Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Aug 14, 2016 at 7:47 PM       17,350       24            
Just over a week back we reported on the 3.55 PS4 HENkaku Exploit, and since then PlayStation 4 developer Fire30 has been updating Github with FireKaku PS4 ports for both 3.15 and 3.50 Firmware as well. :D

Download: PS4-3.55-Code-Execution-PoC-master.zip / GIT / WhiteOverfl0w GIT

From the ReadMe file: PS4 3.55 Code Execution:

This repo contains a PoC for getting code execution on ps4's with firmware version 3.55 (Now with support for 3.15 and 3.50).

It uses the same webkit vulnerability as the henkaku project. So far there is basic ROP working and returning to normal execution is included.

I have also included some helper methods to make researching a tad easier. Currently the documentation is pretty poor but I will be updating it over time.

Usage:

You need to edit the dns.conf to point to the ip address of your machine, and modify your consoles dns settings to point to it as well. Then run:
Code:
python fakedns.py -c dns.conf
then
Code:
python server.py
Debug output will come from this process.

Navigate to the User's Guide page on the PS4 and information about the exploit and all loaded modules should be printed out. This is an example of what running it will look like: https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8

If you want to try the socket test to work. Change the IP address at the bottom of ps4sploit.html to your computers and run a command such as netcat -l 0.0.0.0 8989 -v. You should see something like:
Code:
Listening on [0.0.0.0] (family 0, port 8989)
Connection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)
Hello From a PS4!
There are a few notes:
  • The exploit is not 100% reliable currently. It is more like 80% which is good enough for our purposes. So if it does not work on first try, try a few more times. Also doing to much allocating after the sort() is called can make it more unstable.
  • The process will crash after the rop is done executing.
  • This is really only useful for researchers. There are many many more steps needed before this will be useful to normal users.
Acknowledgements:

xyz - Much of the code is based off of his code used for the henkaku project
Anonymous contributor - WebKit vulnerability PoC
CTurt - I basically copied his JuSt-ROP idea
xerpi - Used his idea for the socket code
rck`d - Finding bugs such as not allocating any space for a stack on function calls Maxton - 3.50 support and various cleanup Thunder07 - 3.15 support

Contributing:

The code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.

Thanks to @Jeff in the PSXHAX.COM Shoutbox for the heads-up! :)
HENkaku PS4 Exploit.jpg

FireKaku PS4.jpg
 

Comments

azoreseuropa

Senior Member
Contributor
Verified
I'm guessing you are on about full jailbroken ps4 with debug options and stuff, and that will still be along time most likely as we still need a kernal exploit for 3.55 to even do anything worth while with this.
in how many months we will see the jailbroken PS4 ??
just asking ...
Yeah, it will happen. But when ? We don't know. They are working on it and thats why psxhax is here for us so we can keep reading it and see whats going on. Its called NEWS! :D
 

STLcardsWS

Member
Contributor
This isn't completely accurate either, as PlayStation 4 kernel and user level exploits have been found, reported and patched internally at Sony throughout PS4 Firmware revisions... not only public exploits get patched, the majority discovered never even make it to the public's eyes before Sony puts the kibosh on them :D

So, for example, if Sony patched a kernel exploit in 3.50 then it would still be present in 3.15 for devs or anyone else who hasn't been tempted to update beyond 3.15 yet since HENkaku can be ran from it :)
We do not know what has been reported or patched internally that is speculative at best. Of course they test and try and find holes, but there is many different attacks and methods and that is why developers can usually talk about an exploit and not see a patch until the exploit is actually live and it can be seen first hand. While its not an impossible thought a hack is in private and sony patches same hole through internal testing. i honestly just do not see that scenario happening very often.

Also the new site logo, looks great, much better then the previous one. .
 

PSXHAX

Staff Member
Moderator
Contributor
Verified
We do not know what has been reported or patched internally that is speculative at best. Of course they test and try and find holes, but there is many different attacks and methods and that is why developers can usually talk about an exploit and not see a patch until the exploit is actually live and it can be seen first hand. While its not an impossible thought a hack is in private and sony patches same hole through internal testing. i honestly just do not see that scenario happening very often.
I'm not sure who 'we' is, but I personally know it's 100% fact not speculation whatsoever and happened fairly often actually. :D

How do I know? Doing this for almost 2 decades and having worked with MANY PlayStation, PS2, PSP and PS3 developers who by day were Sony employees and moonlighted as release group / scene devs sharing both internal (breaking NDA's) and external exploits, with what was internally reported as patched being confirmed when the next Firmware update went live numerous times.

Many exploits over the years were only made public after Sony patched them, and those not deemed useful to developers got publicly released prior to Sony patching them... as devs knew they would be patched in the next OFW update and naturally they were right but didn't care.

Of course there are also factors such as developer / release group feuds, leaks and other scenarios in the mix so nothing is completely predictable :p

Let there be no mistake though, it definitely happens whether you want to believe it or not. You're certainly entitled to your opinion but having lived through and experienced all this first-hand for nearly 20 years I wouldn't want to be included in that 'we' statement as I do know better with countless nights spent in private IRC chatrooms seeing what really goes on ;)

Also the new site logo, looks great, much better then the previous one. .
Thanks! The old one was just a template holder, but YES it's nice to be able to cross one more thing off the ongoing to-do list. :)
 

Legion PS3

Member
Contributor
No word as of yet when a PS4 games disc can be inserted into a jb PS4 then downloaded to it's hard drive?

*edit* No reply needed. I've read previous posts. Thx
 
Recent Articles
Red Dead Redemption 2 PS4 Models and Textures Tool by ID-Daemon
Following his Spider-Man PS4 Skeletal Models & Textures Tool release and the recent RDR2 PS4 Modding Demos data miner @iddaemon (aka ID-Daemon) shared details on his Red Dead Redemption 2 PS4...
3D Renders of Rumored PS5 / PlayStation 5 Development Kit Patent Design
Proceeding the rumored PS5 / PlayStation 5 DevKit Patent that surfaced earlier this week, today some artist renditions based on the Sony patent have surfaced for those seeking a closer look at the...
Latest PlayStation 4 Game Trailer Videos from Gamescom 2019
Earlier this week we saw a Call of Duty: Modern Warfare 2v2 Alpha PS4 trailer video from Gamescom 2019, and below is some more fresh PlayStation 4 video game footage from this year's Gamescom...
Chiaki: Free and Open Source PS4 Remote Play Client by Thestr4ng3r!
Last month we reported on a PS4 Remote Play open source client in development by thestr4ng3r, and today he released Chiaki... the first free and open source PS4 Remote Play client software for...
Top