Metasploit-framework: Improve check method in Belkin Wemo UPnP RCE

Created on 22 Feb 2019  路  17Comments  路  Source: rapid7/metasploit-framework

Putting this ticket up so I don't forget.

I wanted to improve the check method in exploit/linux/upnp/belkin_wemo_upnp_exec ~and auxiliary/admin/wemo/crockpot~ (irrelevant) a firmware version check, but I forgot the UPnP action and don't have access to the device at the moment.

Edit: I also didn't discover the vulnerable version number until much later in development. Now we have it.

@nstarke has kindly volunteered to help with that this weekend. No pressure. This is just for coordination. :P

For #10731 and #11409.

enhancement module
Source
picture wvu-r7

Most helpful comment

@wvu-r7 Will try to get this into pull request form this weekend!

picture nstarke on 22 Feb 2019
❤2

All 17 comments

Example request response cycles below:

Request:

POST /upnp/control/firmwareupdate1 HTTP/1.1
SOAPAction: "urn:Belkin:service:firmwareupdate:1#GetFirmwareVersion"
Host: 192.168.40.102:49153
Content-Type: text/xml
Content-Length: 275
Connection: close

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<s:Body>
    <u:GetFirmwareVersion xmlns:u="urn:Belkin:service:firmwareupdate:1">

    </u:GetFirmwareVersion>
</s:Body>
</s:Envelope>

Response:

HTTP/1.1 200 OK
CONTENT-LENGTH: 377
CONTENT-TYPE: text/xml; charset="utf-8"
DATE: Fri, 22 Feb 2019 17:53:38 GMT
EXT:
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body>
<u:GetFirmwareVersionResponse xmlns:u="urn:Belkin:service:firmwareupdate:1">
<FirmwareVersion>FirmwareVersion:WeMo_WW_2.00.11057.PVT-OWRT-InsightV2|SkuNo:Plugin Device</FirmwareVersion>
</u:GetFirmwareVersionResponse>
</s:Body> </s:Envelope>
nstarke picture nstarke on 22 Feb 2019
👀1

@wvu-r7 Will try to get this into pull request form this weekend!

nstarke picture nstarke on 22 Feb 2019
❤2

You rock! I appreciate it!

wvu-r7 picture wvu-r7 on 22 Feb 2019

We can do a Gem::Version check against 2.00.8643 and return CheckCode::Appears, then force the existing check to CheckCode::Detected.

wvu-r7 picture wvu-r7 on 22 Feb 2019

Something like this:

https://github.com/rapid7/metasploit-framework/blob/3871e45196067375d31705cbaefab697ab1ca1b2/modules/exploits/unix/webapp/jquery_file_upload.rb#L78-L115

Or this:

https://github.com/rapid7/metasploit-framework/blob/3871e45196067375d31705cbaefab697ab1ca1b2/modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb#L59-L77

wvu-r7 picture wvu-r7 on 22 Feb 2019

I would LOVE to see UPnP library support in Metasploit, btw. That might be a fun "summer" project, perhaps for a GSoC student.

wvu-r7 picture wvu-r7 on 22 Feb 2019

Yeah me too, because right now I'm patching miranda

nstarke picture nstarke on 22 Feb 2019

Value can also be found in /setup.xml in node root->device->firmwareVersion - that is probably what I will end up using to grab the device firmware version.

nstarke picture nstarke on 22 Feb 2019
👍1

The check method already grabs that file, so feel free to work off that!

wvu-r7 picture wvu-r7 on 22 Feb 2019

Since we're working with XML, I think XPath will be the way to go:

https://github.com/rapid7/metasploit-framework/blob/76724b46c289e3bbb3c5bb5e4168c188725de71a/modules/auxiliary/admin/wemo/crockpot.rb#L91

Regex is too brutish.

wvu-r7 picture wvu-r7 on 22 Feb 2019

that will make my xml parsing sooooo much cleaner, thank you @wvu-r7

nstarke picture nstarke on 22 Feb 2019
❤1

Hey @wvu-r7 sorry to bother you but I can't get the xpath functions (at, search, xpath) to retrieve any nodes from the XML graph. The xml data looks like this:

