PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[esc0rtd3w]

one small step forward, I do not know what will come of it but its a start!

this is a snip from my post over at PSX-Place, but I have also been keeping the GitHub updated with resources for exploration and research.

Spoiler: Full Snippet From WebKit Exploitation Thread

I would love to hear feedback

 

[thedarkghost]

Esc0rtd3w amazing, you are going to achieve something that might change the scene.

 

[esc0rtd3w]

here are a few more tests that I posted on PSX-Place. I also updated GitHub with the screenshots for people to view.

The last test I did is a bit more detailed for comparing before and after. Im getting tired...lol

Spoiler: Updated Bottom Snippet From Testing

 

[esc0rtd3w]

if anyone wants to help compare some of the JSArray code from the PS4 webkit to the PS3 webkit, that would be helpful.

Here are some JSArray files for comparison

• PS3--JSArray_Files--webkit-10.10.01-14d0bd2.zip
• PS3--JSArray_Files--webkit-11.02.03-ga52edd9.zip
• PS3--JSArray_Files--webkit-12.03.14.zip
• PS3--JSArray_Files--webkit-12.10.11.zip

• PS4--JSArray_Files--1.76--webkit_536_26.zip
• PS4--JSArray_Files--2.00-2.04--webkit_537_73.zip
• PS4--JSArray_Files--2.50-2.57--webkit_537_73-2.zip
• PS4--JSArray_Files--3.00-3.15--webkit_537_73-3.zip
• PS4--JSArray_Files--3.50--webkit_537_78.zip
• PS4--JSArray_Files--3.55--webkit_537_78.zip
• PS4--JSArray_Files--4.00-4.07--webkit_537_78-3.zip
• PS4--JSArray_Files--4.50+--webkit-601_2_7-450.zip

Spoiler: PS3 :: webkit-12.10.11 :: JSArray.cpp :: Lines 957-1035
Spoiler: PS3 :: webkit-12.10.11 :: JSArray.cpp :: Lines 1105-1218

Spoiler: PS4 1.76 :: webkit_536_26 :: JSArray.cpp :: Lines 1444-1517
Spoiler: PS4 1.76 :: webkit_536_26 :: JSArray.cpp :: Lines 1596-1705

Spoiler: PS4 3.55 :: webkit_537_78 :: JSArray.cpp :: Lines 1190-1247
Spoiler: PS4 3.55 :: webkit_537_78 :: JSArray.cpp :: Lines 1440-1468

 

[esc0rtd3w]

I have had this domain for a while and now I finally get to use it.

Right now it just has a directory listing you can navigate. Support for PS3, PS4, Wii-U, and Switch right now as far as what is uploaded.

http://websploit.org/

​

 

[batman]

WOW Man. You are going to rock the PS3 Scene!!!

 

[esc0rtd3w]

OK, not sure what this news means, but our lovely PS3 and it's evil Flash Sibling are getting along great!

I tested some flash exploits on PS3 and well........pretty much every single one I tried so far.......WORKED!! Well, let me be clear, the exploit does succeed, after that, not sure what can be done yet! Anybody wanna whip up a few exploit-friendly SWF's that we can leverage?

Here are a few beautiful screenies

yeah, I suck at metasploit, so I cheated and used Armitage

​

 

[Jaroslav01]

websploit gives this error on ps3: ReferenceError: Can't find variable: Unit32Array (< very important)

 

[batman]

@esc0rtd3w

Hello bro, impressive progress so far, I say this because whenever many fantastic playstation scene developers unfortunatelly left the hacking scene, you are still struggling with our beloved PS3.

I am sorry I can`t help on the hacking scene, my experience is just on game development using Unreal Engine 3, however I think you should get more developers to help you. Like they said 2 heads think better than just 1

Is exactly what I did whenever porting UDK Engine for PS3 and Xbox360, I reached to a good point on development, however I did stuck, then I got help from many devs even from here on psxhax, untill I was able, with their help, to finally finish my project UDKUltimate Game Engine (https://sites.google.com/view/udkultimate/). However, it took 2 years of development for me finish this project

Anyway, I think I am more excited than anyone here because with CFW on PS3 4.81 (superslim models) and UDKUltimate Engine for PS3, we can have a ressurrection on PS3 Homebrew Gaming Scene!!!

 

[esc0rtd3w]

websploit gives this error on ps3: ReferenceError: Can't find variable: Unit32Array (< very important)

the PS3 stuff is currently in *TESTING* only and does not actually do anything useful yet!

stay tuned