Interested in investing time and money into PSXHAX.COM? Read More and Contact Us for details!

PPPwn: PlayStation 4 PPPoE RCE PS4 Kernel Exploit to 11.00 by TheOfficialFloW

Category PS4 Jailbreaking       Thread starter Thread starter PSXHAX       Date / timeStart date Apr 30, 2024 at 2:26 PM       Replies 488      
Status
Not open for further replies.
Today TheOfficialFloW aka theflow0 decided to publish PPPwn ahead of his Remote Vulnerabilities in SPP talk on CVE-2006-4304 (FreeBSD.org) at TyphoonCon 2024 next month, which is the first PlayStation 4 PPPoE (Point-to-Point Protocol over Ethernet) RCE (Remote Code Execution) Kernel Exploit supporting PS4 Firmware versions up to 11.00 OFW with @KIWIDOGGIE aka kd_tech_ passing along some 11.00 Offsets (Orbis110.hpp) that can help in reverse-engineering payloads crediting developer @Al Azif (fw_defines.h / payloads_1100_and_below.zip - 46.3 KB - includes ps4-app-dumper.bin, ps4-disable-updates.bin, ps4-fan-threshold.bin, ps4-ftp.bin, ps4-module-dumper.bin, ps4-permanent-uart.bin and ps4-todex.bin via @zecoxao aka notnotzecoxao) stage2.bin (11.2 KB) and additional payloads (module_dumper.bin - 10.7 KB, permanent_uart.bin - 6.84 KB, pup_decrypter.bin - 16.8 KB, update_blocker.bin - 5.48 KB - rename to payload.bin and put on USB) and Enable Debug Menu Settings and FPKG patches (stage2_10.00.bin - 10.9 KB, stage2_10.01.bin - 10.9 KB, stage2_11.00.bin - 10.9 KB - rename file to stage2.bin and put in the stage2 folder) via @LightningMods aka LightningMods_ with Pull Requests for Ports spanning 7.00, 7.01, 7.02, 7.50, 7.51, 7.55, 8.00, 8.01, 8.03, 8.50, 8.52, 9.00, 9.03, 9.04, 9.50, 9.51, 9.60, 10.00, 10.01, 10.50, 10.70, 10.71 and 11.00. :love:

While PS5 Firmware versions up to 8.20 OFW were confirmed as vulnerable to CVE-2006-4304 by theflow0 previously, according to @CrazyVoid on Twitter, "what flow released is for PS4. the PS5 is different then PS4, it might not be able to be exploited the same way" with @SpecterDev elaborating on Twitter, "Since I've seen a lot of ppl asking about it, theflow's latest RCE won't easily be adapted to PS5. PS4 is much weaker in terms of mitigations which played a part in allowing a remote exploit w/o userland code execution. PS5 is different. SMAP+CFI make this much harder to do."

He went on to state via Twitter, "XOM also plays a role, even if CFI were a non-issue, you can't easily get gadgets to ROP with either. It might not be impossible but a new strategy would be needed and you'd need to go for R/W. You'd also likely need userland code exec. I wouldn't expect anything soon.."

Download PPPwn PS4 Payloads and Variants:
Spoiler: Depreciated

:arrow: Additional PlayStation 4 Homebrew / Payload Updates for 11.00 PS4 Firmware:
Here's further details from the PPPwn README.md: PPPwn - PlayStation 4 PPPoE RCE

PPPwn is a kernel remote code execution exploit for PlayStation 4 upto FW 11.00. This is a proof-of-concept exploit for CVE-2006-4304 that was reported responsibly to PlayStation.

Supported versions are:
  • FW 7.00 / 7.01 / 7.02
  • FW 7.50 / 7.51 / 7.55
  • FW 8.00 / 8.01 / 8.03
  • FW 8.50 / 8.52
  • FW 9.00
  • FW 9.03 / 9.04
  • FW 9.50 / 9.51 / 9.60
  • FW 10.00 / 10.01
  • FW 10.50 / 10.70 / 10.71
  • FW 11.00
  • more can be added (PRs are welcome)
The exploit only prints PPPwned on your PS4 as a proof-of-concept. In order to launch Mira or similar homebrew enablers, the stage2.bin payload needs to be adapted.