<?xml version="1.0"?>
<root xmlns="urn:Belkin:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
<deviceType>urn:Belkin:device:insight:1</deviceType>
<friendlyName>WeMo Insight upstairs 2</friendlyName>
    <manufacturer>Belkin International Inc.</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Insight 1.0</modelDescription>
    <modelName>Insight</modelName>
    <modelNumber>1.0</modelNumber>
    <modelURL>http://www.belkin.com/plugin/</modelURL>
<serialNumber>231652K1200478</serialNumber>
<UDN>uuid:Insight-1_0-231652K1200478</UDN>
    <UPC>123456789</UPC>
<macAddress>149182B45F38</macAddress>
<firmwareVersion>WeMo_WW_2.00.11057.PVT-OWRT-InsightV2</firmwareVersion>
<iconVersion>0|49154</iconVersion>
<binaryState>0</binaryState>
    <iconList> 
      <icon> 
        <mimetype>jpg</mimetype> 
        <width>100</width> 
        <height>100</height> 
        <depth>100</depth> 
         <url>icon.jpg</url> 
      </icon> 
    </iconList>
    <serviceList>
      <service>
        <serviceType>urn:Belkin:service:WiFiSetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:WiFiSetup1</serviceId>
        <controlURL>/upnp/control/WiFiSetup1</controlURL>
        <eventSubURL>/upnp/event/WiFiSetup1</eventSubURL>
        <SCPDURL>/setupservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:timesync:1</serviceType>
        <serviceId>urn:Belkin:serviceId:timesync1</serviceId>
        <controlURL>/upnp/control/timesync1</controlURL>
        <eventSubURL>/upnp/event/timesync1</eventSubURL>
        <SCPDURL>/timesyncservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:basicevent:1</serviceType>
        <serviceId>urn:Belkin:serviceId:basicevent1</serviceId>
        <controlURL>/upnp/control/basicevent1</controlURL>
        <eventSubURL>/upnp/event/basicevent1</eventSubURL>
        <SCPDURL>/eventservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>
        <serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>
        <controlURL>/upnp/control/firmwareupdate1</controlURL>
        <eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>
        <SCPDURL>/firmwareupdate.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:rules:1</serviceType>
        <serviceId>urn:Belkin:serviceId:rules1</serviceId>
        <controlURL>/upnp/control/rules1</controlURL>
        <eventSubURL>/upnp/event/rules1</eventSubURL>
        <SCPDURL>/rulesservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:metainfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:metainfo1</serviceId>
        <controlURL>/upnp/control/metainfo1</controlURL>
        <eventSubURL>/upnp/event/metainfo1</eventSubURL>
        <SCPDURL>/metainfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:remoteaccess:1</serviceType>
        <serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>
        <controlURL>/upnp/control/remoteaccess1</controlURL>
        <eventSubURL>/upnp/event/remoteaccess1</eventSubURL>
        <SCPDURL>/remoteaccess.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:deviceinfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:deviceinfo1</serviceId>
        <controlURL>/upnp/control/deviceinfo1</controlURL>
        <eventSubURL>/upnp/event/deviceinfo1</eventSubURL>
        <SCPDURL>/deviceinfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:insight:1</serviceType>
        <serviceId>urn:Belkin:serviceId:insight1</serviceId>
        <controlURL>/upnp/control/insight1</controlURL>
        <eventSubURL>/upnp/event/insight1</eventSubURL>
        <SCPDURL>/insightservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:smartsetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:smartsetup1</serviceId>
        <controlURL>/upnp/control/smartsetup1</controlURL>
        <eventSubURL>/upnp/event/smartsetup1</eventSubURL>
        <SCPDURL>/smartsetup.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:manufacture:1</serviceType>
        <serviceId>urn:Belkin:serviceId:manufacture1</serviceId>
        <controlURL>/upnp/control/manufacture1</controlURL>
        <eventSubURL>/upnp/event/manufacture1</eventSubURL>
        <SCPDURL>/manufacture.xml</SCPDURL>
      </service>

    </serviceList>
   <presentationURL>/pluginpres.html</presentationURL>
</device>
</root>

