JailbreakMe PS4 4.0x: PS4 4.0x WebKit RCE Exploit by Qwertyoruiopz!

Following the PS4 Playground for Firmware 3.55 and PS4 3.55 File Browser, today PlayStation 4 developer qwertyoruiopz made available a PS4 4.0x WebKit RCE Exploit dubbed JailbreakMe PS4 4.0x with details via Twitter below!

PS4 Link (click go 3 times): http://rce.party/ps4/ / local rce.rar (3 KB) via Nesterwork / Local RCE v2.rar (6 KB) via Nesterwork / Local rce v3.rar (12 KB) via Nesterwork

According to the developer's Tweets below, the bug used is a stack uninit read yielding UaF and the actual exploit does nothing but give you read/write/infoleak arbitrary JS object primitives.

He also confirmed the exploit won't work on PS4 4.50 as Sony updated WebKit past a vulnerable version unfortunately, but it's still an entry point for those on PlayStation 4 OFW 3.55 through 4.07.

That said, if you give it a try on a PlayStation 4 under 4.50 and receive a ffff000000000539 error prompt it's expected output for the exploit's success.

Spoiler: Related Twitter Tweets

Cheers to @DarkElementPL, @DoxyMarket, @hyndrid, @ryan111, @toni1988 and @vettegast for sharing the news in the PSXHAX Shoutbox!

 

[yota1979]

But if I'd like to try to execute code for the kernel exploit, how i try this? I have to edit the exploit.js file to load in memory the file and execute?

Ok... I see the new code 2 of the exploit... I don't understand mode of code. I'm not a programmer.

But... for the programmer... with this exploit there is the possibility to try run this exploit :

https://www.exploit-db.com/exploits/39570/

 

[Seedlord]

"CVE-2016-1885 is not applicable to the PS4, Sony removed set_ldt after 1.76. Thanks to Red-EyeX32 for pointing this out."

 

[ps4hk]

I've just read a twitter from qwertyoruiop in which says "30 hours of no sleep later i am finally happy about the ps4 exploit"....what does he means?? He have found a kernel exploit as well????

 

[ArthurBishop]

He have found a kernel exploit as well????

Not yet , he is working on it but have some problems.

 

[Nesterwork]

https://mega.nz/#!WEcyjCBZ!SZ8SMTFP2EdpZNpUbuzFYHMRCozDTadYh1lFKyNMTV4

"v3"

 

[MadMan467]

Not yet , he is working on it but have some problems.

Really? Is he actually working on a kexploit? Where did you find this?

 

[lukasplays]

So, what can I do now with the exploit?

 

[ArthurBishop]

Sorry , I made mistake , sleepy today.

 

[MadMan467]

Would have been too nice. I guess he is just improving his webkit exploit.

 

[ArthurBishop]

Indeed , v3.