Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Testing John the Ripper in Mac OS X as a RAR password recovery solution, but xargs gives me an error:

john --incremental:all --stdout | xargs -I jtr unrar e -pjtr -inul test2.rar | grep 100%
xargs: unterminated quote

But when I add '-0' to xargs to deal with the quote, I get another xargs error:

john --incremental:all --stdout | xargs -0 -I jtr unrar e -pjtr -inul test2.rar | grep 100%
xargs: insufficient space for argument

Which I suppose is because the '-0' is preventing xargs from using newlines as delimiters, which is creating the space issue?

Any ideas on how to make xargs happy? Is there a way to solve the quotes issue while keeping the newline delimiter intact?

share|improve this question
xargs launches ONE instance of your command with too many arguments, you need to launch unrar for each password you want to try like explained by @Mattias – David Costa Jan 6 '12 at 21:43
up vote 4 down vote accepted

I would probably do something like this instead:

john --incremental:all -stdout | while read pass;do
  rar x -p"${pass}" test2.rar
  if [ "$?" -eq 0 ];then
    exit 0

Replace rar options, etc. as you like. This way the command only runs until it successfully unpacks the file and you don't have to grep for something. $? is a shell variable containing the return code of the last run command, and if run successfully it equals 0. So if you match it with 0 you know the previous command "worked".

Edit 1: Added "'s around the password, like -p"${pass}".

share|improve this answer
This also asks for a password (will not be echoed) immediately followed by a reenter request partway through. I wonder if that's john or unrar? – chuckkahn Jan 7 '12 at 5:43
I tried this with a dummy password protected rar file, it matched the 25th password and it worked just fine. Use rar and not unrar to be sure, and type =exactly= as above, don't change rar for unrar, etc. Don't change variable names or anything. – Mattias Ahnberg Jan 7 '12 at 6:08
If I wanted to restore a previous aborted session, would I just substitute "--incremental:all" with "--restore"? – chuckkahn Jan 7 '12 at 19:05
Should work fine, yes! – Mattias Ahnberg Jan 7 '12 at 20:02
The homebrew package manager has unrar but not rar -- what was the reason to use rar and not unrar? – chuckkahn Jan 7 '12 at 20:52

I don't know of a way (other than -0 mode) to get xargs to ignore quotes in its input, but it's easy to use tr to convert the newlines to nulls and then use -0 mode:

john --incremental:all --stdout | tr "\n" "\0" | xargs -0 -I jtr unrar e -pjtr -inul test2.rar | grep 100%

share|improve this answer
When I add the tr portion, it does this at the end: Enter password (will not be echoed): Reenter password: I guess that's rar asking? I dunno. – chuckkahn Jan 7 '12 at 5:18
I think that's what it does with the argument "-p" (i.e. when given the empty string as a password). If I'm right, you should be able to suppress this by creating a john.conf file with "MinLen = 1". – Gordon Davisson Jan 7 '12 at 8:21
Yeah it was set to = 0. Weird. – chuckkahn Jan 7 '12 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .