Hacking Kankun Smart Wifi Plug

Kankun Smart Wifi Plug

The Kankun "Small K" (KK-SP3) Smart Wifi Plug Socket is an inexpensive device (~$20) that lets you switch an outlet on and off over Wi-Fi.

Smart Plug is a Controllable OpenWRT Linux BusyBox

Designed to be controlled by a smart phone, some engineering minds posted on Hackaday a way to control the device from any web browser or SSH client.  It turns out the Smart Plug is running a version of OpenWRT, which is basically a minimal BusyBox Linux environment (BusyBox: The Swiss Army Knife of Embedded Linux). It also has SSH access turned on by default, and was just a matter of determining the default password (admin, 1234, or p9z34c). Once you have SSH access you can either control the relay directly, or add a CGI script to control from a web browser.

root@koven:~# cat /etc/openwrt_release
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="Bleeding Edge"
DISTRIB_REVISION="r39365"
DISTRIB_CODENAME="barrier_breaker"
DISTRIB_TARGET="ar71xx/generic"
DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r39365"

AliExpress

The Kunkun Smart Plug can be picked up on AliExpress for about $20.

"AliExpress is like eBay worldwide, but a lot bigger." (src)

Smart Plug package

There are a lot of options for purchase, just make sure you pick the US connector version (example), or you will need to buy an adapter (a mistake I made with the first one I ordered).

Smart Plug - US Connector Version

If you do get the wrong one, the front "female" receptacle connector was a universal connector, but the back "male" plug connector is the problem and you have to buy an adapter, so your device will end up looking like this:

Smart Plug - Chinese Connectors with US adapter

I should mention that one plug took 2 weeks to arrive and another took just shy of a full month. Different sellers, but both coming from China.

Factory Reset

As we make changes to the wireless settings, we can recover to the original factory settings by pressing and holding an almost-invisible white button on the surface of the plug for 4 seconds.

Configuring to SmartPlug Wireless Network

To get access and control to the Smart Plug, we first need to configure it.

Out of the box the Smart Plug is set as a Wireless Access Point, with an SSID of OK_SP3 (no password). To be useful, we will need to connect to this temporary access point and configure the device to connect to our home wireless network.

To configure the wireless, we can either:

1. Connect to the SSH service (default ip: 192.168.10.253) and modify the wireless files manually

or

2. We can use the Smart Phone Android/iOS app to configure the Smart Plug

I think the initial setup is easier with the app, so...

Configuring to SmartPlug Wireless Network - Android App Method

1. Download and install the Android Kankun "SmartPlug" app. (I assume the app on iOS is the same, but I haven't verified this)

For reference, I installed the app from the Google Play Store, but the instructions also provide a URL to download the app file: http://kk.huafeng.com:8081/android/Smartwifi.apk

2. Connect your Android Smart phone to the OK_SP3 network.

3. Start the SmartPlug app and click the "Config" button. Note: the "Device" page will be empty, unless you have already configured devices.

4. This is where we will change the Smart Plug's wireless network settings to our home network. Change the "Wifi" item to your home SSID (sorry no discovery option here). Change the Password to your home's wireless password. Ignore the "Encryption" option. Finally click the Configuring button to save the changes.

5. The Smart Plug should now be on your home's wireless network, and your Smart Phone will have been auto disconnected from the OK_SP3 network and also back on your home network. Check the status of the blue LED on the Smart Plug. If the LED is off, everything is good. If the light is blinking, it was unable to connect to your home wireless network.

6. Now check the "Device" list. Your Smart Plug should now be in the device list. Select the device.

Note: The device's Ethernet address (MAC) is also listed. Take note of the MAC, as you will want to check your DHCP server's logs to determine the IP address of your Smart Plug.

7. From here, we can quickly test the Smart Plug. We will be presented with a visual "on/off" button. Click the "on/off" a few times until you are satisfied. You will hear the relay switch on and off, or if you have something plugged into the Smart Plug, you will see it turn on and off.

7. Check your home's DHCP logs to find out what the new IP address of your Smart Plug is. Next we will connect to the Smart Plug over SSH.