Requirements
  • Computer with Ethernet port
    • USB adapter also works
  • Ethernet cable
  • Linux
    • You can use VirtualBox to create a Linux VM with Bridged Adapter as network adapter to use the ethernet port in the VM.
  • Python3 and gcc installed
Usage

On your computer, clone the repository:
Code: 
git clone --recursive https://github.com/TheOfficialFloW/PPPwn
Change the directory to the cloned repository:
Code: 
cd PPPwn
Install the requirements:
Code: 
sudo pip install -r requirements.txt
Compile the payloads:
Code: 
make -C stage1 FW=1100 clean && make -C stage1 FW=1100
make -C stage2 FW=1100 clean && make -C stage2 FW=1100
For other firmwares, e.g. FW 9.00, pass FW=900.

DO NOT RUN the exploit just yet (don't press Enter yet) but prepare this command on your prompt (see ifconfig for the correct interface):
Code: 
sudo python3 pppwn.py --interface=enp0s3 --fw=1100
For other firmwares, e.g. FW 9.00, pass --fw=900.

On your PS4:
  • Go to Settings and then Network
  • Select Set Up Internet connection and choose Use a LAN Cable
  • Choose Custom setup and choose PPPoE for IP Address Settings
  • Enter anything for PPPoE User ID and PPPoE Pasword
  • Choose Automatic for DNS Settings and MTU Settings
  • Choose Do Not Use for Proxy Server
  • Now, simultaneously press the 'X' button on your controller on Test Internet Connection and 'Enter' on your keyboard (on the computer you have your Python script ready to run).
ALWAYS wait for the console to show the message "Cannot connect to network: (NW-31274-7)" before trying this PPPOE injection again.

If the exploit fails or the PS4 crashes, you can skip the internet setup and simply click on Test Internet Connection. Kill the pppwn.py script and run it again on your computer, and then click on Test Internet Connection on your PS4: always simultaneously.

If the exploit works, you should see an output similar to below, and you should see Cannot connect to network. followed by PPPwned printed on your PS4, or the other way around.

If the exploit works, you should see an output similar to below, and you should see Cannot connect to network. followed by PPPwned printed on your PS4.

Example run
Code: 
[+] PPPwn - PlayStation 4 PPPoE RCE by theflow
[+] args: interface=enp0s3 fw=1100 stage1=stage1/stage1.bin stage2=stage2/stage2.bin

[+] STAGE 0: Initialization
[*] Waiting for PADI...
[+] pppoe_softc: 0xffffabd634beba00
[+] Target MAC: xx:xx:xx:xx:xx:xx
[+] Source MAC: 07:ba:be:34:d6:ab
[+] AC cookie length: 0x4e0
[*] Sending PADO...
[*] Waiting for PADR...
[*] Sending PADS...
[*] Waiting for LCP configure request...
[*] Sending LCP configure ACK...
[*] Sending LCP configure request...
[*] Waiting for LCP configure ACK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure NAK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure ACK...
[*] Sending IPCP configure request...
[*] Waiting for IPCP configure ACK...
[*] Waiting for interface to be ready...
[+] Target IPv6: fe80::2d9:d1ff:febc:83e4
[+] Heap grooming...done

[+] STAGE 1: Memory corruption
[+] Pinning to CPU 0...done
[*] Sending malicious LCP configure request...
[*] Waiting for LCP configure request...
[*] Sending LCP configure ACK...
[*] Sending LCP configure request...
[*] Waiting for LCP configure ACK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure NAK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure ACK...
[*] Sending IPCP configure request...
[*] Waiting for IPCP configure ACK...
[+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141

[+] STAGE 2: KASLR defeat
[*] Defeating KASLR...
[+] pppoe_softc_list: 0xffffffff884de578
[+] kaslr_offset: 0x3ffc000

[+] STAGE 3: Remote code execution
[*] Sending LCP terminate request...
[*] Waiting for PADI...
[+] pppoe_softc: 0xffffabd634beba00
[+] Target MAC: xx:xx:xx:xx:xx:xx
[+] Source MAC: 97:df:ea:86:ff:ff
[+] AC cookie length: 0x511
[*] Sending PADO...
[*] Waiting for PADR...
[*] Sending PADS...
[*] Triggering code execution...
[*] Waiting for stage1 to resume...
[*] Sending PADT...
[*] Waiting for PADI...
[+] pppoe_softc: 0xffffabd634be9200
[+] Target MAC: xx:xx:xx:xx:xx:xx
[+] AC cookie length: 0x0
[*] Sending PADO...
[*] Waiting for PADR...
[*] Sending PADS...
[*] Waiting for LCP configure request...
[*] Sending LCP configure ACK...
[*] Sending LCP configure request...
[*] Waiting for LCP configure ACK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure NAK...
[*] Waiting for IPCP configure request...
[*] Sending IPCP configure ACK...
[*] Sending IPCP configure request...
[*] Waiting for IPCP configure ACK...