What am I missing here? I was able to parse this out successfully using REXML, but the code was ugggggggly

nstarke picture nstarke on 22 Feb 2019

nevermind, looks like I dont even need to parse the XML to extract the version.

nstarke picture nstarke on 22 Feb 2019

I created https://github.com/rapid7/metasploit-framework/pull/11463/files for this!

nstarke picture nstarke on 22 Feb 2019

XPath example against the HTTP response object:

[1] pry(#<Msf::Modules::Exploit__Linux__Upnp__Belkin_wemo_upnp_exec::MetasploitModule>)> res = Rex::Proto::Http::Response.new
=> #<Rex::Proto::Http::Response:0x00007fad5bec91d0
 @auto_cl=true,
 @body="",
 @bufq="",
 @chunk_max_size=10,
 @chunk_min_size=1,
 @code=200,
 @count_100=0,
 @headers={},
 @inside_chunk=false,
 @message="OK",
 @proto="1.1",
 @state=1,
 @transfer_chunked=false>
[2] pry(#<Msf::Modules::Exploit__Linux__Upnp__Belkin_wemo_upnp_exec::MetasploitModule>)> res.body = File.read('setup.xml')
=> "<?xml version=\"1.0\"?>\n<root xmlns=\"urn:Belkin:device-1-0\">\n  <specVersion>\n    <major>1</major>\n    <minor>0</minor>\n  </specVersion>\n  <device>\n<deviceType>urn:Belkin:device:insight:1</deviceType>\n<friendlyName>WeMo Insight upstairs 2</friendlyName>\n    <manufacturer>Belkin International Inc.</manufacturer>\n    <manufacturerURL>http://www.belkin.com</manufacturerURL>\n    <modelDescription>Belkin Insight 1.0</modelDescription>\n    <modelName>Insight</modelName>\n    <modelNumber>1.0</modelNumber>\n    <modelURL>http://www.belkin.com/plugin/</modelURL>\n<serialNumber>231652K1200478</serialNumber>\n<UDN>uuid:Insight-1_0-231652K1200478</UDN>\n    <UPC>123456789</UPC>\n<macAddress>149182B45F38</macAddress>\n<firmwareVersion>WeMo_WW_2.00.11057.PVT-OWRT-InsightV2</firmwareVersion>\n<iconVersion>0|49154</iconVersion>\n<binaryState>0</binaryState>\n    <iconList> \n      <icon> \n        <mimetype>jpg</mimetype> \n        <width>100</width> \n        <height>100</height> \n        <depth>100</depth> \n         <url>icon.jpg</url> \n      </icon> \n    </iconList>\n    <serviceList>\n      <service>\n        <serviceType>urn:Belkin:service:WiFiSetup:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:WiFiSetup1</serviceId>\n        <controlURL>/upnp/control/WiFiSetup1</controlURL>\n        <eventSubURL>/upnp/event/WiFiSetup1</eventSubURL>\n        <SCPDURL>/setupservice.xml</SCPDURL>\n      </service>\n      <service>\n        <serviceType>urn:Belkin:service:timesync:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:timesync1</serviceId>\n        <controlURL>/upnp/control/timesync1</controlURL>\n        <eventSubURL>/upnp/event/timesync1</eventSubURL>\n        <SCPDURL>/timesyncservice.xml</SCPDURL>\n      </service>\n      <service>\n        <serviceType>urn:Belkin:service:basicevent:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:basicevent1</serviceId>\n        <controlURL>/upnp/control/basicevent1</controlURL>\n        <eventSubURL>/upnp/event/basicevent1</eventSubURL>\n        <SCPDURL>/eventservice.xml</SCPDURL>\n      </service>\n      <service>\n        <serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>\n        <controlURL>/upnp/control/firmwareupdate1</controlURL>\n        <eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>\n        <SCPDURL>/firmwareupdate.xml</SCPDURL>\n      </service>\n      <service>\n        <serviceType>urn:Belkin:service:rules:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:rules1</serviceId>\n        <controlURL>/upnp/control/rules1</controlURL>\n        <eventSubURL>/upnp/event/rules1</eventSubURL>\n        <SCPDURL>/rulesservice.xml</SCPDURL>\n      </service>\n\t  \n      <service>\n        <serviceType>urn:Belkin:service:metainfo:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:metainfo1</serviceId>\n        <controlURL>/upnp/control/metainfo1</controlURL>\n        <eventSubURL>/upnp/event/metainfo1</eventSubURL>\n        <SCPDURL>/metainfoservice.xml</SCPDURL>\n      </service>\n\n      <service>\n        <serviceType>urn:Belkin:service:remoteaccess:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>\n        <controlURL>/upnp/control/remoteaccess1</controlURL>\n        <eventSubURL>/upnp/event/remoteaccess1</eventSubURL>\n        <SCPDURL>/remoteaccess.xml</SCPDURL>\n      </service>\n\t   \n      <service>\n        <serviceType>urn:Belkin:service:deviceinfo:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:deviceinfo1</serviceId>\n        <controlURL>/upnp/control/deviceinfo1</controlURL>\n        <eventSubURL>/upnp/event/deviceinfo1</eventSubURL>\n        <SCPDURL>/deviceinfoservice.xml</SCPDURL>\n      </service>\n\n      <service>\n        <serviceType>urn:Belkin:service:insight:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:insight1</serviceId>\n        <controlURL>/upnp/control/insight1</controlURL>\n        <eventSubURL>/upnp/event/insight1</eventSubURL>\n        <SCPDURL>/insightservice.xml</SCPDURL>\n      </service>\n\n      <service>\n        <serviceType>urn:Belkin:service:smartsetup:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:smartsetup1</serviceId>\n        <controlURL>/upnp/control/smartsetup1</controlURL>\n        <eventSubURL>/upnp/event/smartsetup1</eventSubURL>\n        <SCPDURL>/smartsetup.xml</SCPDURL>\n      </service>\n      \n      <service>\n        <serviceType>urn:Belkin:service:manufacture:1</serviceType>\n        <serviceId>urn:Belkin:serviceId:manufacture1</serviceId>\n        <controlURL>/upnp/control/manufacture1</controlURL>\n        <eventSubURL>/upnp/event/manufacture1</eventSubURL>\n        <SCPDURL>/manufacture.xml</SCPDURL>\n      </service>\n\n    </serviceList>\n   <presentationURL>/pluginpres.html</presentationURL>\n</device>\n</root>\n"
[3] pry(#<Msf::Modules::Exploit__Linux__Upnp__Belkin_wemo_upnp_exec::MetasploitModule>)> res.get_xml_document.at('firmwareVersion').text
=> "WeMo_WW_2.00.11057.PVT-OWRT-InsightV2"
[4] pry(#<Msf::Modules::Exploit__Linux__Upnp__Belkin_wemo_upnp_exec::MetasploitModule>)>
wvu-r7 picture wvu-r7 on 22 Feb 2019

