Oh, wow, lone a fewer hours after tweeting that this needed to beryllium “ironed out”, SpecterDev has present published his implementation of the PS5 IPV6 Kernel exploit!

This merchandise relies connected the Webkit vulnerability arsenic an introduction point, meaning it volition enactment connected immoderate PS5 (including PS5 Digital edition) moving firmware 4.03. Lower firmwares mightiness enactment (although the exploit mightiness request tweaking). Higher firmwares volition not enactment astatine the infinitesimal (they are not susceptible to the Webkit exploit)

PS5 4.03 Kernel exploit is here!

SpecterDev warns astir significant limitations of this exploit. Notably:

1. The exploit is reasonably unstable, and successful his acquisition volition enactment astir 30% of the time. If you are trying to tally it, don’t springiness up, it mightiness necessitate respective attempts earlier the exploit gets through
2. Possibly much important, this exploit gives america read/write access, but nary execute! This means nary anticipation to load and tally binaries astatine the moment, everything is constrained wrong the scope of the ROP chain. The existent implementation does nevertheless alteration debug settings.

More precisely, from the exploit’s readme:

Currently Included

• Obtains arbitrary read/write and tin tally a basal RPC server for reads/writes (or a dump server for ample reads) (must edit your ain address/port into the exploit record connected lines 673-677)
• Enables debug settings paper (note: you volition person to afloat exit settings and spell backmost successful to spot it).
• Gets basal privileges

Limitations

• This exploit achieves read/write, but not codification execution. This is due to the fact that we cannot presently dump kernel codification for gadgets, arsenic kernel .text pages are marked arsenic eXecute Only Memory (XOM). Attempting to work kernel .text pointers volition panic!
• As per the supra + the hypervisor (HV) enforcing kernel constitute protection, this exploit also cannot instal immoderate patches oregon hooks into kernel space, which means nary homebrew-related codification for the clip being.
• Clang-based fine-grained Control Flow Integrity (CFI) is contiguous and enforced.
• Supervisor Mode Access Prevention/Execution (SMAP/SMEP) cannot beryllium disabled, owed to the HV.
• The constitute primitive is somewhat constrained, arsenic bytes 0x10-0x14 indispensable beryllium zero (or a valid web interface).
• The exploit’s stableness is presently poor. More connected this below.
• On palmy run, exit the browser with ellipse button, PS fastener panics for a presently chartless reason.

Stability Notes

Stability for this exploit is astatine astir 30%, and has aggregate imaginable points of failure. In bid of observed descending liklihood:

1. Stage 1 causes much than 1 UAF owed to failing to drawback 1 oregon much successful the reclaim, causing latent corruption that causes a panic immoderate clip aboriginal on.
2. Stage 4 finds the overlap/victim socket, but the pktopts is the aforesaid arsenic the maestro socket’s, causing the “read” primitive to conscionable work backmost the pointer you effort to work alternatively of that pointer’s contents. This needs immoderate betterment and to beryllium fixed if imaginable due to the fact that it’s truly annoying.
3. Stage 1‘s effort to reclaim the UAF fails and thing other steals the pointer, causing contiguous panic.
4. The kqueue leak fails and it fails to find a recognized kernel .data pointer.

In different words, this merchandise is utile for hackers only, oregon radical who are funny to excavation into the wrong of the PS5. Note nevertheless that contempt its limitations, this is the archetypal ever nationalist merchandise of specified a almighty hack for the PS5, which means caller discoveries are bound to happen!

PS5 IPV6 Exploit showcase video

Scene subordinate Echo Stretch managed to tally the exploit and get america a video of it successful action, arsenic tin beryllium seen below. In the video, you tin spot Debug paper and bundle installer being unlocked connected the PS5

Testing PS5 4.03 Kernel Exploit For Disc Or Digital PS5@frwololo @ps4_hacking pic.twitter.com/K8p8j0owoq

— Echo Stretch (@StretchEcho) October 3, 2022

Download and run

You tin download the hack here.

You volition request Python to tally SpecterDev’s implementation, and you volition beryllium moving a webserver connected your section PC for your PS5 to access.

1. Configure fakedns via dns.conf to point manuals.playstation.net to your PCs IP address
2. Run fake dns: python fakedns.py -c dns.conf
3. Run HTTPS server: python host.py
4. Go into PS5 precocious web settings and acceptable superior DNS to your PCs IP code and permission secondary at 0.0.0.0
   1. Sometimes the manual inactive won’t load and a restart is needed, unsure wherefore it’s truly weird
5. Go to idiosyncratic manual successful settings and judge untrusted certificate prompt, run
6. Optional: Run rpc/dump server scripts (note: address/port indispensable beryllium substituted successful binary signifier into exploit.js)

This is simply a processing story, arsenic much radical volition trial and study connected this hack successful the days to come, truthful enactment tuned!

Source: SpecterDev