Table of Contents
Streaming Players
All the devices that can be plugged into a TV (usually) for the purpose of playing streaming media, using apps, and so on. If that's not exactly clear, think Roku, Amazon Fire TV stick, Apple TV, and so on (all featured here). CPU architectures are usually ARM, with the rare aberrations, while OSes will usually be Android or Linux, with occasional differences (such as tvOS).
Aluratek WiFi Radio
Operating Systems (ARM?)
Android 4.4.2
The Aluratek wifi radio is an android 4.4.2 API version 19 device
This little thing runs stock Android, but it can be rooted through adb USB access. It already has many applications loaded upon it, but with this adb method, maybe some proper EOPs could be accessed?
Amazon Fire TV (Box; 1st Gen)
Operating Systems (Krait 300)
Android
From here, just copy over the SuperSU APK into app, and the su binary to bin
While this is what the device runs as stock, there are various methods to effectively interface with it’s existing Android install, even to the point of running unofficial APKs that expand the EOP potential of this device.
Debian chroot
the performance of Kodi does not seem to suffer of having the Debian Chroot running
Requires sideloading an application onto the Fire TV. May be the stick version? Has functional x11 and various applications available, with an autostart script available.
https://forum.xda-developers.com/t/install-debian-linux-on-the-firetv.3171645/
Fedora + XMBC
Requires root or unlocking the bootloader, which can be accomplished through various methods. Otherwise, a functional albeit lightweight Fire TV Linux install can be accomplished. Note: no demonstration of a conventional DE/X.Org
postmarketOS
Upload root filesystem to the partition of your choice using fastboot
The display works, and the last time things were updated, mainlining of the Linux kernel port was in progress. Updates have appeared in 2021.
https://gitlab.com/CalcProgrammer1/pmaports
https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_(amazon-bueller)
Amazon Fire TV Cube
Operating Systems
Android (thru fireFU)
leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z
FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Cube. While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.
Amazon Fire TV Pendant
Operating Systems
Android (thru fireFU)
leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z
FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Pendant (while originally made for the Cube). While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.
Amazon Fire TV Stick (1st Gen)
Operating Systems (ARM)
Android
you will need to first open the device and remove the heat shield
By attaching to the eMMC on this device, it is possible to root the Android system which runs upon it. Not much is known as to what can be done with this rooting, however.
Amazon Fire TV Stick (2nd Gen/Basic)
Operating Systems (Mediatek 8127D)
postmarketOS
Before installing PostmarketOS you need to unlock the bootloader using the amonet exploit
Similar in function to the 4K. Display works, although this one can be completely flashed. Hardware-wise, the basic is identical to the 2nd generation Fire TV Stick, so thus presumably postmarket can be loaded onto them also.
https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_Basic_Edition_(amazon-tank)
Amazon Fire TV Stick 4K
Operating Systems (Cortex-A53)
postmarketOS
The Stick will detect if an USB OTG adapter is plugged in at bootup
The level of function is somewhat up in the air, but the display works, as for USB OTG access. The kernel can be loaded onto the device also.
https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_4K_(amazon-mantis)
Apple TV (1st Gen)
Operating Systems (Pentium M)
Linux (OSMC/Patchstick)
You have two options for Linux.
OSMC is a sort of TV-optimized Debian variant, while patchstick is a way to get a vanilla distro on the Apple TV, which requires some github projects and script corrections. However, once doing all of this, various distributions, such as Debian 9 (used in the demo), can be ran off the Apple TV natively.
https://www.tommycoolman.com/2018/10/10/installing-linux-on-the-1st-generation-apple-tv/
https://www.tommycoolman.com/2018/10/13/installing-linux-on-the-1st-generation-apple-tv-part-2/
Mac OS X (Tiger, Leopard…)
Leopard doesn’t have problems with the Nvidia Kexts
With some alterations of drivers, kexts, and another Mac, this Apple TV is able to run various versions of Mac OS X. The video demonstrates Tiger, but the deletion of those aforementioned drivers causes it some problems, which Leopard does not experience. Thus, it is better to use their methods, but with Leopard instead. Quote is taken from a top comment.
ReactOS
The legends at ReactOS have decided that it is now time for the AppleTV to support it.
Asus Cube
Operating Systems (Marvell Armada 1500?)
Rooted Android
Cuberoot will: Root your Asus Cube.
These Google TV boxes can be rooted, like many others, however this exploit appears to be less dependent on not updating. Here, the method exists within a certain application, and has already been “premade” by the exploiteers team.
Boxee Box
Operating Systems (Intel Atom CE4170)
Linux(?)
