How to configure access control on main router for TL-WR802N. By edisonzhang. Fail to install TP-Link adapter on Win10? Disable Signed Driver Enforcement. How do I install a TP-Link Archer router with a Cable Modem (new logo)? Some frequently asked questions about TP-Link smart plug and Kasa APP.

1. Tp-link 192.168.o.1 Admin

For the full story, see Reverse Engineering the TP-Link HS110

Tp-link 192.168.o.1 Admin

tplink_smartplug.py

A python client for the proprietary TP-Link Smart Home protocol to control TP-Link HS100 and HS110 WiFi Smart Plugs.The SmartHome protocol runs on TCP port 9999 and uses a trivial XOR autokey encryption that provides no security.

There is no authentication mechanism and commands are accepted independent of device state (configured/unconfigured).

Commands are formatted using JSON, for example:

{'system':{'get_sysinfo':null}}

Instead of null we can also write {}. Commands can be nested, for example:

{'system':{'get_sysinfo':null},'time':{'get_time':null}}

A full list of commands is provided in tplink-smarthome-commands.txt.

Usage

./tplink_smartplug.py -t <ip> [-c <cmd> -j <json>]

Provide the target IP using -t and a command to send using either -c or -j. Commands for the -c flag:

More advanced commands such as creating or editing rules can be issued using the -j flag by providing the full JSON string for the command. Saints row 2 character creations 2018. Please consult tplink-smarthome-commands.txt for a comprehensive list of commands.

Wireshark Dissector

Wireshark dissector to decrypt TP-Link Smart Home Protocol packets (TCP port 9999).

Installation

Copy tplink-smarthome.lua into:

tddp-client.py

A proof-of-concept python client to talk to a TP-Link device using the TP-Link Device Debug Protocol (TDDP).

TDDP is implemented across a whole range of TP-Link devices including routers, access points, cameras and smartplugs.TDDP can read and write a device's configuration and issue special commands. UDP port 1040 is used to send commands, replies come back on UDP port 61000. This client has been tested with a TP-Link Archer C9 Wireless Router and a TP-Link HS-110 WiFi Smart Plug.

TDDP is a binary protocol documented in patent CN102096654A.

Commands are issued by setting the appropriate values in the Type and SubType header fields.Data is returned DES-encrypted and requires the username and password of the device to decrypt. Likewise, configuration data to be written to the device needs to be sent encrypted. The DES key is constructed by taking the MD5 hash of username and password concatenated together, and then taking the first 8 bytes of the MD5 hash.

Usage

./tddp-client.py -t <ip> -u username -p password -c 0A

Provide the target IP using -t. You can provide a username and password, otherwise admin/admin is used as a default. They are necessary to decrypt the data that is returned.

Provide the command as a two-character hex string, e.g. -c 0A. What type of data a command might read out will be different for various TP-Link devices.

Example

Reading out the WAN link status on an Archer C9 in default configuration shows the link is down (0):