mirror
/
RootMyTV.github.io
kopia lustrzana https://github.com/RootMyTV/RootMyTV.github.io
1
0
Forkuj 0
Kod Zgłoszenia Projekty Wydania Wiki Aktywność

Cosmetic updates

pull/4/head
David Buchanan 2021-05-13 17:05:13 +01:00
rodzic b23cd4cf03
commit 73fa69e2e4
3 zmienionych plików z 190 dodań i 77 usunięć
Pokaż statystyki Ściągnij plik aktualizacji Ściągnij plik porównania Expand all files Collapse all files

26
exploit/common.css
Wyświetl plik

@ -39,8 +39,13 @@ article > p {
margin: 1em; margin: 1em;
} }
article a, article a:visited {
color: #d653dd;
}
.slider-bar { .slider-bar {
width: 90%; width: 90%;
height: 4em;
margin: 2em auto; margin: 2em auto;
border: 1px solid #fff; border: 1px solid #fff;
position: relative; position: relative;
@ -49,7 +54,6 @@ article > p {
box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.5em #731178, inset 0 0 1em 0.5em #731178, inset 0 0 1px 1px #fff; box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.5em #731178, inset 0 0 1em 0.5em #731178, inset 0 0 1px 1px #fff;
/**/ /**/
background: black;
} }
/* Use pre-baked glow effect to improve perf on the TV itself */ /* Use pre-baked glow effect to improve perf on the TV itself */
@ -70,7 +74,7 @@ background-position: center;
background-repeat: no-repeat; background-repeat: no-repeat;
} }
}*/ }*/
.slider-button { .slider-button {
z-index: 1; z-index: 1;
display: block; display: block;
border: 1px solid #fff; border: 1px solid #fff;
@ -86,8 +90,8 @@ background-repeat: no-repeat;
box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.2em #0bb6be, inset 0 0 1em 0.2em #0bb6be, inset 0 0 1px 1px #fff; box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.2em #0bb6be, inset 0 0 1em 0.2em #0bb6be, inset 0 0 1px 1px #fff;
/**/ /**/
} }
.slider-button > p { .slider-button > p {
cursor: grab; cursor: grab;
font-family: 'Orbitron', sans-serif; font-family: 'Orbitron', sans-serif;
font-size: 3em; font-size: 3em;
@ -97,8 +101,8 @@ background-repeat: no-repeat;
text-shadow: 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 1em #0bb6be, 0 0 0.3em #0bb6be, 0 0 0.3em #0bb6be; text-shadow: 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 1em #0bb6be, 0 0 0.3em #0bb6be, 0 0 0.3em #0bb6be;
/**/ /**/
} }
.slider-text { .slider-text {
margin: 0; margin: 0;
display: block; display: block;
text-align: center; text-align: center;
@ -115,8 +119,8 @@ background-repeat: no-repeat;
position: relative; position: relative;
} }
.slider-text:after { .slider-text:after {
content: "slide to root"; content: "slide to root";
position: absolute; position: absolute;
left: 0; left: 0;
@ -132,16 +136,16 @@ background-repeat: no-repeat;
background-image: linear-gradient(270deg, #000 0%, #11bbc2 15%, #000 30%, #000 100%); background-image: linear-gradient(270deg, #000 0%, #11bbc2 15%, #000 30%, #000 100%);
animation: Shine 3000s linear infinite; animation: Shine 3000s linear infinite;
/**/ /**/
} }
@keyframes Shine { @keyframes Shine {
0%{ 0%{
background-position: 0 0; background-position: 0 0;
} }
100%{ 100%{
background-position: 1000000px 0; /* FIXME: should be percentage, but that breaks it */ background-position: 1000000px 0; /* FIXME: should be percentage, but that breaks it */
} }
} }
#log { #log {
width: 100%; width: 100%;