11463 is merged, so please rebase your work! Feel free to remove the TODO when you do, but please leave the NOCVE note where it is.

wvu-r7 picture wvu-r7 on 22 Feb 2019
👍1

Unpatched Crock-Pot setup.xml:

<?xml version="1.0"?>
<root xmlns="urn:Belkin:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
<deviceType>urn:Belkin:device:crockpot:1</deviceType>
<friendlyName>Crock-Pot庐 Slow Cooker</friendlyName>
    <manufacturer>Belkin International Inc.</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Plugin Socket 1.0</modelDescription>
    <modelName>Socket</modelName>
    <modelNumber>1.0</modelNumber>
    <modelURL>http://www.belkin.com/plugin/</modelURL>
<serialNumber>221733S00000B5</serialNumber>
<UDN>uuid:Crockpot-1_0-221733S00000B5</UDN>
    <UPC>123456789</UPC>
<macAddress>94103E61FC54</macAddress>
<firmwareVersion>WeMo_WW_2.00.6461.PVT</firmwareVersion>
<iconVersion>1|49152</iconVersion>
<binaryState>1</binaryState>
    <iconList> 
      <icon> 
        <mimetype>jpg</mimetype> 
        <width>100</width> 
        <height>100</height> 
        <depth>100</depth> 
         <url>icon.jpg</url> 
      </icon> 
    </iconList>
    <serviceList>
      <service>
        <serviceType>urn:Belkin:service:WiFiSetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:WiFiSetup1</serviceId>
        <controlURL>/upnp/control/WiFiSetup1</controlURL>
        <eventSubURL>/upnp/event/WiFiSetup1</eventSubURL>
        <SCPDURL>/setupservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:timesync:1</serviceType>
        <serviceId>urn:Belkin:serviceId:timesync1</serviceId>
        <controlURL>/upnp/control/timesync1</controlURL>
        <eventSubURL>/upnp/event/timesync1</eventSubURL>
        <SCPDURL>/timesyncservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:basicevent:1</serviceType>
        <serviceId>urn:Belkin:serviceId:basicevent1</serviceId>
        <controlURL>/upnp/control/basicevent1</controlURL>
        <eventSubURL>/upnp/event/basicevent1</eventSubURL>
        <SCPDURL>/eventservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:crockpotevent:1</serviceType>
        <serviceId>urn:Belkin:serviceId:crockpotevent1</serviceId>
        <controlURL>/upnp/control/crockpot1</controlURL>
        <eventSubURL>/upnp/event/crockpot1</eventSubURL>
        <SCPDURL>/jardenservice.xml</SCPDURL>
      </service>    
    <service>
        <serviceType>urn:Belkin:service:jardenevent:1</serviceType>
        <serviceId>urn:Belkin:serviceId:jardenevent1</serviceId>
        <controlURL>/upnp/control/jardenevent1</controlURL>
        <eventSubURL>/upnp/event/jardenevent1</eventSubURL>
        <SCPDURL>/jardenservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>
        <serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>
        <controlURL>/upnp/control/firmwareupdate1</controlURL>
        <eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>
        <SCPDURL>/firmwareupdate.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:rules:1</serviceType>
        <serviceId>urn:Belkin:serviceId:rules1</serviceId>
        <controlURL>/upnp/control/rules1</controlURL>
        <eventSubURL>/upnp/event/rules1</eventSubURL>
        <SCPDURL>/rulesservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:metainfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:metainfo1</serviceId>
        <controlURL>/upnp/control/metainfo1</controlURL>
        <eventSubURL>/upnp/event/metainfo1</eventSubURL>
        <SCPDURL>/metainfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:remoteaccess:1</serviceType>
        <serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>
        <controlURL>/upnp/control/remoteaccess1</controlURL>
        <eventSubURL>/upnp/event/remoteaccess1</eventSubURL>
        <SCPDURL>/remoteaccess.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:deviceinfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:deviceinfo1</serviceId>
        <controlURL>/upnp/control/deviceinfo1</controlURL>
        <eventSubURL>/upnp/event/deviceinfo1</eventSubURL>
        <SCPDURL>/deviceinfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:smartsetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:smartsetup1</serviceId>
        <controlURL>/upnp/control/smartsetup1</controlURL>
        <eventSubURL>/upnp/event/smartsetup1</eventSubURL>
        <SCPDURL>/smartsetup.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:manufacture:1</serviceType>
        <serviceId>urn:Belkin:serviceId:manufacture1</serviceId>
        <controlURL>/upnp/control/manufacture1</controlURL>
        <eventSubURL>/upnp/event/manufacture1</eventSubURL>
        <SCPDURL>/manufacture.xml</SCPDURL>
      </service>

    </serviceList>
   <presentationURL>/pluginpres.html</presentationURL>
</device>
</root>

Patched Switch setup.xml:

