Esoteric Devices Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Streaming Players ======

All the devices that can be plugged into a TV (usually) for the purpose of playing streaming media, using apps, and so on. If that's not exactly clear, think Roku, Amazon Fire TV stick, Apple TV, and so on (all featured here). CPU architectures are usually ARM, with the rare aberrations, while OSes will usually be Android or Linux, with occasional differences (such as tvOS).

===== Aluratek WiFi Radio =====

==== Operating Systems (ARM?) ====
=== Android 4.4.2 ===
>The Aluratek wifi radio is an android 4.4.2 API version 19 device

This little thing runs stock Android, but it can be rooted through adb USB access. It already has many applications loaded upon it, but with this adb method, maybe some proper EOPs could be accessed?

[[https://www.exploitee.rs/index.php/Aluratek_WiFi_Radio%E2%80%8B|https://www.exploitee.rs/index.php/Aluratek_WiFi_Radio]]



===== Amazon Fire TV (Box; 1st Gen) =====

==== Operating Systems (Krait 300) ====
=== Android ===
>From here, just copy over the SuperSU APK into app, and the su binary to bin

While this is what the device runs as stock, there are various methods to effectively interface with it’s existing Android install, even to the point of running unofficial APKs that expand the EOP potential of this device.

https://www.exploitee.rs/index.php/Amazon_FireTV



=== Debian chroot ===
>the performance of Kodi does not seem to suffer of having the Debian Chroot running

Requires sideloading an application onto the Fire TV. May be the stick version? Has functional x11 and various applications available, with an autostart script available.

https://forum.xda-developers.com/t/install-debian-linux-on-the-firetv.3171645/



==Fedora + XMBC ===
Requires root or unlocking the bootloader, which can be accomplished through various methods. Otherwise, a functional albeit lightweight Fire TV Linux install can be accomplished. Note: no demonstration of a conventional DE/X.Org

https://www.youtube.com/watch?v=PEruWaKKviQ

https://github.com/freedreno/freedreno/wiki/FireTV



=== postmarketOS ===
>Upload root filesystem to the partition of your choice using fastboot

The display works, and the last time things were updated, mainlining of the Linux kernel port was in progress. Updates have appeared in 2021.

https://gitlab.com/CalcProgrammer1/pmaports

[[https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_(amazon-bueller)]]



===== Amazon Fire TV Cube =====

==== Operating Systems ====
=== Android (thru fireFU) ===
>leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z

FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Cube. While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.

https://www.exploitee.rs/index.php/FireFU_Exploit



===== Amazon Fire TV Pendant =====

==== Operating Systems ====
=== Android (thru fireFU) ===
>leveraging a read write primitive from the FireTV Cube and Pendant’s Amlogic S905Z

FireFU is quite simply, an exploit that allows running unsigned code and applications on the Fire TV Pendant (while originally made for the Cube). While it’s unknown if it works on “most recent” firmware (as of 2021), the device may very well be discontinued so thus the most recent firmware is years old. Requires some further reading.

https://www.exploitee.rs/index.php/FireFU_Exploit

https://www.exploitee.rs/index.php/Amazon_FireTV_Pendant



===== Amazon Fire TV Stick (1st Gen) =====

==== Operating Systems (ARM) ====
=== Android ===
>you will need to first open the device and remove the heat shield

By attaching to the eMMC on this device, it is possible to root the Android system which runs upon it. Not much is known as to what can be done with this rooting, however.

[[https://www.exploitee.rs/index.php/Amazon_Fire_TV_Stick%E2%80%8B|https://www.exploitee.rs/index.php/Amazon_Fire_TV_Stick]]



===== Amazon Fire TV Stick (2nd Gen/Basic) =====

==== Operating Systems (Mediatek 8127D) ====

=== postmarketOS ===
>Before installing PostmarketOS you need to unlock the bootloader using the amonet exploit

Similar in function to the 4K. Display works, although this one can be completely flashed. Hardware-wise, the basic is identical to the 2<sup>nd</sup> generation Fire TV Stick, so thus presumably postmarket can be loaded onto them also.

