This approach will work (provided there are no proprietary funny locks in place anywhere), but the recovery partition is no party to it from the very beginning. The default.prop is overwritten on bootup, copied from the boot partition, which is not a directly accessible file system. You need an image of the boot partition, which you will then unpack, make the change, and repack.
Assuming you know how to go about doing all that (since you say you tried it with the recovery), I must warn ahead that often times it is necessary to include the base address when making the image with mkbootimg. There is no way to know when it is required, so it is safe to always include a base address. You can follow a tutorial here:
The script includes the od command with which you can get the base address, in case you want to make your own script. For more on the manual steps (for reproducing on GNU/Linux):
I do not recommend use of the unpack/repack scripts, as they have hardcoded lines not portable across cases. Use split_bootimg.pl, then gunzip and cpio extract it, after which you will again use cpio and gzip it, followed by the mkbootimg command. The only exception is for MTK65xx devices, where you will need the relevant unpack/repack tools (because they have very different offsets; you will also skip the mkbootimg as the repack script does it for you):
And here is an on-going example of a Chinese rebranded phone going through the same thing to finally get root:
I'm sorry I have to strip off proper links, but I am apparently considered potential spam. Also, I've not been rather thorough because I'm not really sure you'd want more verbosity.