{"version": "2.1.0", "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "STACS", "rules": [{"id": "CredentialPKIPEMRSA", "shortDescription": {"text": "Potential PEM format RSA private key found."}}, {"id": "CredentialPKIPEMDER", "shortDescription": {"text": "Potential DER format RSA private key found."}}, {"id": "CredentialGenericHTTPBasic", "shortDescription": {"text": "Potential HTTP basic authentication credentials found."}}, {"id": "CredentialHashMD5", "shortDescription": {"text": "File contains an MD5 crypt hash which may be a credential."}}], "version": "0.5.1", "downloadUri": "https://www.github.com/stacscan/stacs/", "informationUri": "https://www.github.com/stacscan/stacs/"}}, "results": [{"message": {"text": "Potential PEM format RSA private key found."}, "level": "error", "ruleId": "CredentialPKIPEMRSA", "locations": [{"physicalLocation": {"region": {"byteOffset": 2212, "snippet": {"binary": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNTlGdDdmWQ=="}}, "contextRegion": {"snippet": {"binary": "AAAAAAAAAAAAAAAAAAAAAAAAAAAtLS0tLUJFR0lOIFJTQSBQUklWQVRFIEtFWS0tLS0tCk1JSUVwQUlCQUFLQ0FRRUE1OUZ0N2ZZNnVKZ1JDbUs0VkJEVUVDYTk0NXM="}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock1", "index": 0, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "Potential DER format RSA private key found."}, "level": "error", "ruleId": "CredentialPKIPEMDER", "locations": [{"physicalLocation": {"region": {"byteOffset": 540596, "snippet": {"binary": "MIIBOgIBAAJBANYzucj7Tzx9wAGG0OegVfKVk8xPt1tnW5RoyTQV3qUuHDPCbvw0XnETt9bu2KVlBXKHqLB3/lf1/F9Vg4fdV0kCAwEAAQ=="}}, "contextRegion": {"snippet": {"binary": "FLr6WYjt5OCMouwUfi3i8EZJlUUwggE6AgEAAkEA1jO5yPtPPH3AAYbQ56BV8pWTzE+3W2dblGjJNBXepS4cM8Ju/DRecRO31u7YpWUFcoeosHf+V/X8X1WDh91XSQIDAQABAkEAp/eRxQ+EV9wH92p/YFKzcvE="}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/bin/openssl", "index": 1, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "Potential DER format RSA private key found."}, "level": "error", "ruleId": "CredentialPKIPEMDER", "locations": [{"physicalLocation": {"region": {"byteOffset": 539988, "snippet": {"binary": "MIICXAIBAAKBgQDcmEPoPUNb5AXN0Kk+y4N19rWln2vpNEEpGPpqVU1w/OyuhzgKIKnARXduV2BX9O2WIsuP4TM6Fx/tN6Vv66a8EoAdU71w6yF2PskvGkUkgv/NWTIGLhI7I3jtEj3gjflnTzdORwJMLcBPH7OU4UEuLZAQ/IKRiw8i1PL8LKtTVQIDAQAB"}}, "contextRegion": {"snippet": {"binary": "1E4L/YvDDh2cRFePH4b31RvklQAwggJcAgEAAoGBANyYQ+g9Q1vkBc3QqT7Lg3X2taWfa+k0QSkY+mpVTXD87K6HOAogqcBFd25XYFf07ZYiy4/hMzoXH+03pW/rprwSgB1TvXDrIXY+yS8aRSSC/81ZMgYuEjsjeO0SPeCN+WdPN05HAkwtwE8fs5ThQS4tkBD8gpGLDyLU8vwsq1NVAgMBAAECgYArzD+PWLqLABb26jrwMNAFFw=="}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/bin/openssl", "index": 1, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "Potential DER format RSA private key found."