{"id":26,"date":"2017-03-10T19:13:06","date_gmt":"2017-03-10T18:13:06","guid":{"rendered":"http:\/\/wp.bizoir.dk\/?p=26"},"modified":"2025-06-16T18:02:31","modified_gmt":"2025-06-16T17:02:31","slug":"maginon-sp-2-smart-plug-part-ii","status":"publish","type":"post","link":"https:\/\/wp.bizoir.dk\/?p=26","title":{"rendered":"Maginon SP-2 Smart Plug – Part 2"},"content":{"rendered":"

Go to part 1<\/a>\u00a0– Go to part 3<\/span><\/u><\/a><\/p>\n

It is now necessary to gather as much information about the plug as possible.<\/p>\n

If you plug it into a power socket and power it on, you will see a new WIFI network SSID available. In my case, it was called “Reco900000621<\/span>“. If you try to connect to it, you will be asked for a network WPA key. If you look at the backside of the plug, you will find the WPA key.<\/p>\n

BTW, the “Reco<\/span>” part turns out to point to the real producer of this plug – apparantly “Reco4Life.com<\/span>“. Their homepage Reco4Life <\/a>is sadly in chinese – at least the forum, where a little bit of usable information (the AT commands) can be found using Google Translate if you are patient. I have not been able to find this exact plug on their website.<\/p>\n

Now you should be connected to the socket. You will see, that you have been assigned the ip-address 10.10.100.150<\/span> and that the gateway (the socket) is assigned the ip-address 10.10.100.254<\/span><\/p>\n

Next task. Which ports are open on the device. If you run a nmap scan from a linux box, you will find these TCP ports open<\/p>\n

nmap -p1-10000 10.10.100.254<\/pre>\n
PORT\u00a0\u00a0\u00a0\u00a0 STATE SERVICE
\n80\/tcp\u00a0\u00a0 open\u00a0 http
\n8899\/tcp open\u00a0 ospf-lite<\/p>\n
and these UDP ports.<\/p>\n
PORT\u00a0\u00a0 STATE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SERVICE
\n53\/udp open|filtered domain
\n67\/udp open|filtered dhcps
\n48899\/udp open|filtered unknown
\nMAC Address: AC:CF:23:XX:XX:XX (Hi-flying electronics technology Co.)<\/p>\n
We can also note, that the MAC belongs to “Hi-flying electronics<\/span>…..”. This points to the producer of the WIFI chip in the socket.<\/p>\n
Since the HTTP port is open, the next obvious step, is to try to connect to it using a browser. If you try, you will be asked to provide a username and password. Since none are available, random guesses will show that ADMIN<\/span>\/ADMIN<\/span> works. Sadly though, all you get for your troubles is a “ERROR:404 Not Found<\/span>” message. No matter what I have tried, I have not been able to find an URL that returns anything else than this error-message. If you find any that works, please let me know.<\/p>\n
Afterwards (unfortunately I cannot remember where) I have found mentioning of other smart plugs which provides this apparantly dummy http-server which is not meant to be used.<\/p>\n
Next possible target is the open TCP port 8899. If you telnet to it<\/p>\n
telnet 10.10.100.254 8899\r\nTrying 10.10.100.254...\r\nConnected to xxxxxxxx.\r\nEscape character is '^]'.<\/pre>\n
nothing happens. Whatever you type, you are treated with a “+ERROR” message. This looked to me like a response to a AT command (like in the good old modem days). Hence I tried many-many AT commands, but I only ever got the +ERROR message.<\/p>\n
As it turns out, at this point already, one can actually control the socket, if you know or guess the exact AT commands to send (on<\/a> \/ off<\/a>). I have only found 4 commands that give a response on this port.<\/p>\n
The downside to issuing the commands here, is that you need to be directly connect to the WIFI network on the socket and cannot access it through your normal network. This makes this solution unusable for most purposes.<\/p>\n
As socket setup is not yet clear, it might be an idea to take a quick look inside the plug – it might be possible to see which IC’s the socket uses<\/p>\n
\"Maginon<\/a>
Maginon SP-2 plug<\/figcaption><\/figure>\n
Sadly, apart from the relay itself, not much important is visible from this side. All the important stuff is apparantly mounted on the reverse side. And it is soldered VERY well to the socket legs, and I do not want to possibly ruin the plug by de-soldering it.<\/p>\n
The only other interesting thing which is visible, is that the socket has a serial interface on the bottom right in the picture. You can use a standard 3V3 serial USB interface to communicate with the socket.<\/p>\n
While it was easy to get the serial communication up and running, I was not able to learn anything relevant from it. I did not investigate it much. On the surface it looks very similar to what you get when you connect to TCP port 8899.<\/p>\n
To connect to the serial interface on the socket, connect the GND, TX og RX pins on the socket to the 3V3 USB interface and use connection settings<\/p>\n
115200 8\/N\/1<\/p>\n
in eg. minicom<\/a> (linux), HyperTerminal (Windows) or similar<\/p>\n","protected":false},"excerpt":{"rendered":"
Go to part 1\u00a0– Go to part 3 It is now necessary to gather as much information about the plug as possible. If you plug it into a power socket and power it on, you will see a new WIFI network SSID available. In my case, it was called “Reco900000621“. If you try to connect … Continue reading “Maginon SP-2 Smart Plug – Part 2”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-26","post","type-post","status-publish","format-standard","hentry","category-hardware"],"_links":{"self":[{"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/posts\/26","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=26"}],"version-history":[{"count":12,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":1158,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=\/wp\/v2\/posts\/26\/revisions\/1158"}],"wp:attachment":[{"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.bizoir.dk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}