A backdoor lockpick for Phicomm's routers

[oblivia-simplex]

Committing a PoC for the backdoors discussed here: https://medium.com/tenable-techblog/a-backdoor-lockpick-d847a83f4496

Verified to work on all known models and firmware versions of Phicomm routers (at least those released in the last few years).

[gitguardian]

⚠️ GitGuardian has uncovered 31 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	Secret	Commit	Filename
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/ca-key.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/client.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/demoCA/private/cakey.pem	View secret
-	DSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/dsa-ca.pem	View secret
-	DSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/dsa-pca.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/pca-key.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/privkey.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/rsa8192.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/s1024key.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/s512-key.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/server.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/apps/server2.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/certs/demo/ca-cert.pem	View secret
-	DSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/certs/demo/dsa-ca.pem	View secret
-	DSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/certs/demo/dsa-pca.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/certs/demo/pca-cert.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/bio/server.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/cms/cakey.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/cms/signer.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/cms/signer2.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/easy_tls/cert.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/privkey.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/sign/key.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/sign/sig.txt	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/smime/cakey.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/smime/signer.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/smime/signer2.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/tunala/A-client.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/demos/tunala/A-server.pem	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/ms/keyCA.ss	View secret
-	RSA Private Key	1e75433	Phicomm/backdoor-lockpick_tra-2022-01/openssl-1.0.2/ms/keyU.ss	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Revoke and rotate the secret.

2. If possible, rewrite git history with git commit --amend and git push --force.

---

<sup>🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!</sup>

[oblivia-simplex]

GitGuardian is complaining about some hardcoded pems included in the copy of openssl I've got stuffed in there. Nothing to worry about.