122
exploit/stage1.html
Wyświetl plik

@ -1,7 +1,9 @@
<!DOCTYPE html>
<html> <html>
<head> <head>
<title>RootMyTV - Stage 1</title> <title>RootMyTV - Stage 1</title>
<meta name="viewport" content="width=1280">
<link rel="stylesheet" href="common.css" /> <link rel="stylesheet" href="common.css" />
</head> </head>
@ -11,13 +13,28 @@
</header> </header>
<hr> <hr>
<section class="content-center"> <section class="content-center">
<button id="exploit" class="slider-bar"> <article id="main-article">
Press to root <p>
</button> This webpage will exploit your LG webOS smart TV, gain local root privileges,
<article> and install the <a href="https://github.com/webosbrew/webos-homebrew-channel">
<pre id="log"></pre> webOS Homebrew Channel.</a> If you don't know what that means, please
read our documentation and writeup <a href="https://github.com/RootMyTV/RootMyTV.github.io">here.</a>
</p>
<p>
Once you're ready to proceed, drag the slider below
(or press "5") to begin.
</p>
<div class="slider-bar">
<div class="slider-button"><p>-&gt;</p></div>
<p class="slider-text">slide to root</p>
</div>
<p>
Note: If you are visting this page from a device that isn't your TV,
you will need to know your TV's local IP address.
</p>
</article> </article>
</section> </section>
<hr>
<script> <script>
window.ORIGIN_URL = window.ORIGIN_URL =
@ -29,6 +46,94 @@
alert('error: ' + JSON.stringify(err) + '\n' + err.fileName + ' ' + err.lineNumber); alert('error: ' + JSON.stringify(err) + '\n' + err.fileName + ' ' + err.lineNumber);
}; };
</script> </script>
<script>
/* slider animation logic */
var slider = document.getElementsByClassName("slider-button")[0];
var sliderText = document.getElementsByClassName("slider-text")[0];
var startX = 0;
var endX = 0;
var posX = 0;
var grabbed = false;
var velX = 0;
var lastUpdate = Date.now();
var prevPosX = 0;
function slidermousedown(e) {
e.preventDefault();
startX = e.clientX;
grabbed = true;
endX = Math.floor(slider.parentElement.clientWidth * 0.827);
//console.log("mousedown");
window.onmousemove = slidermousemove;
window.onmouseup = slidermouseup;
return false;
}
function slidermousemove(e) {
e.preventDefault();
//console.log("mousemove");
var deltaX = e.clientX - startX;
if (deltaX < 0) {
deltaX = 0;
} else if (deltaX > endX) {
deltaX = endX;
}
posX = deltaX; // XXX fixme
}
function slidermouseup(e) {
//console.log("mouseup");
window.onmousemove = null;
window.onmouseup = null;
velX = 0;
if (posX == endX) {
console.log("slid!");
begin_exploit();
slider.onmousedown = null;
} else {
grabbed = false;
}
}
function animate_tick() {
var now = Date.now();
var dt = now - lastUpdate;
ticks = dt/(1000/60);
if (ticks > 4) ticks = 4;
lastUpdate = now;
if (!grabbed && posX != 0) {
var accel = (0.5 + posX/200) * ticks;
velX -= accel;
posX += velX * ticks;
if (posX < 0) {
velX *= -0.3;
posX *= -0.3;
}
if (posX < 0.1) {
posX = 0;
}
}
//document.getElementById("fps").innerText = Math.floor(1000/dt);
if (prevPosX != posX) {
slider.style.left = Math.floor(posX) + "px";
sliderText.style.opacity = 1-(posX/endX);
}
prevPosX = posX;
window.requestAnimationFrame(animate_tick);
}
slider.onmousedown = slidermousedown;
window.requestAnimationFrame(animate_tick);
</script>
<script> <script>
// Exploit data: url navigation for browsers which didn't have following patch // Exploit data: url navigation for browsers which didn't have following patch
// applied yet (webOS 3.x): // applied yet (webOS 3.x):
@ -173,12 +278,15 @@
log("An unexpected error occured: " + err.toString()); log("An unexpected error occured: " + err.toString());
} }
} }
document.querySelector('#exploit').addEventListener('click', function () { function begin_exploit() {
// replace main body with log window
document.querySelector("#main-article").innerHTML = "<pre id='log'></pre>";
// Allow people to download the exploit page to manually set target IP, // Allow people to download the exploit page to manually set target IP,
// in case direct on-tv deployment fails for some reason. // in case direct on-tv deployment fails for some reason.
var target = window.location.protocol === 'file:' ? prompt('Enter IP address of Your TV') : 'localhost'; var target = window.location.protocol === 'file:' ? prompt('Enter IP address of Your TV') : 'localhost';
bootstrap(target, new URL('stage2.html', ORIGIN_URL).href); bootstrap(target, new URL('stage2.html', ORIGIN_URL).href);
}); }
</script> </script>
</body> </body>

1
exploit/stage2.html
Wyświetl plik

@ -1,3 +1,4 @@
<!DOCTYPE html>
<html> <html>
<head> <head>