{"id":13774441,"url":"https://github.com/softscheck/tplink-smartplug","last_synced_at":"2025-05-14T16:05:25.790Z","repository":{"id":45189403,"uuid":"64391401","full_name":"softScheck/tplink-smartplug","owner":"softScheck","description":"TP-Link WiFi SmartPlug Client and Wireshark Dissector","archived":false,"fork":false,"pushed_at":"2024-10-15T10:48:09.000Z","size":102,"stargazers_count":1163,"open_issues_count":53,"forks_count":297,"subscribers_count":70,"default_branch":"master","last_synced_at":"2025-04-12T01:54:23.329Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/softScheck.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-07-28T11:51:37.000Z","updated_at":"2025-04-11T11:02:27.000Z","dependencies_parsed_at":"2022-08-24T14:49:40.073Z","dependency_job_id":"78c05c9b-5809-4c24-a55f-ad5b2613329e","html_url":"https://github.com/softScheck/tplink-smartplug","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/softScheck%2Ftplink-smartplug","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/softScheck%2Ftplink-smartplug/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/softScheck%2Ftplink-smartplug/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/softScheck%2Ftplink-smartplug/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/softScheck","download_url":"https://codeload.github.com/softScheck/tplink-smartplug/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248505873,"owners_count":21115354,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:26.757Z","updated_at":"2025-04-12T01:54:27.581Z","avatar_url":"https://github.com/softScheck.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"6fa0e0d1f898fba299b2566a33602841\"\u003e\u003c/a\u003eWireshark"],"sub_categories":[],"readme":"# TP-Link WiFi SmartPlug Client and Wireshark Dissector\n\nFor the full story, see [Reverse Engineering the TP-Link\nHS110](https://www.softscheck.com/en/reverse-engineering-tp-link-hs110/)\n\n## tplink_smartplug.py\n\nA python client for the proprietary TP-Link Smart Home protocol to control\nTP-Link HS100, HS110 and KP115 WiFi Smart Plugs. The SmartHome protocol runs on TCP\nport 9999 and uses a trivial XOR autokey encryption that provides no security.\n\nThere is no authentication mechanism and commands are accepted independent of\ndevice state (configured/unconfigured).\n\nCommands are formatted using JSON, for example:\n\n`{\"system\":{\"get_sysinfo\":null}}`\n\nInstead of `null` we can also write `{}`. Commands can be nested, for example:\n\n`{\"system\":{\"get_sysinfo\":null},\"time\":{\"get_time\":null}}`\n\nA full list of commands is provided in\n[tplink-smarthome-commands.txt](tplink-smarthome-commands.txt).\n\n### Usage\n\n   `./tplink_smartplug.py -t \u003cip\u003e [-c \u003ccmd\u003e || -j \u003cjson\u003e]`\n\nProvide the target IP using `-t` and a command to send using either `-c` or\n`-j`. Commands for the `-c` flag:\n\n| Command       | Description                           |\n|---------------|---------------------------------------|\n| antitheft     | Lists configured antitheft rules      |\n| cloudinfo     | Returns cloud connectivity info       |\n| countdown     | Lists configured countdown rules      |\n| energy        | Return realtime voltage/current/power |\n| energy_reset  | Reset energy meters                   |\n| info          | Returns device info                   |\n| ledoff        | Turn off the LED indicator            |\n| ledon         | Turn on the LED indicator             |\n| off           | Turns off the plug                    |\n| on            | Turns on the plug                     |\n| reboot        | Reboot the device                     |\n| reset         | Reset the device to factory settings  |\n| runtime_reset | erase runtime statistics              |\n| schedule      | Lists configured schedule rules       |\n| time          | Returns the system time               |\n| wlanscan      | Scan for nearby access points         |\n\nMore advanced commands such as creating or editing rules can be issued using the\n`-j` flag by providing the full JSON string for the command. Please consult\n[tplink-smarthome-commands.txt](tplink-smarthome-commands.txt) for a\ncomprehensive list of commands.\n\n\u003e [!TIP]\n\u003e For pretty printing the response, use the quiet parameter (-q) and pipe the\n\u003e output through `jq` For example:\n\u003e  `./tplink_smartplug.py -t 192.168.178.49 -c info -q | jq`\n\n## Wireshark Dissector\n\nWireshark dissector to decrypt TP-Link Smart Home Protocol packets (TCP port\n9999).\n\n![ScreenShot](wireshark-dissector.png)\n\n\u003e [!NOTE]  \n\u003e If you have Wireshark \u003e 3.5.0 you can use the built-in dissector.\n\n### Installation\n\nCopy [tplink-smarthome.lua](tplink-smarthome.lua) into:\n\n| OS          | Installation Path                  |\n| ----------- | ---------------------------------- |\n| Windows     | %APPDATA%\\Wireshark\\plugins        |\n| Linux/MacOS | $HOME/.local/lib/wireshark/plugins |\n\n## tddp-client.py\n\nA proof-of-concept python client to talk to a TP-Link device using the **TP-Link\nDevice Debug Protocol (TDDP)**.\n\nTDDP is implemented across a whole range of TP-Link devices including routers,\naccess points, cameras and smartplugs. TDDP can read and write a device's\nconfiguration and issue special commands. UDP port 1040 is used to send\ncommands, replies come back on UDP port 61000. This client has been tested with\na TP-Link Archer C9 Wireless Router and a TP-Link HS-110 WiFi Smart Plug.\n\nTDDP is a binary protocol documented in patent\n[CN102096654A](https://www.google.com/patents/CN102096654A?cl=en).\n\nCommands are issued by setting the appropriate values in the Type and SubType\nheader fields. Data is returned DES-encrypted and requires the username and\npassword of the device to decrypt. Likewise, configuration data to be written to\nthe device needs to be sent encrypted. The DES key is constructed by taking the\nMD5 hash of username and password concatenated together, and then taking the\nfirst 8 bytes of the MD5 hash.\n\n### Usage\n\n`./tddp-client.py -t \u003cip\u003e -u username -p password -c 0A`\n\nProvide the target IP using -t. You can provide a username and password,\notherwise admin/admin is used as a default. They are necessary to decrypt the\ndata that is returned.\n\nProvide the command as a two-character hex string, e.g. -c 0A. What type of data\na command might read out will be different for various TP-Link devices.\n\n### Example\n\nReading out the WAN link status on an Archer C9 in default configuration shows\nthe link is down (0):\n\n```text\n./tddp-client.py -t 192.168.0.1 -c 0E\nRequest Data: Version 02 Type 03 Status 00 Length 00000000 ID 0001 Subtype 0e\nReply Data:   Version 02 Type 03 Status 00 Length 00000018 ID 0001 Subtype 0e\nDecrypted:    wan_ph_link 1 0\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsoftscheck%2Ftplink-smartplug","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsoftscheck%2Ftplink-smartplug","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsoftscheck%2Ftplink-smartplug/lists"}