Device Discovery via TDDP

[mweinelt]

https://www.softscheck.com/en/reverse-engineering-tp-link-hs110/#TP-Link Device Debug Protocol

It says the TP-Link Device Debug Protocol has the ability to discover devices inside the same broadcast domain. A reference implementation of the general protocol is available at https://github.com/softScheck/tplink-smartplug/tree/master/tddp-client.

[GadgetReactor]

Ah thanks so much for this!

[mweinelt]

Also check out this fresh vulnerability report: http://www.coresecurity.com/advisories/tp-link-tddp-multiple-vulnerabilities

[rytilahti]

Device discovery doesn't need TDDP implementation, just a broadcast UDP packet to 255.255.255.255:9999. The devices will reply with usual payloads.

Request payload:
{"system": {"get_sysinfo": None}, "emeter": {"get_realtime": None}}

[rytilahti]

This has been implemented (not with TDDP though, but I'd say extra work on this is not worth the effort), so closing for now.

[babanaweed]

Please help me with this exploit how to use it.
https://www.exploit-db.com/exploits/40814/