<?xml version="1.0"?>
<root xmlns="urn:Belkin:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
<deviceType>urn:Belkin:device:controllee:1</deviceType>
<friendlyName>living room lights</friendlyName>
    <manufacturer>Belkin International Inc.</manufacturer>
    <manufacturerURL>http://www.belkin.com</manufacturerURL>
    <modelDescription>Belkin Plugin Socket 1.0</modelDescription>
<modelName>Socket</modelName>
    <modelNumber>1.0</modelNumber>
<hwVersion>v2</hwVersion>
    <modelURL>http://www.belkin.com/plugin/</modelURL>
<serialNumber>221739K0107021</serialNumber>
<UDN>uuid:Socket-1_0-221739K0107021</UDN>
    <UPC>123456789</UPC>
<macAddress>58EF68F439C8</macAddress>
<hkSetupCode>507-67-282</hkSetupCode>
<firmwareVersion>WeMo_WW_2.00.11143.PVT-OWRT-SNSV2</firmwareVersion>
<iconVersion>1|49152</iconVersion>
<binaryState>0</binaryState>
    <iconList>
      <icon>
        <mimetype>jpg</mimetype>
        <width>100</width>
        <height>100</height>
        <depth>100</depth>
         <url>icon.jpg</url>
      </icon>
    </iconList>
    <serviceList>
      <service>
        <serviceType>urn:Belkin:service:WiFiSetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:WiFiSetup1</serviceId>
        <controlURL>/upnp/control/WiFiSetup1</controlURL>
        <eventSubURL>/upnp/event/WiFiSetup1</eventSubURL>
        <SCPDURL>/setupservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:timesync:1</serviceType>
        <serviceId>urn:Belkin:serviceId:timesync1</serviceId>
        <controlURL>/upnp/control/timesync1</controlURL>
        <eventSubURL>/upnp/event/timesync1</eventSubURL>
        <SCPDURL>/timesyncservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:basicevent:1</serviceType>
        <serviceId>urn:Belkin:serviceId:basicevent1</serviceId>
        <controlURL>/upnp/control/basicevent1</controlURL>
        <eventSubURL>/upnp/event/basicevent1</eventSubURL>
        <SCPDURL>/eventservice.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>
        <serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>
        <controlURL>/upnp/control/firmwareupdate1</controlURL>
        <eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>
        <SCPDURL>/firmwareupdate.xml</SCPDURL>
      </service>
      <service>
        <serviceType>urn:Belkin:service:rules:1</serviceType>
        <serviceId>urn:Belkin:serviceId:rules1</serviceId>
        <controlURL>/upnp/control/rules1</controlURL>
        <eventSubURL>/upnp/event/rules1</eventSubURL>
        <SCPDURL>/rulesservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:metainfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:metainfo1</serviceId>
        <controlURL>/upnp/control/metainfo1</controlURL>
        <eventSubURL>/upnp/event/metainfo1</eventSubURL>
        <SCPDURL>/metainfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:remoteaccess:1</serviceType>
        <serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>
        <controlURL>/upnp/control/remoteaccess1</controlURL>
        <eventSubURL>/upnp/event/remoteaccess1</eventSubURL>
        <SCPDURL>/remoteaccess.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:deviceinfo:1</serviceType>
        <serviceId>urn:Belkin:serviceId:deviceinfo1</serviceId>
        <controlURL>/upnp/control/deviceinfo1</controlURL>
        <eventSubURL>/upnp/event/deviceinfo1</eventSubURL>
        <SCPDURL>/deviceinfoservice.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:smartsetup:1</serviceType>
        <serviceId>urn:Belkin:serviceId:smartsetup1</serviceId>
        <controlURL>/upnp/control/smartsetup1</controlURL>
        <eventSubURL>/upnp/event/smartsetup1</eventSubURL>
        <SCPDURL>/smartsetup.xml</SCPDURL>
      </service>

      <service>
        <serviceType>urn:Belkin:service:manufacture:1</serviceType>
        <serviceId>urn:Belkin:serviceId:manufacture1</serviceId>
        <controlURL>/upnp/control/manufacture1</controlURL>
        <eventSubURL>/upnp/event/manufacture1</eventSubURL>
        <SCPDURL>/manufacture.xml</SCPDURL>
      </service>

    </serviceList>
   <presentationURL>/pluginpres.html</presentationURL>
</device>
</root>
wvu-r7 picture wvu-r7 on 27 Feb 2019
Was this page helpful?
0 / 5 - 0 ratings

Related issues

handsomebeast picture handsomebeast  路  3Comments
XSecr3t picture XSecr3t  路  3Comments
ejholmes picture ejholmes  路  3Comments
Sonya2010 picture Sonya2010  路  3Comments
felipee07 picture felipee07  路  3Comments