throwaway96

WTA backdoor/vulnerability

Overview

There is a vulnerability/backdoor in webOS 5+ that allows you to easily run arbitrary commands as root during the boot process. The easiest way to exploit it simply involves putting a file on a USB drive and having it connected to your TV while it boots. There are two other methods that are more complex and require additional exploits.

throwaway96

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

throwaway96

Warnings

What you do with this information is your own responsibility. If you brick your TV trying this, it's not my fault. You should probably have some electronics experience if you want to attempt this.

This is going to involve opening your TV and attaching wires to the pins of an integrated circuit. If you're not comfortable with that, this is not for you.

This document is a work in progress.

debugstatus

LG TVs since at least the era of NetCast and "Global Platform" (webOS predecessors) have had the notion of a debug level, generally called "debugstatus". There are three modes: DEBUG, EVENT, and RELEASE. TVs normally operate in RELEASE mode. DEBUG mode enables a variety of logging and other debugging features in webOS, including access to the bootloader console and debug menus via serial. EVENT is similar to DEBUG, although it may not enable as much logging and has other relatively minor differences.

aabytt

This is just a dump of some interesting undocumented features of webOS (3.8 specifically, on early 2018 4k LG TV) and other development-related tips.

Homebrew app ideas

• OpenVPN frontend (OpenVPN itself is easily buildable and runs on webOS TVs: https://discord.com/channels/407937994037919756/835489130967859251/906943542457401395)
• App autostart manager - dynamically update arbitrary app config and register it as input (see Registering an app as an input)
• webos-vncserver frontend with autostart option
• Package hyperiond into Piccap directly
• Quick Screenshot (expose HTTP port that just returns PNG of current screen contents)
• Custom IR remote codes editor/updater/blaster

aabytt

Replacing Netflix and Amazon keys of the webOS LG TV LG Magic Remote with other apps

This procedure allows substituting one or both Netflix and Amazon keys of the Magic Remote Control Unit with other apps or TV control menus of the webOS LG TV.

Netflix and Amazon keys can be found just over the Red-Green-Yellow-Blue color buttons of such remote.

Assumption for this procedure is that you accept to uninstall the apps related to the keys to be substituted. Example: if you want to replace the Netflix key, you need to uninstall Netflix (possibly, you are not using Netflix if you do not need such key).

To uninstall Netflix or Amazon Prime, press the Home key of the Magic Remote, select the "LG Content Store" app, press "APP" at the top of the screen, press "My Apps", press the "Rem

aabytt

Playling a link with standard LG webOS player

• id - id of the player app, com.webos.app.mediadiscovery for webOS 6+, com.webos.app.photovideo for webOS 3.x-5.x, com.webos.app.smartshare for webOS 1.0-2.x
• fullPath - url of the video file
• fileName - name of the video displayed in player. Filename is remembered by the player to continue playback from exit timestamp

from a web app

webOS.service.request("luna://com.webos.applicationManager", {
           method: "launch",

nathan-osman

from argparse import ArgumentParser
from datetime import datetime, timezone
from html import escape

import xml.etree.ElementTree as ET


class SmsFormat:

    def __init__(self, f_in, f_out):

Ircama

Replacing Netflix and Amazon keys of the webOS LG TV LG Magic Remote with other apps

This procedure allows substituting one or both Netflix and Amazon keys of the Magic Remote Control Unit with other apps or TV control menus of the webOS LG TV.

Netflix and Amazon keys can be found just over the Red-Green-Yellow-Blue color buttons of such remote.

Assumption for this procedure is that you accept to uninstall the apps related to the keys to be substituted. Example: if you want to replace the Netflix key, you need to uninstall Netflix (possibly, you are not using Netflix if you do not need such key).

To uninstall Netflix or Amazon Prime, press the Home key of the Magic Remote, select the "LG Content Store" app, press "APP" at the top of the screen, press "My Apps", press the "Rem

bandrel

#!/usr/bin/env python3
from __future__ import print_function
import socket
import argparse
import requests
import re


parser = argparse.ArgumentParser(description='Enumerate subdomains via certificate transparency logs')
parser.add_argument('domain', type=str, help='Target domain name')

bandrel

#!/usr/bin/env python

import requests
import sys
import re

domain = sys.argv[1]

r = requests.get('https://crt.sh/?q=%.'+domain)
hostnames = re.findall(r'<TD>(\S+\.'+domain+r')',r.text)