GetMeIn : One time rooting/jailbreaking tool for webOS LG TV's

Search This thread
By:
Advanced…
Seilenos

Seilenos

Member
Feb 26, 2017
6
1
Moscow
Hello to all.
47LB650V-ZE, WEBOS 1.4.0-2532, firmware 05.05.70
I have passed a quest with GetMeIn script and received Root rights.
Then I have seen "Done! Please restart your System", I turned off/on TV and tryed to access.
And that's the problem.

Trying to access from PC (KiTTY / WinSCP / Linux) - No access..
For ex. WinSCP - Net Error: connect to 192.168.1.70 (TV IP) declined, KiTTY - Network Error, Linux ssh: connect to host 192.168.1.70 port 9922: Connection refused

OK, opening CLI,
write:
ares-setup-device -list
received:
tv2 [email protected]:9922 ssh tv
emulator [email protected]:6622 ssh tv

write:
ares-install --device tv2 --list
received:
ares-install ERR! ares-install: Error: Connection time out. please check the device IP address or port.

ping 192.168.1.70
Ping Statistics for 192.168.1.70:
Sent = 4, Received = 4, Lost = 0

So, trying to connect trough port 22:
$ ssh -i tv2_webos [email protected] -p 22
Enter passphrase for key 'tv2_webos': (writing Developer Mode password)
[email protected]'s password: trying "alpin" password - Permission denied, please try again.
[email protected]'s password: password from Developer Mode - Permission denied, please try again.

Does anybody help me what kind of password I shell to use for access?

Regards, Dmirty
 
platforma

platforma

Member
Dec 8, 2011
7
1
Seilenos said:
So, trying to connect trough port 22:
$ ssh -i tv2_webos [email protected] -p 22
Enter passphrase for key 'tv2_webos': (writing Developer Mode password)
[email protected]'s password: trying "alpin" password - Permission denied, please try again.
[email protected]'s password: password from Developer Mode - Permission denied, please try again.

Does anybody help me what kind of password I shell to use for access?

Regards, Dmirty
Click to expand...
Click to collapse

You need to have KeyServer enabled in Developer Mode on the TV, otherwise it won't let you login with your tv2_webos key. Port should be 9922, at least for me by default. And the ssh passphrase is the "Passphrase" displayed in the Developer Mode app.
 
Seilenos

Seilenos

Member
Feb 26, 2017
6
1
Moscow
platforma said:
You need to have KeyServer enabled in Developer Mode on the TV, otherwise it won't let you login with your tv2_webos key. Port should be 9922, at least for me by default. And the ssh passphrase is the "Passphrase" displayed in the Developer Mode app.
Click to expand...
Click to collapse
Dev Mode is opened, KeyServer enabled.
If I trying to connect by SSH through port 9922 (CLI : tv2 [email protected]:9922 ssh tv) by command in Linux or KiTTY: - ssh -i tv2_webos [email protected] -p 9922 - I have no answer from TV (connection time out), but if I change port to 22 - connection to the TV is available.

Passphrase (from Dev Mode) for tv2_webos is accepted but next step I receive а request for username password. And that's the problem "alpin" password doesn't accepted.
 
L

LLP42

Member
Mar 15, 2021
21
8
Mysteriouslog6 said:
So in Web OS 4.4 the Dev mode is AGAIN in a read write (ext4) environment , so is it possible that you can somehow port it for Web OS 4.4?
Click to expand...
Click to collapse
That's not how it works. You need some form of privilege escalation. The vulnerability exploited by GetMeIn was fixed in the Linux kernel of all LG firmwares a long time ago.

You would need to use a new vulnerability like this.
 
C

crashnburnMDA

Senior Member
May 31, 2006
89
2
Texas
Is it possible to install Web OS FW of a LG Commercial Signage Display on to a matching Consumer Retail model? How?

Or from one Commercial Series to another?
 
W

Wastir

New member
Apr 15, 2021
1
0
Someone have any idea why i can't connect with my tv using ssh? I tried use port 9922 and 22.
ssh1.png

ssh2.png
 
Z

zabrana

New member
Aug 25, 2015
3
0
I got to the last step, but it always showed me this:

GetMeIn: #* Opening memory IO!

GetMeIn: #! Cannot map memory data!

I attached the log files.
Running WebOS 3.4 on my B6.

Thanks in advance.
 