}, "level": "error", "ruleId": "CredentialPKIPEMDER", "locations": [{"physicalLocation": {"region": {"byteOffset": 538796, "snippet": {"binary": "MIIEowIBAAKCAQEAwMDOPjxTZz9PxS+kwlovWP0nUmroz0pzR40lD18DJnjv8CIS095HshwLOGMabIV6gMaPoEGvYsRnMoj4ppz1Ix3krD8p+ezhiyYDLLKr8321yknAjxzfMzpg2jywFvipEo9krCMMaWSXXZnUCYObYdOs8N7dXp9ElNs6TZfoUin325QHRZB4HjELgPdXrRx5xcsysM7NdLPilMV4LzQaRfeMUqW8jezRLzE78ElZXoidFZI1MsHnYexQSHy6Bfn4+KeMg+hmW+v+2E/dbTbAspAPuFL5BJtALCfWNo7CG0TzktUVnpq8830D1wIUIOkQkv35/I/lGOGVzJ5gpvo4TQIDAQAB"}}, "contextRegion": {"snippet": {"binary": "2+uP/9uwxlWv+CqRnVBEIRcAAAAwggSjAgEAAoIBAQDAwM4+PFNnP0/FL6TCWi9Y/SdSaujPSnNHjSUPXwMmeO/wIhLT3keyHAs4YxpshXqAxo+gQa9ixGcyiPimnPUjHeSsPyn57OGLJgMssqvzfbXKScCPHN8zOmDaPLAW+KkSj2SsIwxpZJddmdQJg5th06zw3t1en0SU2zpNl+hSKffblAdFkHgeMQuA91etHHnFyzKwzs10s+KUxXgvNBpF94xSpbyN7NEvMTvwSVleiJ0VkjUywedh7FBIfLoF+fj4p4yD6GZb6/7YT91tNsCykA+4UvkEm0AsJ9Y2jsIbRPOS1RWemrzzfQPXAhQg6RCS/fn8j+UY4ZXMnmCm+jhNAgMBAAECggEAAMPDDbQnkI1Lv7iEqtC4xw=="}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/bin/openssl", "index": 1, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "Potential DER format RSA private key found."}, "level": "error", "ruleId": "CredentialPKIPEMDER", "locations": [{"physicalLocation": {"region": {"byteOffset": 536444, "snippet": {"binary": "MIIJKQIBAAKCAgEAwHGsGhOIgkM7UVdxjbYrgmUhU18oKU+NfIq5RLMoQU/T+mr4uShQOWdTLDzXy5ZBQDK763CuH7Bl9zrZIv0Qrr0C4t3zwnk8xvx1u69OOjbCT+ol3xMWSyD+S2kWxH8aQ6YXG7kK8wmGKInPLNDUga/GbeYhje7v6ty3xjtjnw6tiXgjGL9wfoTgN+zbjpw+ahnMmXLmtX1t+uXT5JC1srIScE7K+BD4oxTCSBnrYJm7Kh+xerE9JPugKdq9G9ekv+9gLSLKZZjxxOHJAmsWKC+hqnkA2tx8Q/dCPKDvaPffuWn7jgHtAUK1TlemJrjQe1ZtA8ZAjIwqVdecNQCUk+wD6yLvd7t5Ez8VoY/K3/3TuOHUzAk/PCzb0Ul/OAeDbesIZukGRBKslSKQI2fUCMz0t9zMh9SsaTVMtTk2zaTSlcoNxdrCxSIyKAjj0os4MNyMdU9q7HqsFj6o1GpF4ahPLoA0qlQbApV9im3MecrypC6N+/4VURAOTYixx/R52/C0VkQ3ylrBjEisrkiAgwE/3tnTLFFGsUG2xpFy+YNVG4y683PlLHRQOr7FL6eybYyeE3ejE81tjEXh/Au3aeknvGXD+pvQ7/7oH7NeNPSM6vzTgb89MLK0AehDD7oCI0J2gjFzke0HRmENOYNAznrU24A="}}, "contextRegion": {"snippet": {"binary": "ZeXHOGAktYnUnOtMnB16Ir3RwtIwggkpAgEAAoICAQDAcawaE4iCQztRV3GNtiuCZSFTXygpT418irlEsyhBT9P6avi5KFA5Z1MsPNfLlkFAMrvrcK4fsGX3Otki/RCuvQLi3fPCeTzG/HW7r046NsJP6iXfExZLIP5LaRbEfxpDphcbuQrzCYYoic8s0NSBr8Zt5iGN7u/q3LfGO2OfDq2JeCMYv3B+hOA37NuOnD5qGcyZcua1fW365dPkkLWyshJwTsr4EPijFMJIGetgmbsqH7F6sT0k+6Ap2r0b16S/72AtIsplmPHE4ckCaxYoL6GqeQDa3HxD90I8oO9o99+5afuOAe0BQrVOV6YmuNB7Vm0DxkCMjCpV15w1AJST7APrIu93u3kTPxWhj8rf/dO44dTMCT88LNvRSX84B4Nt6whm6QZEEqyVIpAjZ9QIzPS33MyH1KxpNUy1OTbNpNKVyg3F2sLFIjIoCOPSizgw3Ix1T2rseqwWPqjUakXhqE8ugDSqVBsClX2Kbcx5yvKkLo37/hVREA5NiLHH9Hnb8LRWRDfKWsGMSKyuSICDAT/e2dMsUUaxQbbGkXL5g1UbjLrzc+UsdFA6vsUvp7JtjJ4Td6MTzW2MReH8C7dp6Se8ZcP6m9Dv/ugfs1409Izq/NOBvz0wsrQB6EMPugIjQnaCMXOR7QdGYQ05g0DOetTbgCwfDdE01JLj1PHCAQIDAQABAoIC"}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/bin/openssl", "index": 1, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "Potential HTTP basic authentication credentials found."}, "level": "error", "ruleId": "CredentialGenericHTTPBasic", "locations": [{"physicalLocation": {"region": {"byteOffset": 55889, "snippet": {"binary": "aHR0cDovLyVzOiVzQG1lbWJlcnMuMzMyMi5uZXQv"}}, "contextRegion": {"snippet": {"binary": "LXEgLU8gL3RtcC9mMzMyMiAtcSBodHRwOi8vJXM6JXNAbWVtYmVycy4zMzIyLm5ldC9keW5kbnMvdXBkYXRlP2hvc3RuYQ=="}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/lib/librtsnm.so", "index": 2, "uriBaseId": "STACSROOT"}}}], "suppressions": []}, {"message": {"text": "File contains an MD5 crypt hash which may be a credential."}, "level": "error", "ruleId": "CredentialHashMD5", "locations": [{"physicalLocation": {"region": {"byteOffset": 306, "snippet": {"text": "$1$gmEGnzIX$bFqGa1xIsjGupHyfeHXWR/"}, "startLine": 21}, "contextRegion": {"snippet": {"text": "passwd\n\t#echo 'root:$1$gmEGnzIX$bFqGa1xIsjGupHyfeHXWR/:20:0:99999:7:::' > "}}, "artifactLocation": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/etc/rc.d/rc.local", "index": 3, "uriBaseId": "STACSROOT"}}}], "suppressions": []}], "artifacts": [{"location": {"uri": "patool_extraction/DUMP/mtdblock1", "uriBaseId": "STACSROOT"}, "hashes": {"md5": "77a7d92f35c7f6c436c300f4304423ac"}}, {"location": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/bin/openssl", "uriBaseId": "STACSROOT"}, "hashes": {"md5": "861039c317f8fdd581c7bc9f8ab5c390"}}, {"location": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/lib/librtsnm.so", "uriBaseId": "STACSROOT"}, "hashes": {"md5": "9ad181aebefa03947c3e359e5735550d"}}, {"location": {"uri": "patool_extraction/DUMP/mtdblock8_unblob_extracted/mtdblock8_extract/0-9650176.squashfs_v4_le_extract/etc/rc.d/rc.local", "uriBaseId": "STACSROOT"}, "hashes": {"md5": "006de85361c11b160c4c579df27b5d03"}}], "originalUriBaseIds": {"STACSROOT": {"uri": "file:///logs/firmware/"}}}]}