[Fire TV General] slater_g:
Alright, here are my step-by-step instructions. All credits go to [MENTION=6430510]christofsteel[/MENTION] and of course [MENTION=3991724]rbox[/MENTION]

Do this at your own risk!!!

Note 1: My dirtycow file differs from the one [MENTION=4665157]Anutter226[/MENTION] uploaded. It seems to me that he uploaded the "arm" version while I used the "arm-v7a" version. I did not try his but it might also work similarly.

Note 2: I did this all starting on firmware 51.1.4.0. I do not know if it works with other fimwares.

Note 3: Maybe this also works with a Fire TV Stick. At least I did everything over WiFi on the Box just fine.

Make sure you have adb installed and working.

Find out your Fire TV's IP address. I had mine set to use DHCP (dynamic IP).

Connect to your Fire TV (replace with your Fire TV IP) with ADB in the terminal or commandline:

adb connect 192.168.0.111

Download and extract my files to some directory.

Navigate to that directory in the terminal.

Copy the three files to the Fire TV with the following three commands:

adb push dirtycow /data/local/tmp
adb push su /data/local/tmp
adb push ip_script /data/local/tmp

Now, log into the adb shell on the Fire TV:

adb shell

You are now logged into the shell of the Fire TV, indicated by a $ in the new line.

Make the ip_script executable with this command:

chmod 755 /data/local/tmp/ip_script

Make the exploit executable with this command:

chmod 755 /data/local/tmp/dirtycow

Copy the original "ip" binary of the Fire TV to the temp folder:

cp /system/bin/ip /data/local/tmp

Now it is time to run the exploit. As stated in the OP, this might take some time like 5 to 10 minutes:

./dirtycow /system/bin/ip ip_script

When it's done, it should show something like this (exact numbers not important here):

[ *] mmap 0xb51e5000
[ *] exploit (patch)
[ *] currently 0xb51e5000=464c457f
[ *] madvise = 0xb51e5000 17944
[ *] madvise = 0 1048576
[ *] /proc/self/mem 1635778560 1048576
[ *] exploited 0xb51e5000=464c457f

By the way: This step is permanent. So if you reboot the Fire TV, you do not have to do this again.

Optional: You can check if the exploit was executed correctly by typing:

cat /system/bin/ip

This should give you this:

#!/system/bin/sh
mount -o remount,rw /system
cp /data/local/tmp/su /system/xbin
chmod 4755 /system/xbin/su
/data/local/tmp/ip "$@"

End of optional part.

Now you can exit the adb shell with:

exit

Next you have to trigger the exploit: Go into the settings of your Fire TV and use a static IP. There should be somewhere an "advanced" button to set this. I did this via WiFi and to get a static IP I had to "forget" the current WiFi, then select it again, type the passwort and (important) before confirming the password, the "advanced" button was at the bottom of the password dialog.

Set the IP, Gateway, DNS1, DNS2 and some length setting that I set to 24 according to what works in your network. I used a different IP address than before; don't know if that matters.

The Fire TV should now be connected to the network again.

Head back to your terminal and connect again (replace IP with your Fire TV's new static IP):

adb connect 192.168.0.222

Now, log into the adb shell on the Fire TV:

adb shell

Test the superuser access:

su

There should now be a # instead of a $. Therefore you have root!

Now you can continue with downgrading. For this, follow this guide http://www.aftvnews.com/start/ and select the Fire TV 1 (2014) -> Yes -> 51.1.1.0 (not your FW, but that leads to the correct guide)

Start with 4. of the guide to downgrade and follow along with 5., 6. and 7.

Go the the next page of the guide and do steps 2. to 6.

Step 7. of that page is outdated. Instead install TWRP http://xdaforums.com/fire-tv/development/firetv-1-bueller-twrp-recovery-t3383286

After that, install the newest ROM from TRWP. ROM can be found here: http://xdaforums.com/fire-tv/development/prerooted-stock-images-t2882337

Happy flashing!