4 ms·
That's great. As a summary: This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one tha
by hmottestad 15y ago
That's great.
As a summary:
This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one that will run any script as root (nativeBridge.dbgCmd();). This function is disabled in the browser, so it needs to be called from somewhere else.
So he injects the function call into the ID3 tag of an MP3 file and plays the file on the native mp3 player which has a html gui for displaying the id3 tag info :)
Finally he uses this exploit to enable ssh and install a certificate so he can connect to it.
- djb_hackernews 15y agoAnd this is the "payload": <button type="button" style="width:100%;height:100%" onclick="javascript:nativeBridge.dbgCmd('dd if=/mnt/us/music/jailbreak.mp3 of=/tmp/payload.sh bs=1 skip=25');nativeBridge.dbgCmd('chmod +x /tmp/payload.sh');nativeBridge.dbgCmd('sh /tmp/payload.sh');">Press to Jailbreak!</button>
- malnourish 15y agoWhat a great, simple (not to diminish in any way), hack. Why did Amazon allow a call that always runs as root? Is it necessity, oversight, or something else?
- lmm 15y agodbgCmd() suggests it was originally there for debugging. It runs as root because the UI runs as root, AIUI.