4 ms·

I had truly good “hacking” session with Codex. It’s not hacking, I wasn’t breaking anything, just jumping over the fences TP-Link put for me, owning the router,

I had truly good “hacking” session with Codex. It’s not hacking, I wasn’t breaking anything, just jumping over the fences TP-Link put for me, owning the router, inside the network, knowing the admin password. But TP-Link really tried everything so you cannot access the router you own via API. They really tried to be smart with some very very broken and custom auth and encryption scheme. It took some half a day with Codex, but in the end I have a pretty Python API to access my router, tested, reliable, and exporting beautiful Prometheus metrics. I’m sure there is some over eager product manager sitting in such companies, trying to splits markets into customer and enterprise sections, just by making APIs not useable by humans and adding 200% useless “security by obscurity”.

srcreigh 6mo ago
Any tips to share? I tried to do something similar but failed. My router has a backup/restore feature with an encrypted export, I figured I could use that to control or at least inspect all of its state, but I/codex could not figure out the encryption.
- alfanick 6mo ago
  It's on my long list of projects "to-opensource" (but I need to figure out licensing, for those things CC-BY-SA I think is the way to go), I don't want a random lawyer sitting on my ass though. I started with a simple assumption: if I can access the router via web-browser, then I can also automate that. From that the proof-of-concept was headless Chrome in Docker and AI-directed code (code written via LLM, not using it all the time) that uses Selenium to navigate the code. This worked, but it internally hurt me to run 300MiB browser just to access like 200B of metrics every 10s or so. So from there we (me + codex) worked together towards reverse engineering their minimised JS and their funky encryption scheme, and it eventually worked (in the end it's just OpenSSL with some useless paddings here or there). Give it a shot, it's a fun day adventure. :) Edit: that's the end result (kinda, I have whole infra around it, and another story with WiFi extender with another semi-broken different encryption scheme from the same provider) - https://imgur.com/a/VGbNmBp https://imgur.com/a/VGbNmBp
  - mtud 6mo ago
    You should give codex access to the mobile app :) The app, for a lot of routers, connects via an ssh tunnel to UDP/TCP sockets on the router. Would probably give you access to more data/control.
    - ropbear 6mo ago
      Made a comment up above, but that's tdpServer and tmpServer (sometimes tdpd and tmpd) and it's what I use in my python implementation of tmpcli, the (somewhat broken) client binary on some TP-Link devices. You're correct, it gives you access to everything the Tether app can do. https://github.com/ropbear/tmpcli https://github.com/ropbear/tmpcli
      - mtud 6mo ago
        I had been trying to find that again! It was instrumental in some RE/VR I did last year on tmp and the differences between the UDP socket (available without auth) and the TCP socket. Thanks for making that. I can't remember the details of the scheme, but it also allows you to authenticate using your TPLink cloud credential. If my memory is correct, the username is md5(tplink_account_email) and the password is the cloud account password. If you care, I can find my notes on that to confirm.
  - TurkTurkleton 6mo ago
    For what it's worth, the Creative Commons organization recommends against using CC licenses on software: https://creativecommons.org/faq/#can-i-apply-a-creative-commons-license-to-software https://creativecommons.org/faq/#can-i-apply-a-creative-comm...
  - JTbane 6mo ago
    Why not just use the GPL? It basically covers the same stuff Creative Commons Share-alike does.
    - alfanick 6mo ago
      I don't feel like I own the code itself (hey, GPT wrote 99.5% of it), I own the product and the thought process and everything that lead to it - do whatever you want, just don't forget my name somewhere in the process. Feels more like art project than coding project hence CC license.
- seer 6mo ago
  I had fun “hacking” my router that turned out to be just unzipping the file with slight binary modifications, it was so simple in fact I just implemented it in a few lines of js, even works in the browser :-D https://ivank.github.io/ddecryptor/ https://ivank.github.io/ddecryptor/
jack_pp 6mo ago
that could make a for a nice blog / gist
tclancy 6mo ago
Would definitely be interested in this. Moved to TP Link at the start of the year and I am generally very happy with it, but would like to be able to interact with my router in something other than their phone app.
- alfanick 6mo ago
  That was actually my first thought, to go through TP-Link cloud (ZERO DOCS), but it was too much effort :)
- DANmode 6mo ago
  > Moved to TP Link at the start of the year Can’t understand buying them or Netgear today.
  - tclancy 6mo ago
    Not to worry, I bought them in January.