Under Share Workgroup Name, you can simply add in another command with the semicolon
A quite simple USB-based method allows rooting this device, alongside accessing a rooted telnet shell. It is also possible to exploit the hardware for this purpose, thru UART adapter soldering.
Google Chromecast
Operating Systems (Marvell Armada 1500-Mini)
postmarketOS
Do not connect your Chromecast to the Internet
The level of function for postmarketOS is completely unknown, but the kernel does compile, and a tool utility suite can interfere with boot files for the Chromecast. Sadly, it only works on first generation Chromecasts with particularly old firmware (which automatically updates when internet connected).
https://www.exploitee.rs/index.php/Google_Chromecast (hardware downgrade tips?)
https://wiki.postmarketos.org/wiki/Google_Chromecast_(google-anchovy)
Mini M8S II (MxQ?)
Operating Systems (Amlogic S905X ARM)
Ubuntu
A relatively simple install using some pre-existing binaries supplied by the Armbian project. Unsure about functionality, and the websites related to this have been taken down by evil people as of recent. EOP will have a solution for this.
MK808 Mini TV
Operating Systems (Rochip RK 3066)
Debian 8
8GB NAND Flash, 1GB of RAM
This device has a relatively simple procedure for installing Linux on it, although it does require basic technical skills. Functions very normally, considering it already runs Android natively.
https://medium.com/swlh/running-debian-linux-on-mk808-android-tv-c150ff1afe5d
Netgear NTV200-100NAS
Operating Systems (ARM?)
Linux
On that webserver, create the directory structure outlined below
By spoofing an update URL and altering the tar of a certain application, it is possible to create a persistent root access on this little device.
Netgear Push2TV
Operating Systems
Linux
There are multiple vulnerabilities in the Netgear Push2TV (PTV3000)
This little “device screen casting” box (technically a streaming box) has a few methods for accessing a root shell, involving either UART, cmd injection, or flashing a chip.
https://www.exploitee.rs/index.php/Netgear_Push2TV_(PTV3000)
Onn UHD Streaming Box
Operating Systems
postmarketOS
fastboot flashing unlock. flash
The 4k UHD streaming box under Walmart's “Onn” brand. There is very little info on the linked page, but installation does sound simple.
https://wiki.postmarketos.org/wiki/Onn_UHD_(askey-sti6140d360)
Play Network MC550
Other
Doom, Emulators
To be honest, it’s very hard to figure out what this thing actually was used for. Apparently, it’s a sort of Intel Atom 330-based device to play music? Whether it’s corporate, consumer, direct from a company akin to cable boxes, purchased at end-user level, etc. is unknown to me.
https://www.reddit.com/r/itrunsdoom/comments/76vh2h/polywell_mc550_runs_doom/
PogoPlug Mobile
Operating Systems
Linux
On top of that a user is also able to enable a SSHD server
This device appears to be one of the easiest to exploit and access yet. The bootloader is open, and the kernel just leaves the user in a root shell. Thus, many methods are possible for doing something interesting within it.
Roku 2
Other
DOOM (Native?)
Little info about this, even on the exploiteers website. Appears to be native in some capacity, as the video at the start shows a bunch of wires hooked up to one of the Roku chips. May work on other Roku devices. Other WebAssembly based DOOM ports are not included, as they are just “unsigned” apps for the ROKU, rather than actually interesting/groundbreaking hacks.
Samsung Allshare Cast
Operating Systems (ARM?)
Linux
a device for streaming video from a mobile device to an HDMI display
There are various methods afforded to the user which can run commands as root. Unsurprisingly, the most focused methods are either through a command injection, or a UART connection.
Steam Link
Operating Systems
Linux
The best part? With SSH you get a root shell!
One can root, develop native applications, or just generically exploit the Steam Link. What can be done with these methods is unknown, but there is a lot of data for what’s possible in the name of getting in there.
Vizio CoStar LT (ISV-B11)
Operating Systems (ARM?)
Android/Linux
file on a FAT32 formatted thumb drive
As per usual for exploiteers work, this device has a little exploit which affords the user root access. Simple as that.
Vudu Spark
Operating Systems (ARM?)
Android/Linux
This little thing has a root shell on UART, and that’s about all that is said.
Xiaomi Mi Box 3
Operating Systems (Amlogic S905X-H / Cortex-A53)
postmarketOS
DO NOT PLUG USB drives that had pmOS installed to the TV box when it boots into Android because Android will destroy file permissions!
Comes in several variants, of which only one variant has postmarketOS support. Luckily, the variant it doesn't work on is the China-only variant; the international variant works! Capable of running a FOSS bootloader.
https://wiki.postmarketos.org/wiki/Xiaomi_Mi_Box_3_(xiaomi-once)