All the devices that can be plugged into a TV (usually) for the purpose of playing streaming media, using apps, and so on. If that's not exactly clear, think Roku, Amazon Fire TV stick, Apple TV, and so on (all featured here). CPU architectures are usually ARM, with the rare aberrations, while OSes will usually be Android or Linux, with occasional differences (such as tvOS).

The Aluratek wifi radio is an android 4.4.2 API version 19 device

This little thing runs stock Android, but it can be rooted through adb USB access. It already has many applications loaded upon it, but with this adb method, maybe some proper EOPs could be accessed?

https://www.exploitee.rs/index.php/Aluratek_WiFi_Radio

From here, just copy over the SuperSU APK into app, and the su binary to bin

While this is what the device runs as stock, there are various methods to effectively interface with it’s existing Android install, even to the point of running unofficial APKs that expand the EOP potential of this device.

https://www.exploitee.rs/index.php/Amazon_FireTV

the performance of Kodi does not seem to suffer of having the Debian Chroot running

Requires sideloading an application onto the Fire TV. May be the stick version? Has functional x11 and various applications available, with an autostart script available.

https://forum.xda-developers.com/t/install-debian-linux-on-the-firetv.3171645/

Requires root or unlocking the bootloader, which can be accomplished through various methods. Otherwise, a functional albeit lightweight Fire TV Linux install can be accomplished. Note: no demonstration of a conventional DE/X.Org

https://www.youtube.com/watch?v=PEruWaKKviQ

https://github.com/freedreno/freedreno/wiki/FireTV

Upload root filesystem to the partition of your choice using fastboot

The display works, and the last time things were updated, mainlining of the Linux kernel port was in progress. Updates have appeared in 2021.

https://gitlab.com/CalcProgrammer1/pmaports

https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_(amazon-bueller)

leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z

FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Cube. While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.

https://www.exploitee.rs/index.php/FireFU_Exploit

leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z

FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Pendant (while originally made for the Cube). While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.

https://www.exploitee.rs/index.php/FireFU_Exploit

https://www.exploitee.rs/index.php/Amazon_FireTV_Pendant

you will need to first open the device and remove the heat shield

By attaching to the eMMC on this device, it is possible to root the Android system which runs upon it. Not much is known as to what can be done with this rooting, however.

https://www.exploitee.rs/index.php/Amazon_Fire_TV_Stick

Before installing PostmarketOS you need to unlock the bootloader using the amonet exploit

Similar in function to the 4K. Display works, although this one can be completely flashed. Hardware-wise, the basic is identical to the 2^nd generation Fire TV Stick, so thus presumably postmarket can be loaded onto them also.

https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_Basic_Edition_(amazon-tank)

The Stick will detect if an USB OTG adapter is plugged in at bootup

The level of function is somewhat up in the air, but the display works, as for USB OTG access. The kernel can be loaded onto the device also.

https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_4K_(amazon-mantis)

You have two options for Linux.

OSMC is a sort of TV-optimized Debian variant, while patchstick is a way to get a vanilla distro on the Apple TV, which requires some github projects and script corrections. However, once doing all of this, various distributions, such as Debian 9 (used in the demo), can be ran off the Apple TV natively.

https://www.tommycoolman.com/2018/10/10/installing-linux-on-the-1st-generation-apple-tv/

https://www.tommycoolman.com/2018/10/13/installing-linux-on-the-1st-generation-apple-tv-part-2/

Leopard doesn’t have problems with the Nvidia Kexts

With some alterations of drivers, kexts, and another Mac, this Apple TV is able to run various versions of Mac OS X. The video demonstrates Tiger, but the deletion of those aforementioned drivers causes it some problems, which Leopard does not experience. Thus, it is better to use their methods, but with Leopard instead. Quote is taken from a top comment.

https://www.youtube.com/watch?v=TTDnw-fXvEI

The legends at ReactOS have decided that it is now time for the AppleTV to support it.

https://reactos.org/wiki/Apple_TV_(1st_generation)

Cuberoot will: Root your Asus Cube.

