Wifi Shower - CrossWater Duo

Hello,

I have a module in my shower that runs a little web server. It has ssh but no idea what the username and password is. I might be able to figure that bit out though.
In the mean time, i have tried running a packet capture to see if i can see http post when i set temp and on/off commands via my browser but looks like it is javascript not strait up html.

Any ideas on how i can get to a point where i can control this device via indigo... i know its a massive open question, just looking for some ideas as i have put off this for a few years now hoping this model might become more mainstream but alas no.
In fact i think i may even have a bloody prototype wifi/web server module as it came with a module (which i still have, resembles and ESP8266) which only spoke to a cloud service and a p*ss poor app, which they pulled then re-added to the appstore. In the middle of that i was sent a new model which support have never heard of and now just ignore me.

Anyway, any ideas to get to control/read any data from this module would be helpful. I rarely use the wifi to do anything with the show but that is because its a faf to get out the phone instead of it pre-heat as i open the bathroom door say before 8am but after 4am... it only pre-heats, it does not stay on for more than 20 seconds when enabled via the web page.

It does have some features id like to read like water consumption, temp, if it is on or off (then i can have the extractor tur on based on the shower being on) etc...

If it has an ESP and you can access it you could reprogram it and then get info in and out


Sent from my iPhone using Tapatalk

Did you inherit this when you moved in?

Wow, this is about a $800 device!

Have you tried contacting the manufacturer for the username/password?

No, i had to re-do the shower room due to a) it was old b) had to rip loads out due to to the old shower leaking and ruining walls and floor so took the plunge.

I cant get any sense out of their helpdesk, they seem to think what i was sent as a replacement wifi module does not exist and only the one they replaced (no http server, cloud service only) does... basically im banging my head against a wall with them


Sent from my iPhone using Tapatalk

In the mean time, i have tried running a packet capture to see if i can see http post when i set temp and on/off commands via my browser but looks like it is javascript not strait up html.

You should have captured something, huh? If you did then post that and let us take a look. Also, could post the HTML from the web page on which the controls reside; often can tell what would/should be sent in that manner.

Pcap found here:https://www.dropbox.com/s/bklko3yaxctzjdw/showerhtml.pcapng?dl=0
This was me loading the page in the image attached and clicking the button to warm-up the shower

Very interested! Plugin maybe?!?!

Unfortunately I may need 2, but would be great!

OK so here is all the html and js i can download: https://www.dropbox.com/s/cgkcdot321tgfnp/shower.zip?dl=0

If someone wants to take a stab at what post commands i can use to turn on/off or get the status of the shower (is it on or off and maybe temp) then I would be very appreciative. For me all i really care about is if it is on or not so i can trigger the extract based on that. I use humidity at the moment but would rather get it going from the moment the shower is turned on then wait till it hits a value (which changes depending on the time of year and weather anyway).

To be able to pre-heat would just be a bonus though need to think of fool proof logic so not to be wasteful.

OK im in on ssh... once i knew the OSI, the module manufacturer is 8Devices... Found their dev wiki so now knew the username... password on second guess... wonderful...nearly as good as another £200 device i have which i found was just a Pi with a fancy case and that had the default password! Internet of ___________

So from what is left in the tmp dir i can see this is a Carambola2 board made by 8Devices. It is running BusyBox and branded Oblamatik AG when you log in so i guess that is who created the device for Crosswater.

Linux crosswater 3.10.49 #13 Tue Mar 22 16:58:34 CET 2016 mips GNU/Linux

Now to see what else i can figure out...

By looking at the ssl cert and the banner i can see that CrossWater just OEM'd this shower from Oblamatik. Here is basically the product i have: http://www.oblamatik.ch/en/products/double-2/
Not sure why i am surprised but that looks like 2 x NEMA 17 Stepper motor in there! Makes sense i guess. Turn X steps Left, output one, X steps right - output 2.. Mix hot and cold in the same way but with mechanical mixer...How i did not see those when i craked it open to put in the new wifi module all thouse years ago i don know... angle i guess. but that is the device down to the psu being placed inside the casing like that.

Just incase anyone is interested

It looks like you can get the general URL for commands and state pulls from the tlc_service.js file. It is doing requests with various GET and POST calls to the device. For instance, the press to warm up seems to generate the following request:

Code: Select all

GET /api/tlc/1/warmup/?q=0.8821329700733374

I am not sure if the query parameter there is used or not -- you could try a request straight to /api/tlc/1/warmup/ in your browser and see if the shower responds. It may be some type of token that must be provided and seems to vary with each request. If so, then we would need to find that Javascript routine and grab it also.

There are also state commands, which is likely to be what you want for pulling status - /api/tlc/1/state/q=XYZ. Following the conversation on the PCAP file, that returns a JSON encoded state which has a couple of properties.

I would try first without the q= parameter and see what happens...

http://192.168.124.4/api/tlc/1/warmup/ returns {"state":2} so i guess it needs a token.

http://192.168.124.4/api/tlc/1/state/ returns {"id":"1","state":"a","progress":0,"set_temperature":0,"function_test":0}

http://192.168.124.4/api/tlc/1/state/ returns {"id":"1","state":"c","progress":0,"set_temperature":25,"function_test":0} during a manually initiated warmup from web interface
http://192.168.124.4/api/tlc/1/state/ returns {"id":"1","state":"a","progress":0,"set_temperature":0,"function_test":0}
So it looks like it only updates the state if initiated by the web interface.... not brilliant but making some progress...

Just downloading everything i can from the device via scp as i have ssh access now (dumbest password ever, this is one reason i have these "smart" devices on their own vlan/ssid with just what access they need), I will then start to trawl through to see if there is anything obvious that can be of use. If you want a look, let me know and ill PM that link as it should not be publicly availible but stupid ssh passwords = loss.

Hi,
Some useful links:

Code: Select all

http://IP_address/#/1/quick_bath_fill

http://IP_address/#/1/measuring_cup

http://IP_address/#/1/bathtub_fill

http://IP_address/#/1/password

http://IP_address/#/1/warm_up

http://IP_address/#/1/function_test

http://IP_address/#/1/info

http://IP_address/#/1/settings

http://IP_address/#/1/network