Vincent 0xBADEAFFE

WTA backdoor/vulnerability

Overview

There is a vulnerability/backdoor in webOS 5+ that allows you to easily run arbitrary commands as root during the boot process. The easiest way to exploit it simply involves putting a file on a USB drive and having it connected to your TV while it boots. There are two other methods that are more complex and require additional exploits.

This is a collection of a few of my smaller webOS scripts.

License: AGPL v3 or later

Debugging apps (inspect)

Inspectability

Developer mode apps (those installed in /media/developer) are inspectable by default. Other apps (e.g., from the LG Content Store) are not inspectable by default, but you can add "inspectable": true to their appinfo.json to enable it. Debugging system apps (i.e., those in /usr/palm/applications) may require a special flag.

Ports

The developer mode app debugger listens on port 9998.

System service and system app debugging uses ports 5885 and 9999, respectively. However, debugging for these is not normally enabled.

Inspecting an app

How to Create an SSH Key for webOS with PuTTYgen

Introduction

This is a guide aimed at Windows users who want to set up public key SSH authentication for their webOS TVs. It is assumed that your TV is rooted.

This guide does not cover the Developer Mode SSH server on port 9922, although much of it still applies to that.

The SSH key that will be created can be used in applications such as PuTTY, WinSCP, and Filezilla. You'll be able to connect to your TV without having to type a password. You can even set the username in advance for one-click connections.

On other platforms (e.g., Linux), you're probably going to want to use ssh-keygen.

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

Warnings

What you do with this information is your own responsibility. If you brick your TV trying this, it's not my fault. You should probably have some electronics experience if you want to attempt this.

This is going to involve opening your TV and attaching wires to the pins of an integrated circuit. If you're not comfortable with that, this is not for you.

This document is a work in progress.

debugstatus

LG TVs since at least the era of NetCast and "Global Platform" (webOS predecessors) have had the notion of a debug level, generally called "debugstatus". There are three modes: DEBUG, EVENT, and RELEASE. TVs normally operate in RELEASE mode. DEBUG mode enables a variety of logging and other debugging features in webOS, including access to the bootloader console and debug menus via serial. EVENT is similar to DEBUG, although it may not enable as much logging and has other relatively minor differences.

Run docker in macos without docker desktop

NOTE: I want disclaimer that this work is not complete mine. Most of the work here is comming from: https://dhwaneetbhatt.com/blog/run-docker-without-docker-desktop-on-macos

Run brew doctor and update to make sure everything is working and up to date

$ brew doctor
$ brew update

Using colima and Docker Engine on Apple Silicon (M1 Chip)

This tutorial uses Homebrew to install colima and Docker.

It was tested on Apple MacBook Pro (13-inch, M1, 2020) 8G and macOS Monterey version 12.1 (21C52).

Uninstall any Docker version

Make sure you have fully uninstall any versions of Docker. You can check using:

	#!/bin/sh

	# by throwaway96
	# licensed under AGPLv3+
	# https://gist.github.com/throwaway96/bb31a17562eec4d8325020dee8c7e6b5

	cert=/home/root/something.crt
	name=lol_hax
	file="${name}.pem"
	tmp="/tmp/tempcert.pem.${$}"

	from bs4 import BeautifulSoup
	import cloudscraper
	import requests
	import json

	url = input("enter filecrypt link like https://filecrypt.co/Container/73F6D9D43B.html or html filepath like 75C3806BBE.html: ")

	def getlinks(dlc):
	headers = {
	'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0',