ROTH Touchline – time to get owned!
I have JAVA, it sucks, it’s slow, it’s crashes, it’s awful, it’s ugly , I really don’t like it. So what do you do when your home is fitted with the latest super cool floor heating system from ROTH? And it got this crazy bad software, that could be useful, but really is not working as it should… let’s try and have some fun!
I’ve been in contact with ROTH and asked if there was an API I could use, so that I could develop a third-party sw to controll my system, but that was a clear no no. So I start digging. The software can be downloaded from http://www.roth-nordic.no/softwareoppdateringer.htm. So I could try reverse engineer the java, and see what was under the hood, but as I said before, I do not like JAVA…..
Let’s poke around..
HTTP/1.1 200 OK
Server: Keil-EWEB/2.1
Content-Type: text/html
Cache-Control: no-cache
Connection: close
Okey, so this is a embed web server that are handling my request…
Firing up Burp Suit, my new favourit tool, let it handle all my request.
The login is just a joke, you do not need the password of “1234”, there is no session handling, or anything.. so hurray for bad programing!
Interesting files:
ILRReadValues.cgi – This will give you all the info you ever want.
writeVal.cgi – This will write anything you want.
For ILRReadValues.cgi this are the interesting fields. They are all in the <item_list> tag.
totalNumberOfDevices <– Gives you how many controllers you have. (I’ve got 10)
GX.RaumTemp <– Gives you the temperature for the room
GX.TempSIUnit<– Gives the unit, haven’t digged into this one, as mine is set to Celsius
GX.name <– Gives you the sensor name, if you have set on
GX.WeekProg<– What kind of program it’s running
Change out the X with the number for your sensor.
For writeVal.cgi
SollTemp=xxx (where xxxx is your desired temperature)
OPMode=1 = Night
OPMode=2 = Off / Holiday
OPmode=0 = Day
WeekProg=0 = Av
WeekProg=1 = Pro I
WeekProg=2 = Pro II
WeekProg=3 = Pro III
Let’s get some values, my roth system is running on x.y.z.k ip…
curl -s -k -X ‘POST’ \
-H ‘Content-Type: text/xml’ -H ‘User-Agent: SpiderControl/1.0 (iniNet-Solutions GmbH)’ \
–data-binary $'<body><item_list><i><n>G0.RaumTemp</n></i><i><n>G1.RaumTemp</n></i><i><n>G2.RaumTemp</n></i><i><n>G3.RaumTemp</n></i><i><n>G4.RaumTemp</n></i><i><n>G5.RaumTemp</n></i><i><n>G6.RaumTemp</n></i><i><n>G7.RaumTemp</n></i><i><n>G8.RaumTemp</n></i><i><n>G9.RaumTemp</n></i></item_list></body>’ \
‘http://x.y.z.k/cgi-bin/ILRReadValues.cgi’
This will give me
<body><item_list><i><n>G0.RaumTemp</n><v>2086</v></i><i><n>G1.RaumTemp</n><v>1903</v></i><i><n>G2.RaumTemp</n><v>1895</v></i><i><n>G3.RaumTemp</n><v>1999</v></i><i><n>G4.RaumTemp</n><v>2043</v></i><i><n>G5.RaumTemp</n><v>2188</v></i><i><n>G6.RaumTemp</n><v>2110</v></i><i><n>G7.RaumTemp</n><v>1710</v></i><i><n>G8.RaumTemp</n><v>2014</v></i><i><n>G9.RaumTemp</n><v>2012</v></i></item_list></body>
Here you can actually see my temperatures in my house… Nice and warm… 🙂
If i think G0 should be a bit warm I would set this to 24 degrees…
curl -i -s -k -X ‘GET’ \
-H ‘User-Agent: Mozilla/4.0 (Windows 8 6.2) Java/1.6.0_43’ \
‘http://x.y.z.k/cgi-bin/writeVal.cgi?G0.SollTemp=2400‘
Now I need to write this a php-wrapper, pull data from sensors once every X minutes, log it to database, has the option of controlling my sensors an so on..
21 Coments