Attachments

  • device_info.json
    360 bytes · Views: 18
  • cpu.log
    1 KB · Views: 11
  • devices.log
    7.5 KB · Views: 8
  • libsdir.log
    90.4 KB · Views: 13
  • logdir.log
    212 bytes · Views: 8
  • os_info.json
    564 bytes · Views: 9
  • procdir.log
    17.9 KB · Views: 7
EwOkie

EwOkie

Senior Member
Dec 10, 2010
1,176
278
GLASGOW, UK
Just seen this
I have an LG UM7400PLB
Software version : 05.10.15

Can i install this and will it allow me to use android apps? (noob)
 
S

Superhack

New member
Oct 17, 2009
1
0
I have a LG signage commercial screen which to my understanding is running WebOS 3 but is locked down (does not allow me to access any app store or add any apps).

1. Is this root approach expected to work also on LG's signage displays running WebOS?
2. Would it allow me to turn it into more of a smart TV so I could install Netflix, Spotify, Disney+, Kodi and similar apps on it?
3. What is needed after rooting to install those apps?
4. Would the apps show up in the menu, so I could start them using the normal remote?

Hope for your help and input.
 
D

dfsdfsadf

New member
Oct 22, 2021
1
1
Seilenos said:
Hello to all.
47LB650V-ZE, WEBOS 1.4.0-2532, firmware 05.05.70
I have passed a quest with GetMeIn script and received Root rights.
Then I have seen "Done! Please restart your System", I turned off/on TV and tryed to access.
And that's the problem.
Click to expand...
Click to collapse
I had the same problem, try to use username root auth key from ares-novacom and passphrase from developer mode, for me it works



login as: root
Authenticating with public key "imported-openssh-key"
Passphrase for key "imported-openssh-key":
[email protected]:~#
[email protected]:~# uname -a
Linux LGSmartTV 3.10.19-32.afro.5 #1 SMP PREEMPT Mon Oct 16 11:53:24 KST 2017 armv7l GNU/Linux
[email protected]:~#
 
  • Like
Reactions: Seilenos
R

rodanny

Member
May 14, 2009
19
1
Hello,
i have LG 55UH950V soft vers 05.60.15
a few days ago HBoGo announce not play if WebOs is under vers 3.5
Tell me can upgrade to new vers of Web OS?
If yes can help me anyone?

Sorry for my poor English.
Best,
Danny
 
L

LLP42

Member
Mar 15, 2021
21
8
olivier615 said:
Does this method always work?
My webos version is 4.9.5-10 goldilocks2-gympie
Click to expand...
Click to collapse
No, this method only worked with older models.

As an alternative RootMy.TV is available for newer models (like your 2019 model), but LG has fixed the security vulnerabilities with updates in the meantime, on which RootMy.TV is based on.
 
  • Like
Reactions: Aqq123
O

olivier615

New member
May 23, 2022
2
0
LLP42 said:
No, this method only worked with older models.

As an alternative RootMy.TV is available for newer models (like your 2019 model), but LG has fixed the security vulnerabilities with updates in the meantime, on which RootMy.TV is based on.
Click to expand...
Click to collapse
Thank you for your reply.
Unfortunately RootMyTV does not work for the latest versions of webos either. I hope a new version will arrive soon.
 
You must log in or register to reply here.

Similar threads

M
Rooting the webOS TV
Replies
80
Views
143K
D
daveraver
U
AndroidTV on LG webOS tv
Replies
8
Views
102K
L
lordxenu
T
WebOS on LG Smart TVs: Possible to switch region and download out-of-market apps?
Replies
45
Views
86K
tanyet71
tanyet71
R
Official: Palmdroid Development Thread (android app emulator for WebOS)
Replies
177
Views
101K
RumoredNow
RumoredNow
Nixing
webOS 3.0 on LG TV
Replies
3
Views
22K
M
Medyredy

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 47
    Maroc-OS
    Maroc-OS
    Hello XDA,

    After a long thinking i've decided to create a root or jailbreak tool for LG's awesome webOS, today am stating this thread to release this new root tool, but before that! am gonna ask you for some logs from webOS 3.5 and lower.

    Everyone in this thread must know about webOS if not do your homework then get back again, LG did a great work on this operating system after HP and Palm's versions. they even supported Raspberry Pi module B. but webOS OSE aka Open Source Edition is really different from TV's version.

    LG think about Security and frequently release updates that doesn't have anything new except some patches to close down known holes, one of my favorites was a directory traversal that can replace in tv files and binaries during install (partially closed recently).

    let'stake a look at LG's partition filesystem types, on tv's they chooses to use ext4 for writable partitions (/var, some of /mnt/lg/*, /home and /media) everything else is using squashfs which is a read only compressed filesystem you cannot modify it.

    If you can dump the squashfs partition unshquash it then recompress you will face another problem of hashes and crc checks (checkout the update binary for more details) if you dd it back to block device without kernel and/or bootloader patches. so this is not gonna just work easily.

    What we can really do it play on the RW parts of the system, one of the design flaws on webOS is the devmode aka Developer Mode, they ship it in a Read Write partition so that's easy to be modified.

