search

tuya-cloudcutter / lightleak

Firmware version-agnostic PoC exploit for smart devices
46 stars 10 forks source link

How to flash a lightleak "CustomAP device" to e.g. OpenBeken #14

Closed Plumakeem closed 8 months ago

Plumakeem commented 1 year ago

I'd like to flash one of my BK7231N devices to the lightleak/LibreTuya binary. Is it possible to reflash it after using it for its purpose back to e.g. OpenBeken (without manually flashing the device)?

kuba2k2 commented 1 year ago

Lightleak firmware is not meant to be flashed to actual devices, it's only used as an access point in the process. After exploiting a device with Lightleak, it's functionality doesn't change (it stays on the stock firmware). The Lightleak firmware has to be flashed manually and doesn't contain an OTA system to reflash it to anything else.

LibreTuya is a platform allowing Lightleak firmware to work on Beken chips, as well as running ESPHome on said hardware.

whcrg commented 8 months ago

I think the original poster was asking can the custom AP device be some random already exploited device, and AP-firmware flashed OTA and later some other firmware again OTAed in to use it for ither purpose, without physical access to pins.

That is my question that brought me here... do I need to acquire blank esp23 or some such fr the AP role, or just use for example tuya plug I have lying around, or make some other dummy AP?

Does the custom AP actually active do something, or just exist as AP without internet and that could be replaced with suitable linux laptop configured suitably?

kuba2k2 commented 8 months ago

The AP has to be specifically named, and most importantly have a specific password (non-ASCII), which is not possible to achieve with a Linux AP.

You can use a spare tuya plug, but you have to flash it by wires. Otherwise you won't be able to remove the AP firmware - ever. The Lightleak firmware doesn't have any OTA updating functionality.

Cossid commented 8 months ago

Lightleak requires an intermediate device to act as an AP to listen and send commands. This device can be ESP8266, ESP32, Realtek RTL8710B, or Beken, but that device requires serial access, there is no way to achieve this portion of the requirements via OTA.