Skip to content

Latest commit

 

History

History
35 lines (32 loc) · 1.75 KB

HEADLESS.md

File metadata and controls

35 lines (32 loc) · 1.75 KB
Raw

Blind Deployment

A TV with a broken screen can be rooted quite easily, turning it into a useful platform for further research.

The exploit can be saved to a local disk on (Ctrl-S...) a "normal" browser running on a local network. After opening the resulting index.html file a prompt will be shown asking for an IP address of a TV to perform rooting on. This can help when rooting a TV without a working display.

  1. Check if the TV responds on HTTP port 3000 (http://your-tv:3000) - if it does, you can skip step 1 as it already has LG Connect Apps enabled.
  2. Enable LG Connect Apps (Key sequence likely depends on webOS version, this is documented for webOS 3.8)
    • Long press "Quick Settings" on Magic Remote (or press "Quick Settings" once, ↑, OK)
    • Wait a couple of seconds...
    • 3x ↓
    • 1x →
    • 4x ↓ (or as many as possible, LG Connect Apps is the last item in the menu)
    • OK (open submenu)
    • OK (enable)
    • Exit (or press back multiple times)
  3. Run an exploit in an external browser providing an IP address of a TV
  4. When asked for a connection prompt after a couple of seconds, press → and OK (or ↓ and OK on webOS 6.x+ / TVs released in 2021+)
  5. TV should reboot after a while and should start responding to unauthenticated telnet connections on its IP address.
  6. Important: since RootMyTV v2 we disable telnet by default after a second reboot. In order to keep it on you will need to connect over telnet on first boot after rooting and remove /var/luna/preferences/webosbrew_telnet_disabled file. To enable SSH daemon use the command echo -n 1 > /var/luna/preferences/webosbrew_sshd_enabled. For default password and instructions for adding SSH key see main README.