[[https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_Basic_Edition_(amazon-tank)]]



===== Amazon Fire TV Stick 4K =====

==== Operating Systems (Cortex-A53) ====
=== postmarketOS ===
>The Stick will detect if an USB OTG adapter is plugged in at bootup

The level of function is somewhat up in the air, but the display works, as for USB OTG access. The kernel can be loaded onto the device also.

[[https://wiki.postmarketos.org/wiki/Amazon_Fire_TV_Stick_4K_(amazon-mantis)]]



===== Apple TV (1st Gen) =====

==== Operating Systems (Pentium M) ====
=== Linux (OSMC/Patchstick) ===
>You have two options for Linux.

OSMC is a sort of TV-optimized Debian variant, while patchstick is a way to get a vanilla distro on the Apple TV, which requires some github projects and script corrections. However, once doing all of this, various distributions, such as Debian 9 (used in the demo), can be ran off the Apple TV natively.

https://www.tommycoolman.com/2018/10/10/installing-linux-on-the-1st-generation-apple-tv/

https://www.tommycoolman.com/2018/10/13/installing-linux-on-the-1st-generation-apple-tv-part-2/



=== Mac OS X (Tiger, Leopard…) ===
>Leopard doesn’t have problems with the Nvidia Kexts

With some alterations of drivers, kexts, and another Mac, this Apple TV is able to run various versions of Mac OS X. The video demonstrates Tiger, but the deletion of those aforementioned drivers causes it some problems, which Leopard does not experience. Thus, it is better to use their methods, but with Leopard instead. Quote is taken from a top comment.

https://www.youtube.com/watch?v=TTDnw-fXvEI

=== ReactOS ===

The legends at ReactOS have decided that it is now time for the AppleTV to support it.

[[https://reactos.org/wiki/Apple_TV_(1st_generation)]]
===== Asus Cube =====

==== Operating Systems (Marvell Armada 1500?) ====
=== Rooted Android ===
>Cuberoot will: Root your Asus Cube.

These Google TV boxes can be rooted, like many others, however this exploit appears to be less dependent on not updating. Here, the method exists within a certain application, and has already been “premade” by the exploiteers team.

https://www.exploitee.rs/index.php/Asus_Cube



===== Boxee Box =====

==== Operating Systems (Intel Atom CE4170) ====
=== Linux(?) ===
>Under Share Workgroup Name, you can simply add in another command with the semicolon

A quite simple USB-based method allows rooting this device, alongside accessing a rooted telnet shell. It is also possible to exploit the hardware for this purpose, thru UART adapter soldering.

https://www.exploitee.rs/index.php/Boxee



===== Google Chromecast =====

==== Operating Systems (Marvell Armada 1500-Mini) ====
=== postmarketOS ===
>Do not connect your Chromecast to the Internet

The level of function for postmarketOS is completely unknown, but the kernel does compile, and a tool utility suite can interfere with boot files for the Chromecast. Sadly, it only works on first generation Chromecasts with particularly old firmware (which automatically updates when internet connected).

https://www.exploitee.rs/index.php/Google_Chromecast (hardware downgrade tips?)

[[https://wiki.postmarketos.org/wiki/Google_Chromecast_(google-anchovy)]]



===== Mini M8S II (MxQ?) =====

==== Operating Systems (Amlogic S905X ARM) ====
=== Ubuntu ===
A relatively simple install using some pre-existing binaries supplied by the Armbian project. Unsure about functionality, and the websites related to this have been taken down by evil people as of recent. EOP will have a solution for this.

https://www.youtube.com/watch?v=a7nz00WggYc



===== MK808 Mini TV =====

==== Operating Systems (Rochip RK 3066) ====
=== Debian 8 ===
>8GB NAND Flash, 1GB of RAM

This device has a relatively simple procedure for installing Linux on it, although it does require basic technical skills. Functions very normally, considering it already runs Android natively.

https://medium.com/swlh/running-debian-linux-on-mk808-android-tv-c150ff1afe5d



===== Netgear NTV200-100NAS =====

==== Operating Systems (ARM?) ====
=== Linux ===
>On that webserver, create the directory structure outlined below

By spoofing an update URL and altering the tar of a certain application, it is possible to create a persistent root access on this little device.

