[WebOS Software and Hacking General] NiQ1:
Improved root instructions

YOUR WARRANTY IS NOW VOID

Modding your TV (and any device) removes your warranty in nearly all jurisdictions. While I have tested this method on my TV (webOS 1.4.0) and it worked, I cannot guarantee that it will work for you. Changes that you make to your TV (especially with root permissions) can turn your TV into a nice thin wall-mounted brick, either because you have not performed the steps in this guide accurately or because your TV configuration is different - and I will not be liable for any damages, even if you end-up having to buy a new TV. You have been warned. Proceeding from here constitutes your agreement to this.

OK here's my modified method. It's basically the method by sekil and teffd except that it will end with permanent ssh + sftp access (instead of telnet). It also describes the problems that I ran into and how to solve / work around them, in case you run into the same problems.

Resource: http://webos-forums.ru/topic4650.html

This is the original post that describes the basic root method. If you don't understand Russian then use Google Translate. The automatic translation is very comprehensible.

Any changes from the original post will be marked with the "Modified" keyword. Any potential problems will be marked with the "Problem" keyword.

DO NOT INSTALL ANY FIRMWARE UPDATES. I think the latest firmware fixes the vulnerability that this root method exploits. There's no way of telling if and when a new root method will be found.

Create a developer account at LG's developer center.

Modified: The registration page has been moved a little bit. Go to http://developer.lge.com as usual. Click the "Sign In" link (top right, next to the search box) then click on the "Create Account" tab.

Install the developer mode app from the LG store on your TV (it has been removed on March 2018 for "technical reasons" but as of July 2018 it's back.

Start the developer mode app and log-in with the credentials of the developer account your have created on the previous step. Enable developer mode (your TV will restart) then launch the app again and enable key server.

Install the webOS SDK on your computer.

Modified: The download link of the SDK has changed. It's now available at http://http://webostv.developer.lge.com/sdk/installation/

You can opt for the minimal installer since you only need the CLI components and not the whole SDK.

Launch the CLI. In the window that opens type "ares-setup-device".

Select "add" then fill in the information like in this example (change the IP address to match your TV's. The IP address will be displayed on your TV when the developer mode app is open). Do NOT change anything else, including the device name.

** You can modify the device info in the above list, or add new device.
? Select: add
? Enter Device Name: tv2
? Enter Device IP address: 10.123.45.67
? Enter Device Port: 9922
? Enter ssh user: prisoner
? Enter description: new device
? Select authentification: password
? Enter password:
? Save ? Yes
name deviceinfo connection profile
-------- -------------------------- ---------- -------
tv2 prisoner@10.123.45.67:9922 ssh tv

To verify that the TV has been added type "ares-setup-device -list". You will get an output similar to this:

name deviceinfo connection profile
-------- -------------------------- ---------- -------
tv2 prisoner@10.123.45.67:9922 ssh tv
emulator developer@127.0.0.1:6622 ssh tv

Problem: If you get an error message DO NOT PROCEED. You may have not filled all the information correctly. Run ares-setup-device again and re-add your TV.

Type "ares-novacom --device tv2 --getkey" to retrieve the SSH connection's private key (The developer mode SSH server uses key based authentication instead of password). You will see the following message: "input passphrase [default: webos]:". Do NOT just press enter. Open the developer mode account on your TV (if it's not already open). One of the listed details will be a passphrase. That's what you should enter here.

Problem: If you can't find the key file, it's named "tv2_webos" and on Linux it's located at ~/.ssh. On Windows it's located at %USERPROFILE%\.ssh.

To verify that the connection has been established successfully type "ares-install --device tv2 --list". You are supposed to see a list of the apps installed on your TV.

Problem: If you see an error DO NOT PROCEED. You probably mistyped the passphrase. Delete the key file and try again.

Note: Up until this point all steps were taken from the official developer's guide so they are unlikely to break anything. From here on we are stepping into modding territory. THIS IS THE POINT WHERE YOUR WARRANTY NO LONGER EXISTS.

If you're using Windows you will need to use WinSCP / Putty at some point. We need to convert the key file from Linux format to Putty's format (If you're on Linux you don't have to do any steps involving Putty). Download and install the complete Putty package from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html then launch puttygen.exe

Click Conversions -> Import key and select the saved key file. You will be asked for a password. Again, this is the passphrase displayed on the TV screen.

Problem: The password box is displayed again after you click OK. You probably mistyped your password (try again) or you have ignored one of my earlier warnings. Go back and do things accurately.

Click "Save private key" and save the file in the PPK format.

Download the following files:

https://www40.zippyshare.com/v/kIlXSTCQ/file.html

https://www40.zippyshare.com/v/e6P02yzg/file.html

https://www40.zippyshare.com/v/Ewov5oWm/file.html

Modified: Added the files needed for my ssh access (instead of telnet). Added a mirror for the root file in case the original no-longer works.

Rename "6937580_root" to "root"

On Windows, Download WinSCP from https://winscp.net/eng/download.php

Open WinSCP then in the session tab enter "File protocol = SFTP", set "host name" to your TV's IP address, port to 9922, username to "prisoner" and click "..." next to the "Private key file" box and select the PPK file you've just created. Click login.

Problem: You get asked for a password. It's the same passphrase. If it doesn't work then you may have selected the wrong private key file. Close WinSCP and try again.

Push all three files to the TV (default directory)

On Linux, use the following command for each file to push the files to the server:

sftp <file name> -P 22 -i <private key file> prisoner@<tv IP address>

Modified: Upload all 3 files to the TV

Problem: You get asked for a password. It's the same passphrase. If it doesn't work you may have mistyped the private key file name. Note that on Linux you don't need a PPK file. Use the file that was downloaded from the TV instead.

