PPPwn: PlayStation 4 PPPoE RCE PS4 Kernel Exploit to 11.00 by TheOfficialFloW

cyberdrizzt · Aug 30, 2024 at 9:12 AM

I recently got back in to playing my PS4 and had previously tried the old jailbreak from years ago, but after not having the console on for literally years I was glad to see that I left it on a suitable firmware (v9.00) so I have been happily using the new jailbreak method for a couple of weeks now of that console.

I've even sent off for one of those plug and play ethernet devices so just waiting for it to arrive, at the moment I'm using my LG TV to run the jailbreak.

A few days ago I bought a PS4 Pro cheap just hoping it would be on 11 or lower, but sadly it's on 11.03, still it will be waiting for me once a jailbreak comes for 11+ and I have the 'normal' PS4 till then.

stationplay · Aug 31, 2024 at 6:40 AM

I am on FW 10.00, and I was able to use the pppwn.exe version, but I had a bit of an oddity. I kept getting a failure fairly quickly on the PS4 side that said 'A DNS Server cannot be used' around the time the heap grooming was starting on the exploit side. I rebooted everything. No dice.

On a whim, I tried a different ethernet cable, and everything worked on the next try. I've tested the 'bad cable' and it seems great elsewhere, but something about it didn't work for PPPwn. Hopefully if someone else gets the same error, they find this.

Skiepp · Sep 1, 2024 at 9:54 AM

I had this issue too on the first try! Tested with one (working) ethernet cable with no luck... tried another one and got it working in a couple of seconds.

Then i checked the cable itself with a RJ45 cable tester, and i noticed that the first cable was in fact a CAT5e with only 2 twisted pair (those cables are elsewhere perfectly functional, but only allow 100mbps speed to be negotiated).

Dunno if it's related to the issue, but I manually crimped 2 more cables just for curiosity and the test seems to be confirming my hypothesis...

Anyway, got it working with a short, good CAT6 cable and a Luckfox Pico, extremely convenient as you can leave it attached to the console, and it turns itself off automatically after the JB.

The last issue was how to properly shutdown the console, (the JB sometimes leaves the console pretty stucked when you turn it off).... well, turns out today that the only thing you need to do is to disable internet connection

ankelbiter12 · Sep 1, 2024 at 12:28 PM

This is incredible, nice and easy to follow and I thought I hit a dead end when I found that PC emulation isn't great yet.

I see a lot of people reporting switching the ethernet cable when it fails, but I find it doesn't work every execution anyway. If it works 50% of the time, it's not the ethernet switching that did it, idk if that's the case for everyone but I'm pointing it out to maybe save someone a step, try again, try again, restart, try again.

aerospace · Sep 2, 2024 at 12:59 PM

This exploit is AMAZING! The moment I heard about it, I dusted off my old PS4, formatted my Raspberry Pi's SD card, and cloned the Pi-PWN repo that @stooged made. From there, it was smooth sailing, and I’ve been diving deeper into this fascinating scene ever since. Gotta admit, though, it was a bit nerve-wracking injecting prebuilt binaries from sources I wasn’t familiar with… but all in the name of tinkering, right?

I wanted to share something useful in my first post, so here’s a random tidbit that might help someone out there:

I noticed some folks out there were having trouble setting up an FTP connection with the PPoE NAT implementation of the Pi-PWN repo. The issue might be that they didn’t catch @stooged's note in the README.md to set the FTP client to “Active” mode instead of “Passive” mode. Especially if they’re using FileZilla, they might not realize what the issue is as it won't log anything useful when things go wrong. On top of that, by default, FileZilla doesn’t fall back to active mode after the initial FTP handshake, which can cause headaches.

A potential fix is enabling a Linux kernel module that is a nftables helper which rewrites FTP protocol messages (like the PASV message from the GoldHen FTP server) between the client and server behind a NAT: `nf_nat_ftp`. Just add `sudo modprobe nf_nat_ftp` in `pppoe.sh`, and Active mode FTP should work just fine from that point onwards.

Sidenote: I always assumed kernel modules like the one mentioned above were autoloaded, but apparently that does not seem to be the case for `nf_nat_ftp`, although other (i.e. `nf_conntrack_nat`) are autoloaded. I have no clue why that is, so if any people knowledgeable about the Linux Kenel autoload subsystem are reading this, would love to know your thoughts on this!

Anyways, really excited to join this community, learn more about the fundamentals of the FreeBSD-based PS4 kernel and (hopefully!) eventually contribute and build cool stuff together with you guys!

CptPowPow · Sep 4, 2024 at 6:39 PM

I'm new to the PS4 scene, but recently acquired a PS4 slim (11.00) and decided to give it a whirl. Wiped it, formatted a new 1tb SSD that's attached through USB, used the PPPwn exploit (PC based tool) which worked amazingly well. I haven't ran into any issues really, PKG installation is pretty straight forward.

I am wondering though if there is a PSN spoof for 11.00 that will let me login to my PSN account somehow just so I'm not running a generic profile. As updating isn't an option if I want to keep it pwn'd is there a way to spoof PSN using a router or PC somehow? Thanks

bowura · Sep 6, 2024 at 6:43 AM

I recently jailbroke my 11.0 Slim PS4 with the Luckfox Pico, very easy method but I'm having a big problem: My save files are being deleted without any reason, I already lost 2 saves from different games, so the PKG isn't the problem.

Anyone has any suggestion of what I can do? I'm thinking about saving with Apollo to USB Drive, but Apollo is very confusing to use

stevenzweidrei · Sep 6, 2024 at 2:20 PM

here is my AIO:

PI-Pwn-AIO

zolpidem666 · Sep 7, 2024 at 3:53 PM

I'm looking for a MALE AUX ps4 connector, there is a way to get one?

@bowura I had the same problem but I associate it with the fact that the console went into kernel panic twice in a row and having an hdd the data can be corrupted more easily

Himoko · Sep 9, 2024 at 1:59 PM

For the previous post - I will try and find the german one I used if I still have the email. Radio Shack might of had it.

Concening PPPwn and Luckfox I have been using a Luckfox to jailbreak my 2 PS4 Pros, one on 9.00 and the other on 11.00.

They both share the same problem. Neither system likes to reboot from rest mode (I unplug my luckfox when in Rest Mode) and sometimes when I just click my PS4 controller it might turn on. What usually happens is either PS4 wont boot clean or enter true rest mode or sometimes shut down. When I shutdown the PS4 it sometimes has the need to repair message at startup (I changed the HDMI cable to fix the boot problem but now it is back.

When either boots it needs to repair the PS4 and external storage. The PPPwn jailbreaks the PS4s. It is the next startup that is the issue.

Any suggestions would be appreciated. Thank you

PPPwn: PlayStation 4 PPPoE RCE PS4 Kernel Exploit to 11.00 by TheOfficialFloW

Comments

cyberdrizzt

stationplay

Skiepp

ankelbiter12

aerospace

CptPowPow

bowura

stevenzweidrei

zolpidem666

Himoko

PSXHAX Categories

Latest Forum Topics

Share This Page