# Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source.

I ran metasploit against it and had no luck, it did find some open ports for upnp and something called twonkymedia but I was not able to get anywhere with that.

I have a Hisense LTDN50K220GWUS (Hisense 50H5GB) Smart TV that is running what appears to be a customized version of "Opera TV OS" Running on "Linux-3.0.13" and is using uboot, I tried connecting a usb keyboard to the ports and pounding escape and other buttons but that didn't get me anywhere.

Using Binwalk I was able to extract so info from a rom firmware image: binwalk output

• Link to binwalk output is dead. Providing a link to a full firmware image will also help. – w s Oct 29 '15 at 8:10
• Working for me! – Bob R Nov 12 '15 at 23:46

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve the problem with the display of some of the file names in the Russian keyboard layout that used to be displayed as question marks.... See my research on the link http://openlgtv.org.ru/forum/viewtopic.php?f=17&t=170280

Use binwalk to extract rootfs, then search for file passwd in /etc/ You will discover every users available. Look for root user, this should look like:

root:x3FrTg6uYT7.:0:0:root:/:/bin/sh


Recover the x3FrTg6uYT7string and give it to John the ripper software. This one will try to brute force the password. Once done you will need to find a debug port on your TV.

I advise you to take a look at this link. Finally connect your RS232 com cable, power on your tv and wait for a shell asking for root password :)

Have fun.

• Is ther any root account ? Can you copy/paste the line ? – VivienG Oct 29 '15 at 15:33
• As you may know x means that the password is in /etc/shadow. But as you said there is no shadow file, that's quite strange ... However, shadow file is not obliged to be in /etc/shadow if I remember well, I propose you to do something like grep -R "root:" /path/to/your/rootfs to find the shadow file. – VivienG Oct 29 '15 at 15:43