If you used WinSCP you can close it at this point.

We now want to SSH into the server. It's better to use the console SSH client included in most Linux distros. If you don't have access to a Linux machine you can download a Windows version at https://github.com/PowerShell/Win32-OpenSSH/releases (download OpenSSH-win32.zip or OpenSSH-win64.zip according to your Windows version. Alternatively you should be able to use Putty but this has not been tested.

Modified: Provided the Win32-OpenSSH utility, which saves the trouble of installing the huge Cygwin package. Noted that Putty may also work.

Use the following command to SSH into the TV:

ssh -i <private key file> prisoner@192.168.xx -p 9922

Note that you don't use the PPK file here, even on Windows. Use the file that was downloaded from the TV.

If you use Putty (not tested) fill your TV's IP address, set port to 9922, set connection type to SSH, then go to SSH -> Auth click the browse button at the "Private key file for authentication" box and select the PPK file.

The following two problems apply to both native SSH and Putty, both Linux and Windows.

Modified: Provided instructions for Putty.

Problem: You get asked for a password. It's the same passphrase. If it doesn't work you may have mistyped the private key file name / selected the wrong one. Note that the native SSH client uses the file that was downloaded from the server on both Linux and Windows, while Putty uses the PPK file.

Problem: You get an error saying that the server could not allocate a PTY. This is because the SSH server on the TV runs in a chroot jail and on some models it does not have access to a free PTY to allocate. This can be worked around by not allocating a PTY at all. Add the "-T" flag to the ssh command:

ssh -T -i <private key file> prisoner@192.168.xx -p 9922

On Putty go to SSH -> TTY and tick the box "Don't allocate a pseudo-terminal", then connect again (make sure you've set all other settings like before).

In both cases if you did not allocate a PTY then you won't get a shell prompt at all, it'll seem as though the ssh client just hanged but that's not the case. Type any command ("ls" is a good choice) and it should work. Without a PTY we have a very basic shell that does not allow sophisticated utilities (e.g. vi) but it's good enough for now.

The "ls" command should now list the 3 files that we've uploaded. Set the "root" program to be executable with the following command "chmod 755 root"

Up until this point we have not done anything that is likely to break your TV. The next step is the first step that has the potential of going terribly wrong. THIS IS YOUR LAST CHANCE TO BACK OFF.

Execute the root program with "./root", wait for a message saying "try to install any app from market".

Problem: You see some "operation not permitted" errors. As long as the "try to install any app from market" message appears they can be safely ignored.

Problem: The root program fails. That means that you've probably updated your TV too much and the root no longer works. Give up and hope that some other root method will be found in the future.

On your TV, open the LG store and try to install any app.

Problem: Installation fails. Ignore this, this is expected and supposed to happen. Actually if the installation succeeds then unfortunately the root failed.

You'll see the following message:

third stage ok.
try get root - input password 1111
Password:

Type "1111" as the password and you'll be elevated to root permissions (type "id" to verify that).

The root is now only temporary and it limited to the current session only. We'll need to be able to ssh as root and get a normal shell (that'll also have a PTY on all devices).

Break out of the chroot jail by typing the following command: "busybox chroot /proc/1/root"

Make the /etc directory writable using the following commands:

mkdir -p /media/cryptofs/root/etc
cp -r /etc/* /media/cryptofs/root/etc
mount -o bind /media/cryptofs/root/etc /etc

Set a password for the root user using the "passwd" command (just type "passwd")

Problem: It fails and complains that it couldn't get a lock on the shadow file. Just get write permissions for that file using the following command "chmod 600 /etc/shadow". If it fails and complains that the file system is read-only then you probably skipped the previous step. Do it now and repeat.

From now on all steps were developed by me and are not copied from other guides.

Copy the sshd_config_22 to the SSH folder:

cp sshd_config_22 /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/binaries-armv71/opt/openssh/etc/ssh/

Spawn an sshd instance running as an unjailed root:

/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/binaries-armv71/opt/openssh/sbin/sshd -o StrictModes=no -f /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/binaries-armv71/opt/openssh/etc/ssh/sshd_config_22 -h /var/lib/devmode/sshd/ssh_host_rsa_key -p 22

The new server will use the default port 22 instead of 9922.

Connect to the new ssh server. On Linux type "ssh root@<tv ip address>", on Windows use Putty (do not change any settings except the host name to your TV's IP address and verify that port is 22 and that connection type is SSH. The password is the password you've just set using the "passwd" command.

Problem: Connection fails. You probably mistyped one of the previous commands. Check for any errors in the output of the previous steps, then re-do all steps from that one onward.

Once you get a true root shell (this will not have the PTY problem anymore) you may close the previous ssh connection. We're now not limited to one root session but this is still temporary and will not survive a TV restart.

To make the root access permanent use the following commands:

cp /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh.bak
cp /media/developer/start-devmode.sh /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh
chmod 700 /media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh

Cross your hands, reboot the TV, wait around 30-40 seconds then try to SSH again (port 22). If it works then you now have permanent root and don't have to rely on the original vulnerability.

Don't install firmware updates, don't update the developer mode app, don't uninstall / reinstall the developer mode app, don't disable developer mode from within the app (you may disable the key server though), don't reset the TV to factory settings.

Note that when you turn your TV off it shuts down completely (even when on stand-by). You will only have SSH access when the TV is on and it takes around 30-40 seconds for the SSH server to come up.

Have fun and remember that playing too much with root access can still brick your TV and I will not be liable.