Example:

dnsmasq-dhcp: DHCPDISCOVER(eth0) 00:15:61:bc:42:af
dnsmasq-dhcp: DHCPOFFER(eth0) 10.10.10.222 00:15:61:bc:42:af
dnsmasq-dhcp: DHCPREQUEST(eth0) 10.10.10.222 00:15:61:bc:42:af
dnsmasq-dhcp: DHCPACK(eth0) 10.10.10.222 00:15:61:bc:42:af

Configuring to SmartPlug Wireless Network - SSH Method

default /etc/config/wireless:

...

config wifi-iface
        option device radio0
        option network lan
        option mode ap
        option ssid OK_SP3
        option encryption none

change /etc/config/wireless:

...

config wifi-iface
        option device radio0
        option network wwan
        option ssid 'YOURSSID'
        option mode sta
        option encryption psk
        option key 'YOUR_WPA_KEY'

append /etc/config/network: (thanks Michael Liddle)

  config interface 'wwan'
  option proto 'dhcp'

After saving this file, reboot the Smart Plug and it should be connected to your home network. If the connection fails, perform the "factory reset" procedures to reset the network settings.

# reboot

SSH Password

Using your favorite SSH client, connect to the Smart Plug's IP address. Use "root" for the username, and "p9z34c" as the password (older models may have used "admin" or "1234").

$ ssh root@10.10.10.222
root@10.10.10.222's password:

BusyBox v1.19.4 (2014-03-27 17:39:06 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _    _               _    _
 | | _-_| _____ _____  | | _-_| _____ ____
 |  -_-  |     ||     ||  -_-  |     ||    |
 | |-_   |  -  ||  |  || |-_   |  -__||   _|
 |  _ -_ |_____||__|__||  _ -_ |_____||__|
 |_| -__|  S M A L L   |_| -__| S M A R T
 -----------------------------------------------------
 KONKE Technology Co., Ltd. All rights reserved.
 -----------------------------------------------------
  * www.konke.com            All other products and
  * QQ:27412237              company names mentioned
  * 400-871-3766             may be the trademarks of
  * fae@konke.com            their respective owners.
 -----------------------------------------------------
root@koven:~#

You can then change the default password with the 'passwd' command.

# cat /etc/shadow | grep root
root:$1$4a45vajh$LVbmwoCs84PwyB.r2UdIN1:16185:0:99999:7:::

# passwd
Changing password for root
New password:
Retype password:
Password for root changed by root

Control Relay

Turning on and off the relay is really easy:

# turn relay on
echo 1 > /sys/class/leds/tp-link:blue:relay/brightness

# turn relay off
echo 0 > /sys/class/leds/tp-link:blue:relay/brightness

Web Interface

cnxsoft posted a simple CGI script (relay.cgi) to control the relay from a web interface:

Simply create the directory /www/cgi-bin/ and create the relay.cgi script as follows and give execute permission (chmod +x /www/cgi-bin/relay.cgi).

#!/bin/sh
echo "Content-Type: text/plain"
echo "Cache-Control: no-cache, must-revalidate"
echo "Expires: Sat, 26 Jul 1997 05:00:00 GMT"
echo

RELAY_CTRL=/sys/class/leds/tp-link:blue:relay/brightness

case "$QUERY_STRING" in
 state) 
  case "`cat $RELAY_CTRL`" in
   0) echo "OFF"
   ;;
   1) echo "ON"
   ;;
  esac
 ;;
 on) 
  echo 1 > $RELAY_CTRL
  echo OK
 ;;
 off) 
  echo 0 > $RELAY_CTRL
  echo OK
 ;;
esac

Open a browser and use the following URLs to control the relay:

http://your_device_ip/cgi-bin/relay.cgi?on

http://your_device_ip/cgi-bin/relay.cgi?off

Power Limits

The Smart Plug has a max current of 10 A or 2,200 W. A fire may be caused by exceeding these limits.

Google+ Group

Hacking the the Smart Plug now has a community group setup on Google+ Groups.