These Google TV boxes can be rooted, like many others, however this exploit appears to be less dependent on not updating. Here, the method exists within a certain application, and has already been “premade” by the exploiteers team.

https://www.exploitee.rs/index.php/Asus_Cube

Under Share Workgroup Name, you can simply add in another command with the semicolon

A quite simple USB-based method allows rooting this device, alongside accessing a rooted telnet shell. It is also possible to exploit the hardware for this purpose, thru UART adapter soldering.

https://www.exploitee.rs/index.php/Boxee

Do not connect your Chromecast to the Internet

The level of function for postmarketOS is completely unknown, but the kernel does compile, and a tool utility suite can interfere with boot files for the Chromecast. Sadly, it only works on first generation Chromecasts with particularly old firmware (which automatically updates when internet connected).

https://www.exploitee.rs/index.php/Google_Chromecast (hardware downgrade tips?)

https://wiki.postmarketos.org/wiki/Google_Chromecast_(google-anchovy)

A relatively simple install using some pre-existing binaries supplied by the Armbian project. Unsure about functionality, and the websites related to this have been taken down by evil people as of recent. EOP will have a solution for this.

https://www.youtube.com/watch?v=a7nz00WggYc

8GB NAND Flash, 1GB of RAM

This device has a relatively simple procedure for installing Linux on it, although it does require basic technical skills. Functions very normally, considering it already runs Android natively.

https://medium.com/swlh/running-debian-linux-on-mk808-android-tv-c150ff1afe5d

On that webserver, create the directory structure outlined below

By spoofing an update URL and altering the tar of a certain application, it is possible to create a persistent root access on this little device.

https://www.exploitee.rs/index.php/Netgear_NTV200-100NAS

There are multiple vulnerabilities in the Netgear Push2TV (PTV3000)

This little “device screen casting” box (technically a streaming box) has a few methods for accessing a root shell, involving either UART, cmd injection, or flashing a chip.

https://www.exploitee.rs/index.php/Netgear_Push2TV_(PTV3000)

fastboot flashing unlock. flash

The 4k UHD streaming box under Walmart's “Onn” brand. There is very little info on the linked page, but installation does sound simple.

https://wiki.postmarketos.org/wiki/Onn_UHD_(askey-sti6140d360)

To be honest, it’s very hard to figure out what this thing actually was used for. Apparently, it’s a sort of Intel Atom 330-based device to play music? Whether it’s corporate, consumer, direct from a company akin to cable boxes, purchased at end-user level, etc. is unknown to me.

https://www.reddit.com/r/itrunsdoom/comments/76vh2h/polywell_mc550_runs_doom/

On top of that a user is also able to enable a SSHD server

This device appears to be one of the easiest to exploit and access yet. The bootloader is open, and the kernel just leaves the user in a root shell. Thus, many methods are possible for doing something interesting within it.

https://www.exploitee.rs/index.php/PogoPlug_Mobile

Little info about this, even on the exploiteers website. Appears to be native in some capacity, as the video at the start shows a bunch of wires hooked up to one of the Roku chips. May work on other Roku devices. Other WebAssembly based DOOM ports are not included, as they are just “unsigned” apps for the ROKU, rather than actually interesting/groundbreaking hacks.

https://www.youtube.com/watch?v=YebtKGdgCLQ

a device for streaming video from a mobile device to an HDMI display

There are various methods afforded to the user which can run commands as root. Unsurprisingly, the most focused methods are either through a command injection, or a UART connection.

https://www.exploitee.rs/index.php/Samsung_Allshare_Cast

The best part? With SSH you get a root shell!

One can root, develop native applications, or just generically exploit the Steam Link. What can be done with these methods is unknown, but there is a lot of data for what’s possible in the name of getting in there.

https://www.exploitee.rs/index.php/Steam_Link

file on a FAT32 formatted thumb drive

As per usual for exploiteers work, this device has a little exploit which affords the user root access. Simple as that.

https://www.exploitee.rs/index.php/Vizio_Co-Star

This little thing has a root shell on UART, and that’s about all that is said.

https://www.exploitee.rs/index.php/Vudu_Spark

DO NOT PLUG USB drives that had pmOS installed to the TV box when it boots into Android because Android will destroy file permissions!

Comes in several variants, of which only one variant has postmarketOS support. Luckily, the variant it doesn't work on is the China-only variant; the international variant works! Capable of running a FOSS bootloader.

https://wiki.postmarketos.org/wiki/Xiaomi_Mi_Box_3_(xiaomi-once)