BD-JB PS5 Exploit (Userland) Revision for 7.61 Firmware by TheFloW

Proceeding TheFlow0's BD-JB Sandbox Escape at Hexacon, the 4.03 PS5 HEN PS4 FPKG Enabler Payload & Porting Offsets and the recent 4.50 PS5 HEN PS4 FPKG Enabler Payload Port comes a revision by Security Engineer theflow0 to the BD-JB PS5 Exploit (BD-J Tools) that supports Userland execution, not Kernel (KeX), on PlayStation 5 consoles through 7.61 PS5 Firmware as Andy Nguyen aka TheOfficialFloW on Github confirmed via Twitter it was fixed in 8.00 PS5 System Software:

Seems like Sony fixed the bd-jb path traversal sandbox escape on PS5 FW 8.00. PoC tweetable: Change bdjo.xml#L13:

<baseDirectory>00000</baseDirectory>

to:

`<baseDirectory>file:///app0/cdc/lib/../../../disc/BDMV/JAR/00000.jar</baseDirectory>`

and enjoy native code execution on PS5 FW 7.61.

Spoiler

The PlayStation 5 Remote JAR Loader was also confirmed as working on 7.61, with a new PS5 JAR Loader revision by hammer-83 on Github: 2023-10-27

1. Burn ps5-jar-loader.iso on a BD-R(E).
2. Insert into PS5, go to Media / Disc Player.
3. Press Play on "PS5 JAR Loader"
4. When the message appears showing the IP address where JAR loader is listening, try sending hello-world-remote.jar using the following command:

${path_to_java_11}/java --add-opens java.base/jdk.internal.loader=ALL-UNNAMED -jar hello-world-remote.jar ${ps5_ip_address}

Note: this does not include any exploits, just a proof of concept for repeatedly executing arbitrary JARs on a PS5.

 

[assassin87]

mine is on 6.02

 

[pterodactylstfw]

awaiting the kernel expoit!

 

[ps5user]

Is there a way to set memory executable in user space?

mmap/mprotect/etc with PROT_EXEC as from libc and libkernel failed.

 

[assassin87]

Is there any news about the kernel expoit?

 

[simonwest]

This Christmas hopefully