ropbear 6mo ago
Many eons ago I wrote a Python version of tmpcli for this exact reason. Made some minor improvements a few years ago but haven’t touched it since. Curious what methodology Codex came up with, I haven’t revisited it since models got really good. The idea is that tmpServer listens on localhost, but dropbear allows port forwarding with admin creds (you’ll need to specify -N). That program has full device access and is the API the Tether app primarily uses to interact with the device. https://github.com/ropbear/tmpcli https://github.com/ropbear/tmpcli
- alfanick 6mo ago
  Ha kudos! I went across this project - thanks for your work :) It didn't work on the specific model I own (Archer NX600). My solution is really just using their pseudo-JWT over their obscured APIs (with reverse-engineered names of endpoints and params). Limitation is that there is still only one client allowed to be authenticated at one moment, so my daemon has priority and I need to stop it to actually access Admin panel.
  - ropbear 6mo ago
    Of course! Happy to contribute. As is the case with your device, there's a lot of weird TP-Link firmware variants (even an RTOS called TPOS based on VxWorks), so no guarantee it'll work all the time. Glad there's more research being done in the space!
  - mtud 6mo ago
    We’re splitting this across two threads, but if you give Codex access to jadx and the Archer android app you might be able to get something without that problem. The TPLink management protocol has a few different “transport” types - tmpcli uses SSH, but your device might only support one of the other transports.
  - baq 6mo ago
    Would be amazing if it worked with decos, these are locked down so much you don’t even get an admin interface inside your own network.
0x_rs 6mo ago
I've had good success doing something similar. Recording requests into an .har file using the web UI and providing it for analysis was a good starting point for me, orders of magnitude faster than it would be without an assistant.
_doctor_love 6mo ago
If you're into it, you could always re-flash your TP-Link hardware with some open-source firmware that is more automation friendly. I used to be intimidated by it, but a friend showed me how to do it and it's remarkably simple and pain-free (provided it's a commonly supported router of course).
- alfanick 6mo ago
  ofc I could, but no project supports this specific hardware (Archer NX600) - I'm very happy with my solution :)
  - m463 6mo ago
    I wonder what the effort would be to port openwrt to it? It might be easy if there are adjacent routers on the same chipset.
    - c420 6mo ago
      Generally, if the device is compatible and not new to the market, openwrt has been ported or is in the process (though it may not be the latest version of openwrt). You can search for your device in the compatibility drop downs and get the current status. If it's not listed, searching the device on the openwrt forums may tell you why (which is almost always the chipset).
qingcharles 6mo ago
I have one of these Smiirl flip counters. It runs a version of OpenWrt without the web UI, but has a uhttpd to serve an api. I'm hoping Mythos can help me find an exploit to get into it and enable ssh since they have now disabled the simple api switch that would let you turn it on. https://www.smiirl.com/en/counter/facebook/5d/ https://www.smiirl.com/en/counter/facebook/5d/
stronglikedan 6mo ago
It's a shame that you can't share how you did that without running afoul of DMCA Section 1201 and risking years in federal prison.
- bedstefar 6mo ago
  ... in exactly one of this planet's countries
  - juanani 6mo ago
    [dead]
gilgoomesh 6mo ago
> It’s not hacking, I wasn’t breaking anything That's a very narrow read of the word "hacking". We're literally on a website called "Hacker News". We're not all trying to break things.
- vermilingua 6mo ago
  https://www.catb.org/jargon/html/H/hacker.html https://www.catb.org/jargon/html/H/hacker.html Definition 7 would be the relevant one here.
Wojtkie 6mo ago
I did something similar with an LED display on my computer case. The display required a proprietary UI program from the manufacturer to display GPU/CPU temps which unfortunately only worked on Windows. Since it needs sensor data, WINE would not work here and I didn't want to do something funky with editing WINE or granting non-typical permissions. I was able to reverse engineer the software using Claude, some Python, and a few hours of probing sensor data to understand how it worked and what was available. I wrote most of the code myself (it was dead simple), but Claude was extremely useful in understanding what byte packets were being sent to the USB controller, what they meant, and what the controller was expecting. I was able to make it into a service so now it Just Works(tm). Probably the first time I've used it to "hack" something, but now I have a service that works great, I understand it, and I learned a ton about how Linux controls some low-level hardware.