[[https://www.exploitee.rs/index.php/Netgear_NTV200-100NAS%E2%80%8B|https://www.exploitee.rs/index.php/Netgear_NTV200-100NAS]]



===== Netgear Push2TV =====

==== Operating Systems ====
=== Linux ===
>There are multiple vulnerabilities in the Netgear Push2TV (PTV3000)

This little “device screen casting” box (technically a streaming box) has a few methods for accessing a root shell, involving either UART, cmd injection, or flashing a chip.

[[https://www.exploitee.rs/index.php/Netgear_Push2TV_(PTV3000)%E2%80%8B%E2%80%8B|https://www.exploitee.rs/index.php/Netgear_Push2TV_(PTV3000)]]

===== Onn UHD Streaming Box =====

==== Operating Systems ====
=== postmarketOS ===

>fastboot flashing unlock. flash

The 4k UHD streaming box under Walmart's "Onn" brand. There is very little info on the linked page, but installation does sound simple.

[[https://wiki.postmarketos.org/wiki/Onn_UHD_(askey-sti6140d360)]]



===== Play Network MC550 =====

==== Other ====
=== Doom, Emulators ===
To be honest, it’s very hard to figure out what this thing actually was used for. Apparently, it’s a sort of Intel Atom 330-based device to play music? Whether it’s corporate, consumer, direct from a company akin to cable boxes, purchased at end-user level, etc. is unknown to me.

https://www.reddit.com/r/itrunsdoom/comments/76vh2h/polywell_mc550_runs_doom/



===== PogoPlug Mobile =====

==== Operating Systems ====
=== Linux ===
>On top of that a user is also able to enable a SSHD server

This device appears to be one of the easiest to exploit and access yet. The bootloader is open, and the kernel just leaves the user in a root shell. Thus, many methods are possible for doing something interesting within it.

https://www.exploitee.rs/index.php/PogoPlug_Mobile



===== Roku 2 =====

==== Other ====
=== DOOM (Native?) ===
Little info about this, even on the exploiteers website. Appears to be native in some capacity, as the video at the start shows a bunch of wires hooked up to one of the Roku chips. May work on other Roku devices. Other WebAssembly based DOOM ports are not included, as they are just “unsigned” apps for the ROKU, rather than actually interesting/groundbreaking hacks.

https://www.youtube.com/watch?v=YebtKGdgCLQ



===== Samsung Allshare Cast =====

==== Operating Systems (ARM?) ====
=== Linux ===
>a device for streaming video from a mobile device to an HDMI display

There are various methods afforded to the user which can run commands as root. Unsurprisingly, the most focused methods are either through a command injection, or a UART connection.

https://www.exploitee.rs/index.php/Samsung_Allshare_Cast



===== Steam Link =====

==== Operating Systems ====
=== Linux ===
>The best part? With SSH you get a root shell!

One can root, develop native applications, or just generically exploit the Steam Link. What can be done with these methods is unknown, but there is a lot of data for what’s possible in the name of getting in there.

https://www.exploitee.rs/index.php/Steam_Link



===== Vizio CoStar LT (ISV-B11) =====

==== Operating Systems (ARM?) ====
=== Android/Linux ===
>file on a FAT32 formatted thumb drive

As per usual for exploiteers work, this device has a little exploit which affords the user root access. Simple as that.

https://www.exploitee.rs/index.php/Vizio_Co-Star



===== Vudu Spark =====

==== Operating Systems (ARM?) ====
=== Android/Linux ===
This little thing has a root shell on UART, and that’s about all that is said.

https://www.exploitee.rs/index.php/Vudu_Spark

===== Xiaomi Mi Box 3 =====

==== Operating Systems (Amlogic S905X-H / Cortex-A53) ====
=== postmarketOS ===

> DO NOT PLUG USB drives that had pmOS installed to the TV box when it boots into Android because Android will destroy file permissions!

Comes in several variants, of which only one variant has postmarketOS support. Luckily, the variant it doesn't work on is the China-only variant; the international variant works! Capable of running a FOSS bootloader.

[[https://wiki.postmarketos.org/wiki/Xiaomi_Mi_Box_3_(xiaomi-once)]]