Bulbs

Wiz Connected smart light bulbs

Exploit

Article about hacking the lights

Source Code

Source code of the hack

Cordova

Apache Cordova framework for mobile apps

Cordova Plugin

SSH Connect Cordova Plugin

KDE Widgets

Mobile Interface

Code

Python Script

wiz-hack.py

import socket

import time

import random

import sys

​

if len(sys.argv) < 3:

    print(help)

    exit()

IP = sys.argv[1]

​

on = """{"params":{"orig":"andr","state":true},"id":6,"method":"setPilot"}"""

off = """{"params":{"orig":"andr","state":false},"id":6,"method":"setPilot"}"""

​

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

s.connect((IP, 38899))

if sys.argv[2] != "on" and sys.argv[2] != "off":

  print("Changing lights color")

  b = sys.argv[2]

  color_send = """{"method":"setPilot","params":{"r":""" + str(255) + ""","g":""" + str(255) + ""","b":""" + str(255) + ""","dimming":""" + str(b) + """}}"""

  print(color_send)

  s.sendall(bytes(color_send, "utf-8"))

  s.close()

elif sys.argv[2] == "on":

    print("Turning on the lights")

    s.sendall(bytes(on, "utf-8"))

    s.close()

elif sys.argv[2] == "off":

    print("Turning off the lights")

    s.sendall(bytes(off, "utf-8"))

    s.close()

Shell Scripts

on.sh

#!/bin/sh

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.94 on

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.177 on

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.207 on

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.254 on

​

off.sh

#!/bin/sh

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.94 off

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.177 off

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.207 off

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.254 off

light.sh

#!/bin/sh

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.94 "$1"

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.177 "$1"

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.207 "$1"

/usr/bin/python /usr/local/bin/wiz-hack.py 192.168.0.254 "$1"

Mobile App

index.html (excerpt)

...

Light Control

​

On

Off

​

​

Brightness:

​

index.js

const user = "user";

const password = "redacted_password";

const host = "192.168.0.218";

const port = "22";

​

var sshConnect;

​

function on() {

  sshConnect.connect(user, password, host, port, () => {

      sshConnect.executeCommand('on.sh', function() {

          sshConnect.disconnect();

      });

  });

}

​

function off() {

  sshConnect.connect(user, password, host, port, () => {

      sshConnect.executeCommand('off.sh', function() {

          sshConnect.disconnect();

      });

  });

}

​

function brightness(level) {

  sshConnect.connect(user, password, host, port, () => {

      sshConnect.executeCommand('light.sh '+level, function() {

          sshConnect.disconnect();

      });

  });

}    

​

document.addEventListener('deviceready', onDeviceReady, false);

​

function onDeviceReady() {

  sshConnect = cordova.plugins.sshConnect;

​

  document.getElementById("onButton").addEventListener("click", () => {

    // Send "on" command to light

    console.log("Light turned on");

    on();

  });

​

  document.getElementById("offButton").addEventListener("click", () => {

    // Send "off" command to light

    console.log("Light turned off");

    off();

  });

​

  document.getElementById("brightnessSlider").addEventListener("input", () => {

    const level = document.getElementById("brightnessSlider").value;

    // Send brightness value to light

    console.log("Brightness set to:", level);

    brightness(level);

  });

}