Gaining root on Tzumi MagicTV with a special update script

Gaining root on a Tzumi MagicTV opens up a lot of possibilities with this little device. It has a HD tv tuner, Wifi that can do promiscuous mode, 3000mAh battery, plus a external antenna hookup, oh and did I mention it runs OpenWRT linux. Walmart was selling these on clearance for $13 or less. What a deal. paulbart1234 over on reddit found a way to gain root by using a update file

The Magic TV runs two separate update servers /app/Updateserver and /app/UpdateServerV2 and this is our way in.

paulbart1234 reverse-engineered the old API update server and found out we can upload a tar file to it with a install.sh script in it. This install.sh script can do anything. He chose to add a new superuser “hackme” with a password of “hack1234” After this script runs you can ssh as the hackme user and change the root password. Lets get started.

First thing we need to do is make a directory for MagicTV stuff then clone and build the git project.

Run these commands in your terminal.

mkdir MagicTV
cd MagicTV
git clone https://github.com/ImDroided/tzumi_utils.git
cd tzumi_utils/tz_upload
make

you should now have a file called tz_upload that is executable. Power on the MagicTV and connect your PC to its WiFi. you can now run

./tz_upload example_installers/installer_add_hackme_user.tgz

When this finishes you can SSH over to the Magic TV and login with hackme and hack1234

Now lets change the root password and delete the new user

passwd root

Now logout and log back in as root to make sure everything worked. To delete the hackme user run

userdel -r hackme

Now you can follow our other tutorials on getting the MagicTV on your WiFi network and using it on your PC.

Getting the Tzumi MagicTV on your WiFi network

Controlling and watching Tzumi MagicTV on your PC

Leave a Reply