Skip to content
/ tmpcli Public

A reverse engineering project for the TP-Link Tether Management Protocol (TMP), which allows authenticated configuration of TP-Link routers as well as other use cases.

License

Notifications You must be signed in to change notification settings

ropbear/tmpcli

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

tmpcli

A command line tool based on reverse-engineering the Tether Management Protocol server and client on TP-Link devices.

⚠️ Warning ⚠️

Using this protocol is extremely dangerous for your router. There is no documentation, and changing one thing can lead to bricking the router if a wrong character is entered. I am not liable for any routers bricked as a result of this code. If you do brick your router, use TFTP in uboot to reflash the firmware. You have been warned.

Usage

usage: tmpcli.py [-h] [-p PAYLOAD] [-o OPCODE] [-v] host port

positional arguments:
  host                  Host IPv4
  port                  TCP port

options:
  -h, --help            show this help message and exit
  -p PAYLOAD, --payload PAYLOAD
                        Data to send
  -o OPCODE, --opcode OPCODE
                        TMP opcode
  -v, --verbose         Verbose mode - logging enabled

Port Forwarding

The TMP Server is listening on localhost. Thankfully, dropbear only disallows shell access, which means port forwarding is possible (this is how the Tether app manages the router).

ssh admin@192.168.0.1 -L 20002:127.0.0.1:20002 -N

The password is the same as the one for the web admin. You may need to specify the Cipher and Key specs in order to get SSH to make a connection. I leave that as an exercise for the user.

Example

The example below should return a JSON object which contains a list of clients connected to the device.

$ python3 tmpcli.py 127.0.0.1 20002 -o 0x310 -p '{"amount":32,"start_index":0}'   
INFO:root:Connected to 127.0.0.1:20002
{
	"start_index":	0,
	"client_list":	[{
			"mac":	"DE-AD-BE-EF-CA-FE",
			"conn_type":	"wired",
			"time_period":	-1,
			"ip":	"192.168.0.100",
			"access_time": -19975507200,
			"online":	true,
			"name":	"aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj1kUXc0dzlXZ1hjUQ==",
			"owner_id":	-1,
			"remain_time":	-1,
			"owner_name":	"",
			"client_type":	"other",
			"enable_priority":	false
		}],
	"sum":	1,
	"amount":	1
}

References

  1. Pedro Ribeiro (@pedrib1337) and Radek Domanski (@RabbitPro)
    • this blogpost was immensely helpful for the TdpPacket class. Thanks to Pedro and Radek.

About

A reverse engineering project for the TP-Link Tether Management Protocol (TMP), which allows authenticated configuration of TP-Link routers as well as other use cases.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages