Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Testing John the Ripper in Mac OS X as a RAR password recovery solution, but xargs gives me an error:

john --incremental:all --stdout | xargs -I jtr unrar e -pjtr -inul test2.rar | grep 100%
xargs: unterminated quote

But when I add '-0' to xargs to deal with the quote, I get another xargs error:

john --incremental:all --stdout | xargs -0 -I jtr unrar e -pjtr -inul test2.rar | grep 100%
xargs: insufficient space for argument

Which I suppose is because the '-0' is preventing xargs from using newlines as delimiters, which is creating the space issue?

Any ideas on how to make xargs happy? Is there a way to solve the quotes issue while keeping the newline delimiter intact?

share|improve this question
    
xargs launches ONE instance of your command with too many arguments, you need to launch unrar for each password you want to try like explained by @Mattias –  David Costa Jan 6 '12 at 21:43

2 Answers 2

up vote 4 down vote accepted

I would probably do something like this instead:

john --incremental:all -stdout | while read pass;do
  rar x -p"${pass}" test2.rar
  if [ "$?" -eq 0 ];then
    exit 0
  fi
done

Replace rar options, etc. as you like. This way the command only runs until it successfully unpacks the file and you don't have to grep for something. $? is a shell variable containing the return code of the last run command, and if run successfully it equals 0. So if you match it with 0 you know the previous command "worked".

Edit 1: Added "'s around the password, like -p"${pass}".

share|improve this answer
    
This also asks for a password (will not be echoed) immediately followed by a reenter request partway through. I wonder if that's john or unrar? –  chuckkahn Jan 7 '12 at 5:43
    
I tried this with a dummy password protected rar file, it matched the 25th password and it worked just fine. Use rar and not unrar to be sure, and type =exactly= as above, don't change rar for unrar, etc. Don't change variable names or anything. –  Mattias Ahnberg Jan 7 '12 at 6:08
    
If I wanted to restore a previous aborted session, would I just substitute "--incremental:all" with "--restore"? –  chuckkahn Jan 7 '12 at 19:05
    
Should work fine, yes! –  Mattias Ahnberg Jan 7 '12 at 20:02
1  
The homebrew package manager has unrar but not rar -- what was the reason to use rar and not unrar? –  chuckkahn Jan 7 '12 at 20:52

I don't know of a way (other than -0 mode) to get xargs to ignore quotes in its input, but it's easy to use tr to convert the newlines to nulls and then use -0 mode:

john --incremental:all --stdout | tr "\n" "\0" | xargs -0 -I jtr unrar e -pjtr -inul test2.rar | grep 100%

share|improve this answer
    
When I add the tr portion, it does this at the end: Enter password (will not be echoed): Reenter password: I guess that's rar asking? I dunno. –  chuckkahn Jan 7 '12 at 5:18
    
I think that's what it does with the argument "-p" (i.e. when given the empty string as a password). If I'm right, you should be able to suppress this by creating a john.conf file with "MinLen = 1". –  Gordon Davisson Jan 7 '12 at 8:21
    
Yeah it was set to = 0. Weird. –  chuckkahn Jan 7 '12 at 15:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.