[Android Software Development] borillion_star:
Hi Guys,

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas?

I ran metasploit against it and had no luck, it did find some open ports for upnp and something

called twonkymedia but I was not able to get anywhere with that.

I have a Hisense LTDN50K220GWUS (Hisense 50H5GB) Smart TV that is running what appears to be a customized version of "Opera TV OS"

Its running on "Linux-3.0.13" and is using Uboot, I tried connecting a usb keyboard to the ports and pounding escape and other buttons

but that didn't get me anywhere.

Using Binwalk I was able to extract so info from a rom firmware image:

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
613 0x265 Unix path: /DTV/ROMCODE/NANDBOOT/V01.00
778954 0xBE2CA ELF, 32-bit LSB relocatable, ARM, version 1 (SYSV)
779300 0xBE424 Unix path: /home/gfkfcmo/CMO/MTK5651_US_II_WFD/vm_linux/chiling/uboot/drv_lib/mt5880/inc
1188782 0x1223AE UBI volume ID header, version: 1, type: 1, volume id: 0, size: 0
1190830 0x122BAE UBIFS superblock node, CRC: 0x50BF95C5, flags: 0x0, min I/O unit size: 2048, erase block size: 126976, erase block count: 1016, max erase blocks: 3271, format version: 4, compression type: lzo
1321902 0x142BAE UBIFS master node, CRC: 0xCC5C7044, highest inode: 2313, commit number: 0
1452974 0x162BAE UBIFS master node, CRC: 0xC06C8559, highest inode: 2313, commit number: 0
2632671 0x282BDF XML document, version: "1.0"
2633575 0x282F67 XML document, version: "1.0"
2636223 0x2839BF XML document, version: "1.0"
2637455 0x283E8F XML document, version: "1.0"
{{{ TRUNKATED }}}
132181160 0x7E0ECA8 Unix path: /mtk94064/p4_views/yaocheng.fei/ws_*<
132236386 0x7E1C462 Unix path: /i686/bin/../sysroot/usr/include
132240154 0x7E1D31A Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*=
132277477 0x7E264E5 Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132295801 0x7E2AC79 Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132320817 0x7E30E31 Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132336687 0x7E34C2F Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132337438 0x7E34F1E Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132362676 0x7E3B1B4 Base64 standard index table
132404806 0x7E45646 Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132432505 0x7E4C279 mcrypt 2.5 encrypted data, algorithm: "N", keysize: 440 bytes, mode: "\",
132462804 0x7E538D4 Base64 standard index table
132499502 0x7E5C82E Unix path: /proj/mtk94064/p4_views/yaocheng.fei/ws_*<
132532241 0x7E64811 mcrypt 2.5 encrypted data, algorithm: "N", keysize: 440 bytes, mode: "\",
132547032 0x7E681D8 Unix path: /mtk94064/p4_views/yaocheng.fei/ws_*<
133142037 0x7EF9615 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
133142057 0x7EF9629 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
133599305 0x7F69049 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
134172625 0x7FF4FD1 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
134360038 0x8022BE6 Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 7064247 bytes, 126 inodes, blocksize: 131072 bytes, created: 2015-01-13 09:46:16
141462558 0x86E8C1E Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 27403340 bytes, 1215 inodes, blocksize: 131072 bytes, created: 2015-01-13 09:47:38
168987734 0xA128C56 Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 27403340 bytes, 1215 inodes, blocksize: 131072 bytes, created: 2015-01-13 09:47:38
196508814 0xBB67C8E uImage header, header size: 64 bytes, header CRC: 0x2C8E13D2, created: 2015-01-13 09:35:35, image size: 2060549 bytes, Data Address: 0x7FC0, Entry Point: 0x8000, data CRC: 0x5A54C3A0, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.13"
196508878 0xBB67CCE LZO compressed data
196508929 0xBB67D01 uImage header, header size: 64 bytes, header CRC: 0xCB5E2D0F, created: 2015-01-13 09:35:33, image size: 3839076 bytes, Data Address: 0x7FC0, Entry Point: 0x8000, data CRC: 0x354C5FF1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.13"
197183535 0xBC0C82F SHA256 hash constants, little endian
198761115 0xBD8DA9B uImage header, header size: 64 bytes, header CRC: 0x2C8E13D2, created: 2015-01-13 09:35:35, image size: 2060549 bytes, Data Address: 0x7FC0, Entry Point: 0x8000, data CRC: 0x5A54C3A0, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.13"
198761179 0xBD8DADB LZO compressed data
198761230 0xBD8DB0E uImage header, header size: 64 bytes, header CRC: 0xCB5E2D0F, created: 2015-01-13 09:35:33, image size: 3839076 bytes, Data Address: 0x7FC0, Entry Point: 0x8000, data CRC: 0x354C5FF1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.13"
199435836 0xBE3263C SHA256 hash constants, little endian