How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$? Assume that $h:\{0,1\}^* \rightarrow \{0,1\}^\lambda$ is a cryptologic hash function, $r$ is taken randomly from $\{0,1\}^\lambda$, $p$ is a low-entropy password and $p^*$ is a guess. Now we get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$ but don't know $h(p)$ or $h(p^*)$. 

Then there are two problems is a problem:


Can we get $\Delta{}h = h(p) \oplus h(p^*)$ by a brute-force cracking? (Yes.)
Can we get $h(p)$ (and $p$, due to the low-entropy property)?


There may be a slight different problem to consider easily, what if we get $\mathsf{pad}(p) \oplus \mathsf{pad}(p^*) \oplus r$ and $h(r)$, where $\mathsf{pad} (x)$ simply pads x with zeros?
Let $x = h(p)\oplus h(p^*)\oplus r$. If $h(x) = h(r)$, then either $p = p^*$ or you've found a collision for $h$ (which happens with low probability). Since $p$ is generated from some low-entropy distribution, I assume it's feasible to brute-force over all possible values of $p$, allowing you to recover $p$ by checking whether $h(x) = h(r)$ for each guess $p^*$.