PS4 Jailbreaking

Following their Initial Announcement and the recent PS4 WebKit 7.00-7.02 Exploit Talos WebSocket Vulnerability Probe, today abu_y0ussef and 0xdagger via Synacktiv shared at Black Hat Europe 2020 a Webkit exploit that gives arbitrary R/W (Read / Write) permission on 6.XX PS4 Firmware for PS4 Scene developers to further examine.

Download: PS4-webkit-exploit-6.XX-master.zip / GIT / eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf

This comes proceeding the PS4 6.XX JSC_ConcatMemcpy WebKit Exploit PoC, PS4 6.20 WebKit Code Execution Exploit PoC, PS4 Webkit Bad_Hoist Exploit for PlayStation 4 Firmware 6.XX and PS4 Kernel Exploit (KEX) for 7.02 Firmware with developer sleirsgoevy sharing this This Link via Twitter that Jailbroken PS4 5.05 Console owners can visit to aid in collecting statistics for use in porting the...

With the PS4 WebKit 0-day BlackHat Europe 2020 presentation tomorrow available, recently _Icewall disclosed two advisories via Talos Intelligence vulnerability reports... and while patched, one may be able to bridge the gap between a missing PS4 7.00-7.02 Userland / WebKit Exploit (Mira 7.00-7.02 PS4 Ports) and the previously released PS4 7.02 Kernel Exploit to reignite the PS4 Scene with another full PS4 Jailbreak.

For those who missed it, another Talos Intelligence (CVE-2020-9951) Apple Safari/Webkit aboutBlankURL() code execution vulnerability was reported this past September and following his LogMeIn Hamachi VLAN Client Unofficial PS4 Port developer sleirsgoevy (Twitter) said he would take a look into it in the Github comments with his most recent reply stating, to quote: "It seems that I have a PoC, but nowhere close to a working exploit yet."

While he has a Proof-of-Concept for the latter, @zecoxao (Twitter) notes in the...

Following his PS4 6.72 Jailbreak Exploit Menu & PS-Phwoar! Host Menu Demo, PlayStation 4 homebrew developer @Leeful (Leeful74 on Twitter) recently shared some new PS4 6.72 Exploit Menu Updates including v9a / v9b Menus, PS-Phwoar! For 6.72, some New Features and a v6 Mod with the latest Sleirsgoevy exploit code and a v10 Test version.

To quote from Leeful on these latest updates: 5 New 6.72 Exploit Menus To Try

Here are 5 new 6.72 Exploit Host Menus for people to try out. Please consider all of these menus as tests. Self host versions of each menu can be found at the bottom of the post.

v9a and v9b Menus
This is v9 of my basic menu for 6.72. I have made 2 versions (a&b). version v9a uses the older more common version of the Sleirsgoevy exploit (5th Aug 2020) and v9b uses the most recent one (9th Oct 2020). You can load the exploit and HEN manually or you can set it to auto-load whatever you want when the menu loads.

The latest exploit takes slightly longer to load but in tests I have gotten a better success rate of the exploit loading. The latest exploit also causes an initial lag on the PS4 home screen once it has been loaded but a simple tip to overcome this is to press L2 then L1 on the home screen.

PS-Phwoar! For 6.72
I initially did not want to release a version of PS-Phwoar! for 6.72 because of the instability of the 6.72 exploit but a lot of people have asked for it so here it is.

This is still considered a work in progress and...

Next month Sony's PlayStation 5 next-generation console arrives, and as a result ModernVintageG's latest video on Modern Vintage Gamer's YouTube Channel covers an overview on How Sony's PS4 Security Was Defeated for those late to the PlayStation 4 scene or who are simply interested in learning!

Check out the video below, and if you'd like to support his ongoing work feel free to drop by his Patreon Page and show some love.

How the Sony PlayStation PS4 Security Was Defeated | MVG

As the Sony PlayStation 4's end of life approaches, in this episode we take a closer look at its the hardware and how different exploits have been used over the years to defeat the consoles security.

Credits/Sources/Thanks:

• CTurt Hacking the PS4 Blog
• theflow0
• Modded Warfare
• qwertyoruiopz
• SpecterDev 5.05 Write Up
• BPF 4.55 Exploit Write Up
• PSDevWiki PS4 Exploit List

Cheers to @zecoxao for the heads-up on this PlayStation 4 scene news via Twitter!

Since the PS4 6.XX JSC_ConcatMemcpy WebKit Exploit, PS4 6.20 WebKit Code Execution Exploit, PS4 Webkit Bad_Hoist Exploit for PS4 FW 6.XX, PS4 Webkit Bad_Hoist 6.72 Exploit Port and PS4JB 6.72 Jailbreak Exploit security researchers 0xdagger of quentinmeffre.fr and abu_y0ussef of mtalbi.github.io who work at SYNACKTIV announced plans to discuss exploiting a 0-day PS4 WebKit vulnerability on 6.xx Firmwares at Black Hat Europe 2020.

This year the annual event will take place virtually from December 7-10th, 2020, and their presentation will outline the exploitation strategy used and the hurdles they encountered along the way for those in the InfoSec field or who are simply interested in learning for fun or to cash in on Bug Bounty Programs.

While most of the PS4 Scene is awaiting someone to make use of the PS4 7.02 Kernel Exploit (KEX) with Mira 7.00-7.02 PS4 WIP Ports already underway, according to @Abkarino of Team Rebug on Twitter to quote: "If it is 6.xx WebKit exploit only, then it will be useless for most unless if it is more stable than the current...