srcreigh 6mo ago

Any tips to share? I tried to do something similar but failed. My router has a backup/restore feature with an encrypted export, I figured I could use that to control or at least inspect all of its state, but I/codex could not figure out the encryption.

alfanick 6mo ago
It's on my long list of projects "to-opensource" (but I need to figure out licensing, for those things CC-BY-SA I think is the way to go), I don't want a random lawyer sitting on my ass though. I started with a simple assumption: if I can access the router via web-browser, then I can also automate that. From that the proof-of-concept was headless Chrome in Docker and AI-directed code (code written via LLM, not using it all the time) that uses Selenium to navigate the code. This worked, but it internally hurt me to run 300MiB browser just to access like 200B of metrics every 10s or so. So from there we (me + codex) worked together towards reverse engineering their minimised JS and their funky encryption scheme, and it eventually worked (in the end it's just OpenSSL with some useless paddings here or there). Give it a shot, it's a fun day adventure. :) Edit: that's the end result (kinda, I have whole infra around it, and another story with WiFi extender with another semi-broken different encryption scheme from the same provider) - https://imgur.com/a/VGbNmBp https://imgur.com/a/VGbNmBp
- mtud 6mo ago
  You should give codex access to the mobile app :) The app, for a lot of routers, connects via an ssh tunnel to UDP/TCP sockets on the router. Would probably give you access to more data/control.
  - ropbear 6mo ago
    Made a comment up above, but that's tdpServer and tmpServer (sometimes tdpd and tmpd) and it's what I use in my python implementation of tmpcli, the (somewhat broken) client binary on some TP-Link devices. You're correct, it gives you access to everything the Tether app can do. https://github.com/ropbear/tmpcli https://github.com/ropbear/tmpcli
    - mtud 6mo ago
      I had been trying to find that again! It was instrumental in some RE/VR I did last year on tmp and the differences between the UDP socket (available without auth) and the TCP socket. Thanks for making that. I can't remember the details of the scheme, but it also allows you to authenticate using your TPLink cloud credential. If my memory is correct, the username is md5(tplink_account_email) and the password is the cloud account password. If you care, I can find my notes on that to confirm.
- TurkTurkleton 6mo ago
  For what it's worth, the Creative Commons organization recommends against using CC licenses on software: https://creativecommons.org/faq/#can-i-apply-a-creative-commons-license-to-software https://creativecommons.org/faq/#can-i-apply-a-creative-comm...
- JTbane 6mo ago
  Why not just use the GPL? It basically covers the same stuff Creative Commons Share-alike does.
  - alfanick 6mo ago
    I don't feel like I own the code itself (hey, GPT wrote 99.5% of it), I own the product and the thought process and everything that lead to it - do whatever you want, just don't forget my name somewhere in the process. Feels more like art project than coding project hence CC license.
seer 6mo ago
I had fun “hacking” my router that turned out to be just unzipping the file with slight binary modifications, it was so simple in fact I just implemented it in a few lines of js, even works in the browser :-D https://ivank.github.io/ddecryptor/ https://ivank.github.io/ddecryptor/

jack_pp 6mo ago

that could make a for a nice blog / gist

tclancy 6mo ago

Would definitely be interested in this. Moved to TP Link at the start of the year and I am generally very happy with it, but would like to be able to interact with my router in something other than their phone app.

alfanick 6mo ago
That was actually my first thought, to go through TP-Link cloud (ZERO DOCS), but it was too much effort :)
DANmode 6mo ago
> Moved to TP Link at the start of the year Can’t understand buying them or Netgear today.
- tclancy 6mo ago
  Not to worry, I bought them in January.

