Nov 192012

I was wandering the aisles of Fry’s Electronics and spotted a display of Westinghouse Outlet Valet’s for under $10.  The second I saw this I knew I my TP-Link wr703n was destined to be stuffed into it.  I also picked up an Inland USB Hub because I know it has the smallest foot print of any hub I’ve seen.  I’ve actually been able to place it under the wr703n board in the original housing.  I also picked up a Kingston 16GB micro SD card which comes with a small footprint USB reader.  Couple that with a Samsung OEM wall charger I had and we got the makings of a computer hiding in plain sight.

I created a Coppermine Photo Gallery album with some pictures I took of the device as it was being made.





Westinghouse Outlet Valet


Inland USB Hub


TP-Link WR703N


Inside of Outlet Valet

 When you open up the Westinghouse Outlet Valet you see that there is plenty of room to fit the WR703N once we replace the 120v AC to 5v DC converter with the much smaller Samsung OEM wall charger.  Here are some additional images of the internals of the outlet valet plus size comparisons between the power converters.

Image 1

Image 2

Image 3


 To open up the Samsung OEM converter I carefully removed the font panel (usb port side) using a guitar pick (from a cell phone repair kit) and a small flat head screw driver.  The front is held in place by clips (no glue).  To get the circuit out I tapped on the prongs.  The prongs aren’t even soldered to the circuit but rest on the board as it is packed into the small enclosure.


Remove Connectors

 The USB ports and RJ45 port are removed from the WR703N circuit board using a solder sucker and desoldering braid/wick.  As highlighted with the image on the right I even drilled out two points keeping the RJ45 in place.


WARNING:  Be super careful removing the micro-usb that powers the board as to not remove the pads that you want to solder.  These two key pads are GND and PWR which are the two outside pins.  I removed it as I had trouble soldering the wires with the port in the way.  So you may consider this step optional.

Board Underside


Solder Points

 After the connectors are removed I attach the USB hub by soldering the wires to the underside of the board.  See which color wire goes to which point in the image to the right in the above paragraph.  I solder a ribbon cable to the pins that communicate with the RJ45 jack.  Only thing you have to remember with the RJ45 is the ribbon lines up with the pins but that is pretty simple.  (NOTE:  I had to desolder two pins on the connector because it was upside down 🙂 )


The image to the left shows the solder points for serial port communication.  The socket I chose to use for serial communication is a 3.5mm jack.  This is great for adding the serial connector to the original WR703N case.  I got the idea from this site.  I picked up the parts from the local Radioshack.  One item I did to mount the 3.3mm jack to the original WR703N case (and subsequently the Outlet Valet) was drill the hole with a 3/8 inch spade bit.  I used the bit to obviously drill the hole for the 3.5mm jack to fit but at the same time I shaved away some of the plastic around the hole to create a recessed area where the nut on the socket can hold it in place without using glue.  This is so I can remove the whole mess of solder, glue, and wires from the case when I need to make modifications.  I placed the port at the topof the Outlet Valet.Here is an image of the socket and jack and which wire gets soldered where.


Modifying USB Hub

The main modification needed to be completed for the USB hub is the removal of the case and the rubber around with wires and USB ports. The image details what changes are made. The original solder points on the hub circuit board are not modified though you may want to touch them up or add more glue. Looking at the shoddy work I’m surprised the hub functions properly. Three of the USB ends are stripped of all rubber and the wires cut. One port has most of the casing left on the wires to keep it neat. Click on the image to the left see where each port is soldered. The circuit board is hot glued to the bottom of the wr703n board. 


Here is what it looks like completed.

 Final Product


  5 Responses to “TP-Link WR703N Custom Pwn Plug”

  1. […] TP-Link WR703N Custom Pwn Plug | Information Systems Auditing via Hack a Day […]

  2. For people visiting this site from Hack a Day. Has anybody gotten Openwrt working with USB tethering? I’m trying to get that to work. It would be a great way to have a back door into the device.

  3. […] Cette personne a eu une idée que nous classerons dans les « audits de sécurité« . […]

  4. Hi, I made it work with an iPhone. I installed this packages on openwrt:

    the ipheth kernel driver

    Also I got it to work with an bluetooth adapter ! (Although it was a tad slow!):

    If u need help mail me, maybe I can help.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>