    To do that you must have root access or some powerful exploits to achieve your goal.

    This method is using memory access vulnerability to get root and then jailbreak the tv. i ported some parts of the other root thread even if some are not even needed.

    To jailbreak connect to your tv via prisoner user after uploading GetMeIn binary into it then :

    Code: 
    chmod +x GetMeIn
./GetMeIn

    if root succeed and you saw some errors do this :
    Code: 
    mkdir -p /media/cryptofs/root/etc
mkdir -p /media/cryptofs/root/lib

    After that just reboot and enjoy your root with same ssh key, or use password "alpine".

    there is some old pictures attached, i did some modifications after those.

    Hope this is good enough.:angel:
    View
    14
    L
    lucaterpirla
    What would be a good reason to root a smart tv? What can I do afterward?
    View
    9
    Maroc-OS
    Maroc-OS
    HOW-TO

    To use this GetMeIn webOS Jailbreak tool please create a developer account on LG's developer portal, install developer mode application on your TV and connect with your recently created account.

    Open dev mode app please set the Dev Mode Status to ON and Key Server to ON.

    grab your ssh key with ares then connect to your tv using ssh :

    Code: 
    [email protected]:~# ssh -i ~/.ssh/webOS_TV [email protected] -p 9922
    when you get connected you just follow the steps on the thread.

    Please test and share back screen shouts and logs from tv in both cases failure or success.

    I need informations from your webOS v 3.5 and lower, TV model and webOS version and some commands from the tv.

    okay first of all create a dir named logs :

    Code: 
    mkdir logs

    TV Infos :

    Code: 
    cat /var/run/nyx/device_info.json > logs/device_info.json
    (delete your nduid serial number and mac addresses)

    webOS Infos :

    Code: 
    cat /var/run/nyx/os_info.json > logs/os_info.json

    Code: 
    cat /proc/cpuinfo > logs/cpu.log

    Code: 
    ls -arls /var/log/ > logs/logdir.log

    Code: 
    ls -arls /usr/lib/ > logs/libsdir.log

    Code: 
    ls -arls /proc/ > logs/procdir.log

    Code: 
    ls -arls /dev/ > logs/devices.log

    In case the jailbreak works restart and run this additional commands :

    Code: 
    mount > logs/mounts.log

    i think that's everything i need, upload the logs dir somewhere and put a link here.
    View
    5
    Maroc-OS
    Maroc-OS
    deepblue2000 said:
    any news for support of new webOS versions ?
    Click to expand...
    Click to collapse

    testing some other bugs with help of some great ppl from this topic. will let you know sooner
    View
    5
    Maroc-OS
    Maroc-OS
    renux said:
    [/COLOR]

    can u tell a bit more?
    how can one use these endpoints?

    btw, can this be any help to u: https://godoc.org/github.com/kaperys/go-webos

    ---------- Post added at 06:54 PM ---------- Previous post was at 06:46 PM ----------



    awesome work man, long waited for this...
    Click to expand...
    Click to collapse
    Oh yes i saw that on github before and the replay after you clarified this. i will checkout if there is some hidden API Calls and let you know.

    wybielacz said:
    You can control the TV with the endpoints, basically the LG app works like that, that it sends commands to those endpoints. There are various apps and plugins which already use them, you can simply use them with a http client.
    This link which you provided only has the documented endpoints, but there are lots more which are undocumented. Those undocumented could be used to get even more control over the TV and maybe allow more access to the TV. And to find those undocumented endpoints someone needs to have access to the root file system, which was achieved here :)
    I suppose there should be some kind of JSON file on the file system which has all of them listed + the parameters which they accept...
    Click to expand...
    Click to collapse
    Thank you you clarified this, i did not knew it's the same thing before i read your replay then i remember.

    TheUndertaker21 said:
    still haven't rooted yet but will do this weekend.
    hope we can magisk or something so we can have adblocks etc..
    Click to expand...
    Click to collapse
    Yes just replace /etc/hosts file and you're done :)

    talroze said:
    Thank you very much for this GREAT work :)
    I have only one question [well now that i think about it its 2 :-/ ]

    1. Will there be a way to revert back to original boot loader/mode [e.g. i dont want to brick my T.V. ]
    2. Do you think we will have an easier automated way todo it [e.g. insert a USB Thumb drive restart the T.V. and vualla it is rooted ?]

    Again ,Thank you very very much :)
    Click to expand...
    Click to collapse
    1. Actually yes and the whole process does not even change the original filesystem we just change one original file and add other things that does'nt harm the webOS. I will upload new version that take a backup first and make --restore argument to unjailbreak
    2. I think there may be a way :)
    View

New posts