Rar archive
#1
Hello, I have a hash of the password from the rar archive.
I got it with john the ripper.
When I tried to recover it with hashcat, I got the following message "Hashfile '25.txt' on line 1 ($RAR3$...8exxxxx0d6xxx12b619acx42xxxxxx97*35): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)" . I looked here which hashes support hashcat
https://hashcat.net/wiki/doku.php?id=example_hashes
And my hash is not there, as I understand it, it turned out to be too long.
It turned out to be 1944374 characters and its size is almost two megabytes.
Tell me what I need to do so that hashcat reads it and starts the recovery?
I can attach the complete hash file if needed.
Reply
#2
(04-29-2023, 12:41 PM)Alexander Mak Wrote: Hello, I have a hash of the password from the rar archive.
I got it with john the ripper.
When I tried to recover it with hashcat, I got the following message "Hashfile '25.txt' on line 1 ($RAR3$...8exxxxx0d6xxx12b619acx42xxxxxx97*35): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)" . I looked here which hashes support hashcat
https://hashcat.net/wiki/doku.php?id=example_hashes
And my hash is not there, as I understand it, it turned out to be too long.
It turned out to be 1944374 characters and its size is almost two megabytes.
Tell me what I need to do so that hashcat reads it and starts the recovery?
I can attach the complete hash file if needed.

Did you edit the hash to make it fit hashcat, after extracting it? Using rar2john makes it crackable with hohn, but not hashcat, unless you remove all the data in front of or behind the hash. Also, what mode did you use, when running hashcat?
Reply
#3
(04-29-2023, 06:52 PM)b8vr Wrote:
(04-29-2023, 12:41 PM)Alexander Mak Wrote: Hello, I have a hash of the password from the rar archive.
I got it with john the ripper.
When I tried to recover it with hashcat, I got the following message "Hashfile '25.txt' on line 1 ($RAR3$...8exxxxx0d6xxx12b619acx42xxxxxx97*35): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)" . I looked here which hashes support hashcat
https://hashcat.net/wiki/doku.php?id=example_hashes
And my hash is not there, as I understand it, it turned out to be too long.
It turned out to be 1944374 characters and its size is almost two megabytes.
Tell me what I need to do so that hashcat reads it and starts the recovery?
I can attach the complete hash file if needed.

Did you edit the hash to make it fit hashcat, after extracting it? Using rar2john makes it crackable with hohn, but not hashcat, unless you remove all the data in front of or behind the hash. Also, what mode did you use, when running hashcat?

Yes, I edited the hash after using john the ripper.
I didn't use any special mode in hashcat, just typed in a command and ran it.
Do I need to use some specific mode in hashcat?
Reply
#4
(04-29-2023, 08:50 PM)Alexander Mak Wrote:
(04-29-2023, 06:52 PM)b8vr Wrote:
(04-29-2023, 12:41 PM)Alexander Mak Wrote: Hello, I have a hash of the password from the rar archive.
I got it with john the ripper.
When I tried to recover it with hashcat, I got the following message "Hashfile '25.txt' on line 1 ($RAR3$...8exxxxx0d6xxx12b619acx42xxxxxx97*35): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)" . I looked here which hashes support hashcat
https://hashcat.net/wiki/doku.php?id=example_hashes
And my hash is not there, as I understand it, it turned out to be too long.
It turned out to be 1944374 characters and its size is almost two megabytes.
Tell me what I need to do so that hashcat reads it and starts the recovery?
I can attach the complete hash file if needed.

Did you edit the hash to make it fit hashcat, after extracting it? Using rar2john makes it crackable with hohn, but not hashcat, unless you remove all the data in front of or behind the hash. Also, what mode did you use, when running hashcat?

Yes, I edited the hash after using john the ripper.
I didn't use any special mode in hashcat, just typed in a command and ran it.
Do I need to use some specific mode in hashcat?

Well, a specific hashmode. I was thinking of the -m 12500 for rar3 and -m 13000 for rar5. In your case that would be -m 12500.
Reply
#5
(04-29-2023, 09:36 PM)b8vr Wrote:
(04-29-2023, 08:50 PM)Alexander Mak Wrote:
(04-29-2023, 06:52 PM)b8vr Wrote:
(04-29-2023, 12:41 PM)Alexander Mak Wrote: Hello, I have a hash of the password from the rar archive.
I got it with john the ripper.
When I tried to recover it with hashcat, I got the following message "Hashfile '25.txt' on line 1 ($RAR3$...8exxxxx0d6xxx12b619acx42xxxxxx97*35): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)" . I looked here which hashes support hashcat
https://hashcat.net/wiki/doku.php?id=example_hashes
And my hash is not there, as I understand it, it turned out to be too long.
It turned out to be 1944374 characters and its size is almost two megabytes.
Tell me what I need to do so that hashcat reads it and starts the recovery?
I can attach the complete hash file if needed.

Did you edit the hash to make it fit hashcat, after extracting it? Using rar2john makes it crackable with hohn, but not hashcat, unless you remove all the data in front of or behind the hash. Also, what mode did you use, when running hashcat?

Yes, I edited the hash after using john the ripper.
I didn't use any special mode in hashcat, just typed in a command and ran it.
Do I need to use some specific mode in hashcat?

Well, a specific hashmode. I was thinking of the -m 12500 for rar3 and -m 13000 for rar5. In your case that would be -m 12500.
Firstly my hash starts with $RAR3$*1* which means I need to use either -m 23700 or -m 23800 mode.
I tried both and same error, then I downloaded hashcat sources and overwritten in files module_23700.c and module_23800.c line token.len_max[7] which is 655056 by default, I changed it to 1944320
(I also realized that this number is needed because last time I counted all the characters in the hash and I had to count only those characters that are located after the unpacked file size and before the compression method (in my case, from 981537*1*(without asterisks and unit to 8e4797*35)).
After that, I managed to avoid this error, but a new error appeared called Salt -value exception
I don't know how to solve it, can you tell me what I need to do?
Reply