ropbear 6mo ago

Many eons ago I wrote a Python version of tmpcli for this exact reason. Made some minor improvements a few years ago but haven’t touched it since. Curious what methodology Codex came up with, I haven’t revisited it since models got really good. The idea is that tmpServer listens on localhost, but dropbear allows port forwarding with admin creds (you’ll need to specify -N). That program has full device access and is the API the Tether app primarily uses to interact with the device. https://github.com/ropbear/tmpcli https://github.com/ropbear/tmpcli

alfanick 6mo ago
Ha kudos! I went across this project - thanks for your work :) It didn't work on the specific model I own (Archer NX600). My solution is really just using their pseudo-JWT over their obscured APIs (with reverse-engineered names of endpoints and params). Limitation is that there is still only one client allowed to be authenticated at one moment, so my daemon has priority and I need to stop it to actually access Admin panel.
- ropbear 6mo ago
  Of course! Happy to contribute. As is the case with your device, there's a lot of weird TP-Link firmware variants (even an RTOS called TPOS based on VxWorks), so no guarantee it'll work all the time. Glad there's more research being done in the space!
- mtud 6mo ago
  We’re splitting this across two threads, but if you give Codex access to jadx and the Archer android app you might be able to get something without that problem. The TPLink management protocol has a few different “transport” types - tmpcli uses SSH, but your device might only support one of the other transports.
- baq 6mo ago
  Would be amazing if it worked with decos, these are locked down so much you don’t even get an admin interface inside your own network.

0x_rs 6mo ago

I've had good success doing something similar. Recording requests into an .har file using the web UI and providing it for analysis was a good starting point for me, orders of magnitude faster than it would be without an assistant.

_doctor_love 6mo ago

If you're into it, you could always re-flash your TP-Link hardware with some open-source firmware that is more automation friendly. I used to be intimidated by it, but a friend showed me how to do it and it's remarkably simple and pain-free (provided it's a commonly supported router of course).

alfanick 6mo ago
ofc I could, but no project supports this specific hardware (Archer NX600) - I'm very happy with my solution :)
- m463 6mo ago
  I wonder what the effort would be to port openwrt to it? It might be easy if there are adjacent routers on the same chipset.
  - c420 6mo ago
    Generally, if the device is compatible and not new to the market, openwrt has been ported or is in the process (though it may not be the latest version of openwrt). You can search for your device in the compatibility drop downs and get the current status. If it's not listed, searching the device on the openwrt forums may tell you why (which is almost always the chipset).

qingcharles 6mo ago

I have one of these Smiirl flip counters. It runs a version of OpenWrt without the web UI, but has a uhttpd to serve an api. I'm hoping Mythos can help me find an exploit to get into it and enable ssh since they have now disabled the simple api switch that would let you turn it on. https://www.smiirl.com/en/counter/facebook/5d/ https://www.smiirl.com/en/counter/facebook/5d/

stronglikedan 6mo ago

It's a shame that you can't share how you did that without running afoul of DMCA Section 1201 and risking years in federal prison.

bedstefar 6mo ago
... in exactly one of this planet's countries
- juanani 6mo ago
  [dead]

gilgoomesh 6mo ago

> It’s not hacking, I wasn’t breaking anything That's a very narrow read of the word "hacking". We're literally on a website called "Hacker News". We're not all trying to break things.

vermilingua 6mo ago
https://www.catb.org/jargon/html/H/hacker.html https://www.catb.org/jargon/html/H/hacker.html Definition 7 would be the relevant one here.

Wojtkie 6mo ago

I did something similar with an LED display on my computer case. The display required a proprietary UI program from the manufacturer to display GPU/CPU temps which unfortunately only worked on Windows. Since it needs sensor data, WINE would not work here and I didn't want to do something funky with editing WINE or granting non-typical permissions. I was able to reverse engineer the software using Claude, some Python, and a few hours of probing sensor data to understand how it worked and what was available. I wrote most of the code myself (it was dead simple), but Claude was extremely useful in understanding what byte packets were being sent to the USB controller, what they meant, and what the controller was expecting. I was able to make it into a service so now it Just Works(tm). Probably the first time I've used it to "hack" something, but now I have a service that works great, I understand it, and I learned a ton about how Linux controls some low-level hardware.