5

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source.

I ran metasploit against it and had no luck, it did find some open ports for upnp and something called twonkymedia but I was not able to get anywhere with that.

I have a Hisense LTDN50K220GWUS (Hisense 50H5GB) Smart TV that is running what appears to be a customized version of "Opera TV OS" Running on "Linux-3.0.13" and is using uboot, I tried connecting a usb keyboard to the ports and pounding escape and other buttons but that didn't get me anywhere.

Using Binwalk I was able to extract so info from a rom firmware image: binwalk output

Improve this question
2
  • 5
    Link to binwalk output is dead. Providing a link to a full firmware image will also help.
    – w s
    Oct 29, 2015 at 8:10
  • Working for me!
    – Bob R
    Nov 12, 2015 at 23:46

2 Answers 2

Reset to default
5

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve the problem with the display of some of the file names in the Russian keyboard layout that used to be displayed as question marks.... See my research on the link http://openlgtv.org.ru/forum/viewtopic.php?f=17&t=170280

Improve this answer
3

Use binwalk to extract rootfs, then search for file passwd in /etc/ You will discover every users available. Look for root user, this should look like:

root:x3FrTg6uYT7.:0:0:root:/:/bin/sh

Recover the x3FrTg6uYT7string and give it to John the ripper software. This one will try to brute force the password. Once done you will need to find a debug port on your TV.

I advise you to take a look at this link. Finally connect your RS232 com cable, power on your tv and wait for a shell asking for root password :)

Have fun.

Useful links:

http://cities.lk.net/lost_password.htm

http://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/

http://www.cyberciti.biz/faq/understanding-etcshadow-file/

Improve this answer
4
  • Unfortunately there is no password for root in there, nor is there a /etc/shadow, I am trying to get the sources from the manufacturer. If not I will have to see if there is a method to dump from the TV.
    – Bob R
    Oct 29, 2015 at 15:32
  • Is ther any root account ? Can you copy/paste the line ?
    – VivienG
    Oct 29, 2015 at 15:33
  • root:x:0:0:root:/basic:/bin/sh
    – Bob R
    Oct 29, 2015 at 15:35
  • 2
    As you may know x means that the password is in /etc/shadow. But as you said there is no shadow file, that's quite strange ... However, shadow file is not obliged to be in /etc/shadow if I remember well, I propose you to do something like grep -R "root:" /path/to/your/rootfs to find the shadow file.
    – VivienG
    Oct 29, 2015 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.