Skip to content

Commit 8fd051a

Browse files
CryptogenicCryptogenic
committed
Update README/Index
1 parent 165401c commit 8fd051a

2 files changed

Lines changed: 45 additions & 53 deletions

File tree

‎README.md‎

Lines changed: 26 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
1-
# PS5 4.03 + 4.50 Kernel Exploit
1+
# PS5 4.xx Kernel Exploit
22
---
33
## Summary
44
This repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on **TheFlow's IPV6 Use-After-Free (UAF)**, which was [reported on HackerOne](https://hackerone.com/reports/1441103). The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to accommodate the annoying PS5 memory layout (for more see *Research Notes* section). It establishes an arbitrary read / (semi-arbitrary) write primitive. This exploit and its capabilities have a lot of limitations, and as such, it's mostly intended for developers to play with to reverse engineer some parts of the system.
55

6-
Also note; stability is fairly low, especially compared to PS4 exploits. This is due to the bug's nature of being tied to a race condition as well as the mitigations and memory layout of the PS5. This document will contain research info about the PS5, and this exploit will undergo continued development and improvements as time goes on.
7-
8-
This should now work on 4.03 as well as 4.50 firmware.
6+
With latest stability improvements, reliability is at about 80%. This document will contain research info about the PS5, and this exploit will undergo continued development and improvements as time goes on.
97

108
Those interested in contributing to PS5 research/dev can join a discord I have setup [here](https://discord.gg/kbrzGuH3F6).
119

10+
Exploit should now support the following firmwares (more to come):
11+
12+
- 4.03
13+
- 4.50
14+
- 4.51
15+
16+
17+
1218

1319
## Currently Included
1420

@@ -25,8 +31,6 @@ Those interested in contributing to PS5 research/dev can join a discord I have s
2531
- Clang-based fine-grained Control Flow Integrity (CFI) is present and enforced.
2632
- Supervisor Mode Access Prevention/Execution (SMAP/SMEP) cannot be disabled, due to the HV.
2733
- The write primitive is somewhat constrained, as bytes 0x10-0x14 must be zero (or a valid network interface).
28-
- The exploit's stability is currently poor. More on this below.
29-
- On successful run, **exit the browser with circle button, PS button panics for a currently unknown reason**.
3034

3135

3236

@@ -44,41 +48,20 @@ Those interested in contributing to PS5 research/dev can join a discord I have s
4448

4549
## Future work
4650
- [x] ~~Fix-up sockets to exit browser cleanly (top prio)~~
47-
- [ ] Write some data patches (second prio)
51+
- [x] ~~Write some data patches (second prio)~~
4852
- [x] ~~Enable debug settings~~
4953
- [x] ~~Patch creds for uid0~~
50-
- [ ] Jailbreak w/ cr_prison overwrite
51-
- [ ] Improve UAF reliability
52-
- [ ] Improve victim socket reliability (third prio)
53-
- [ ] Use a better / more consistent leak target than kqueue
54-
54+
- [x] ~~Jailbreak w/ cr_prison overwrite~~
55+
- [x] ~~Improve UAF reliability~~
56+
- [x] ~~Improve victim socket reliability (third prio)~~
57+
- [x] ~~Use a better / more consistent leak target than kqueue~~ (no longer necessary)
58+
- [ ] Make ELF loader support relocations
5559

5660

57-
## Using RPC and Dumping Kernel .data
5861

59-
**RPC**
62+
## Using ELF Loader
6063

61-
RPC is a very simple and limited setup.
62-
63-
1. Edit your IP+port (if changed) into exploit.js.
64-
2. Run the server via `python rpcserver.py`, allow the PS5 to connect when the exploit finishes. The PS5 will send the kernel .data base address in ASCII and you can then send read and write commands. Example is below.
65-
66-
```
67-
[RPC] Connection from: ('10.0.0.169', 59335)
68-
[RPC] Received kernel .data base: 0x0xffffffff88530000
69-
> r 0xffff81ce0334f000
70-
42 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00
71-
> w 0xffff81ce0334f004 0x1337
72-
Wrote qword.
73-
```
74-
75-
This setup is somewhat jank and a better system will be in place soon.
76-
77-
**Dump**
78-
79-
1. Edit your IP+port (if changed) into exploit.js.
80-
2. Comment the RPC code in exploit.js and uncomment dumper code.
81-
3. Run the server via `python dumpserver.py`, allow the PS5 to connect and start dumping when exploit finishes. It will continue to dump data from the kernel base until it panics due to hitting unmapped memory. Note: read is somewhat slow at ~200kbps, so it may take 10 minutes or so to complete.
64+
To use the ELF loader, run the exploit until completion. Upon completion it'll run a server on port `:9020`. Connect and send your ELF to the PS5 over that port and it'll run it. Assuming the ELF doesn't crash the browser, it can continue to run ELFs forever.
8265

