kopia lustrzana https://github.com/RootMyTV/RootMyTV.github.io
36 wiersze
1.8 KiB
Markdown
36 wiersze
1.8 KiB
Markdown
## Blind Deployment
|
|
|
|
A TV with a broken screen can be rooted quite easily, turning it into a useful platform
|
|
for further research.
|
|
|
|
[The exploit](https://rootmy.tv) can be saved to a local disk on (Ctrl-S...) a
|
|
"normal" browser running on a local network. After opening the resulting
|
|
`index.html` file a prompt will be shown asking for an IP address of a TV to
|
|
perform rooting on. This can help when rooting a TV without a working display.
|
|
|
|
0. Check if the TV responds on HTTP port 3000 (http://your-tv:3000) - if it does,
|
|
you can skip step 1 as it already has LG Connect Apps enabled.
|
|
1. Enable LG Connect Apps (Key sequence likely depends on webOS version, this
|
|
is documented for webOS 3.8)
|
|
- Long press "Quick Settings" on Magic Remote (or press "Quick Settings"
|
|
once, ↑, OK)
|
|
- Wait a couple of seconds...
|
|
- 3x ↓
|
|
- 1x →
|
|
- 4x ↓ (or as many as possible, LG Connect Apps is the last item in the
|
|
menu)
|
|
- OK (open submenu)
|
|
- OK (enable)
|
|
- Exit (or press back multiple times)
|
|
2. Run an exploit in an external browser providing an IP address of a TV
|
|
3. When asked for a connection prompt after a couple of seconds, press → and OK
|
|
(or ↓ and OK on webOS 6.x+ / TVs released in 2021+)
|
|
4. TV should reboot after a while and should start responding to unauthenticated
|
|
telnet connections on its IP address.
|
|
5. **Important:** since RootMyTV v2 we disable telnet by default after a second
|
|
reboot. In order to keep it on you will need to connect over telnet on first
|
|
boot after rooting and remove
|
|
`/var/luna/preferences/webosbrew_telnet_disabled` file. To enable SSH daemon
|
|
use the command `echo -n 1 > /var/luna/preferences/webosbrew_sshd_enabled`.
|
|
For default password and instructions for adding SSH key see main README.
|