Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <3FF86C39-32BC-4866-8AD3-1162C86BFD6E@gmail.com>
Date: Thu, 13 Jun 2013 13:59:53 -0400
From: Luis Santana <hacktalk@...ktalk.net>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: rar2john failing?

Hey, trying to run rar2john on an OSX system but getting the following output:

! -hp mode entry found in 1.rar
1.rar:$RAR3$*0*0000000000000000*00000000000000000000000000000000:0::::1.rar

The "file" command gives the following:

1.rar: RAR archive data, v0, os: MS-DOS

And the header of the archive is the following:

[13:58:25 connection@...DOS.local:~/john]$ hexdump -C 1.rar |head
00000000  52 61 72 21 1a 07 00 ce  99 73 80 00 0d 00 00 00  |Rar!.....s......|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000060  00 00 00 00 00 00 00 00  00 00 00 00 cc 0b 7d 38  |..............}8|
00000070  34 9f 04 e8 57 e3 7b 70  f3 c7 76 7b b9 19 a9 07  |4...W.{p..v{....|
00000080  5b 72 6d eb c6 c5 59 05  51 ff c5 2f 04 ea b9 4a  |[rm...Y.Q../...J|
00000090  b0 1f d1 c3 e5 b7 f5 6a  b9 87 82 1b 19 de d8 3e  |.......j.......>|
000000a0  11 9d 30 0a d9 66 18 45  6e 77 9d f9 4f 79 ea 1a  |..0..f.Enw..Oy..|
000000b0  76 21 84 5a 18 4c 4d e4  48 88 58 3e ae 20 92 59  |v!.Z.LM.H.X>. .Y|
000000c0  74 a6 10 c5 f2 03 80 fa  bc bc a2 05 21 77 c5 f1  |t...........!w..|


As this is a file that a client believes is being used to exfiltrate data from the network, I sadly cannot share the archive for debugging purposes but I hope someone has run into this issue in the past and can point me in the right direction.

I hope it's just an OSX issue and I can throw the rar into a Virtual Machine to solve this 
Luis Santana : Founder - HackTalk Security
http://hacktalk.net
hacktalk@...ktalk.net
HackTalk Security - Security From The Underground



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.