8366

8467

@@ -89,21 +72,21 @@ This exploit works in 5 stages, and for the most part follows the same exploit s
8972
3) Infoleak step. Use `pktopts`/`rthdr` overlap to leak a kqueue from the 0x200 slab and `pktopts` from the 0x100 slab.
9073
4) Arbitrary read/write step. Fake `pktopts` again and find the overlap socket to use `IPV6_RTHDR` as a read/write primitive.
9174
4) Cleanup + patch step. Increase refcount on corrupted sockets for successful browser exit + patch data to enable debug menu and patch ucreds for uid0.
75+
4) Run ELF loader server that will accept and load/run ELFs. Currently WIP, does not support relocations at the moment.
9276

9377

9478

9579
## Stability Notes
96-
Stability for this exploit is at about 30%, and has multiple potential points of failure. In order of observed descending liklihood:
97-
1) *Stage 1* causes more than one UAF due to failing to catch one or more in the reclaim, causing latent corruption that causes a panic some time later on.
98-
2) *Stage 4* finds the overlap/victim socket, but the pktopts is the same as the master socket's, causing the "read" primitive to just read back the pointer you attempt to read instead of that pointer's contents. This needs some improvement and to be fixed if possible because it's really annoying.
99-
3) *Stage 1*'s attempt to reclaim the UAF fails and something else steals the pointer, causing immediate panic.
100-
4) The kqueue leak fails and it fails to find a recognized kernel .data pointer.
101-
4) Leaving the browser through "unusual" means such as PS button, share button, or browser crash, will panic the kernel. Needs to be investigated.
80+
Stability for this exploit is at about ~~30%~~ 80-90%, and has two potential points of failure. In order of observed descending liklihood:
81+
1) *Stage 1* fails to reclaim the UAF, causing immediate crash or latent corruption that causes crash.
82+
2) *Stage 4* fails to find a victim socket
10283

10384

10485

10586
## Research Notes
106-
- It appears based on various testing and dumping with the read primitive, that the PS5 has reverted back to 0x1000 page size compared to the PS4's 0x4000.
87+
- ~~It appears based on various testing and dumping with the read primitive, that the PS5 has reverted back to 0x1000 page size compared to the PS4's 0x4000.~~
88+
- After further research, the page size is indeed still 0x4000, however due to some insane allocator changes, different slabs can be allocated in the same virtual page.
89+
10790
- It also seems on PS5 that adjacent pages rarely belong to the same slab, as you'll get vastly different data in adjacent pages. Memory layout seems more scattered.
10891
- Often when the PS5 panics (at least in webkit context), there will be awful audio output as the audio buffer gets corrupted in some way.
10992
- Sometimes this audio corruption persists to the next boot, unsure why.
@@ -127,4 +110,4 @@ Stability for this exploit is at about 30%, and has multiple potential points of
127110

128111
## Thanks to testers
129112

130-
- Dizz (4.50)
113+
- Dizz (4.50/4.51)

‎document/en/ps5/index.html‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<html>
22

33
<head>
4-
<title>pOOBs4 9.00 & pOOBs5 4.03</title>
4+
<title>PS5 Kernel Exploit (4.xx)</title>
55
<meta name="viewport" content="width=device-width, initial-scale=1">
66
<style>
77
.loader {
@@ -74,18 +74,27 @@
7474
<body onload="setTimeout(poc, 1500);">
7575

7676
<div id="loader" class="loader"></div>
77-
<!--<div id="awaiting" class="info" style="display:none;">
78-
Awaiting Payload...
79-
<br />
80-
<span class="j">${jndi:ldap://nsa.gov}</span>
81-
</div>
82-
83-
<div id="allset" class="info" style="display:none;">
84-
You're all set!
85-
</div>-->
8677

8778
<textarea id="console" class="log"></textarea>
8879

80+
<center>
81+
<h3>
82+
<b>v1.01.</b>
83+
<br />
84+
<a href="https://twitter.com/theflow0">@theflow0</a>,
85+
<a href="https://twitter.com/SpecterDev">@SpecterDev</a>,
86+
ChendoChap,
87+
<a href="https://twitter.com/Znullptr">@Znullptr</a>,
88+
<a href="https://twitter.com/sleirsgoevy">@sleirsgoevy</a>,
89+
<br />
90+
<a href="https://twitter.com/psxdev">@psxdev</a>,
91+
<a href="https://twitter.com/flat_z">@flat_z</a>,
92+
<a href="https://twitter.com/notzecoxao">@notzecoxao</a>,
93+
<a href="https://twitter.com/SocraticBliss">@SocraticBliss</a>,
94+
laureeeeeee
95+
</h3>
96+
</center>
97+
8998
</body>
9099
<script>
91100

0 commit comments

Comments
 (0)