wrote:
(12-10-2022, 10:29 PM)pbies Wrote:
(12-10-2022, 10:28 PM)marc1n Wrote:
(12-10-2022, 10:26 PM)pbies Wrote:
(12-10-2022, 10:24 PM)marc1n Wrote: This is a fake archive of 420 BTC

So why hashcat is taking only one hash?

File is not relevant here.

By the way of compression of this rar archive

And what is that?
Each file with separate password?

Probably yes

Probably?
So you don't know what are you talking about?
Reply
#6
How does your hashcat command look like? What makes you say only one hash is worked on? Have you remembererd to remove the filename in front of the hashes? Or do you use --username parameter?
Reply
#7
(12-11-2022, 11:01 AM)b8vr Wrote: How does your hashcat command look like? What makes you say only one hash is worked on? Have you remembererd to remove the filename in front of the hashes? Or do you use --username parameter?

Command is:

hashcat -m 13000 -a 0 -w 3 %hash% %pwds% -o %out% --session=%t% --status --status-timer 10

There is "Recovered: 0/1" even if in the file are 4 hashes. Yes, I've removed the file names. I don't use --username parameter.
Reply