[+] STAGE 4: Arbitrary payload execution
[*] Sending stage2 payload...
[+] Done!
Notes for Mac Apple Silicon Users (arm64 / aarch64)

The code will not compile on Apple Silicon and requires amd64 architecture. There is a workaround using docker which will build the bin files required. Clone this repository to your mac system, then from the repo folder run ./build-macarm.sh. This will build the binaries for PS4 FW 1100 and place the necessary files into the correct folders.

To build the binaries for a different version, i.e. 900, run the command as such: ./build-macarm.sh 900. Once built, copy this folder structure into the Linux VM and execute as instructed above.This has been tested using VMware Fusion 13.5.1, with the VM Guest as Ubuntu 24.04, and the host machine is MacOS 14.4.1

Notes for GoldHEN version

This loader only supports payloads with a kernel entrypoint. The custom version of stage2 first looks for the payload in the root directory of the USB drive, and if found, it is copied to the internal HDD at this path: /data/GoldHEN/payloads/goldhen.bin. The internal payload is then loaded and is no longer needed on the external USB drive. At the moment, only firmware versions 9.00, 10.00, 10.01 and 11.00 are supported. Other versions like 9.60 will also be supported.

Reminder: All GoldHEN related issues, updates, etc go in the ongoing discussion topic for it:
Spoiler: Related Tweets, Videos, Opcode Offsets & ROPGadget Gadgets
PPPwn PlayStation 4 PPPoE RCE PS4 Kernel Exploit to 11.00 by TheOfficialFloW.jpg
 
Click to expand...
PSXHAX
PSXHAX
Live in Your World, HAX in Ours!
Hello World! I've been reporting on Sony PlayStation hacking news since 2000 and started PSXHAX in 2014 to cover PlayStation (PSX), PlayStation 2 (PS2), PlayStation 3 (PS3), PlayStation 4 (PS4), PlayStation Portable (PSP), PlayStation Vita (PS Vita), PlayStation TV (PS TV) and next-gen PlayStation 5 (PS5) platforms along with anything else of interest.

Click on my UserName author link above and you'll be able to view a curated list of all the articles I've contributed thus far to PSXHAX.COM! :)
X - YouTube - Starlink (Ref) - Windscribe VPN (Ref)

Comments

Before using PPPwn on a Luckfox I was able to go to Tylermods PS4 Trainer website and enable WRTE and I was able to use Trainers for my games. Since PPPwn I cannot do that.

Here is what I tried.

1 Jailbroke my PS4 with PPPwn
2 I changed my Network connection to WiFi and tried to enable WRTE (which I had done after the LuckFox jailbroke my PS4). I updated cheat manager so I know I could connect my installed payloads to the internet for updates.
3 I received updates for my installed games that I deleted as they were downloaded. So I know my PS4 was connected to the internet over WiFi.
4. My WiFi IP address is different than my Luckfox

I am not sure on how to proceed to access an exploit host so I can load their WRTE so I can user Tylermods Trainers that are not in the Cheat manager

Any help would be appreciated. Thank you
 
I switched from the 9.00 USB stick jb to PPPwn running on Android and it's way less trouble to get going (what with the webkits out of memory errors plaguing the USB jb).
 
I am curious as to when 11.00 will fully support linux usage. Currently the payloads used to get Linux running on 11.00 are outdated which forces many people to restart their PS4 system again and redo a jailbreak again just in order to attempt to get Linux running the outdated payload Linux running sytem.

I am currently typing this message using Fedora 38 which is running on my PS4 pro, which I think it awesome, however. If I want to go back to playing normal PS4 games that means the next time I want to use my PS4 Pro as a Desktop PC, that means I need to do several attempts of the whole outdateed payload stuff.

I am thankful that I am able to use an awesome jailbroken PS4 because of the hard work of brillant people, but it would be nice if more time was put forth so that all jailbroken PS4 users can have a smoother experience, especially since it's been more than a year since this great achievement.

I am aware that people are very busy with their private lives, but I think a smoother experience will make this community more lively as there are many who don't like to continue using a system that isn't running smoothly.
 
I finally got my PS4 jailbroken on fw 11.00 a few months ago. I didn't get much time to play around with it because of school. But know that it's summer I've been having a lot of fun with it. I'm glad to see PPPwn feels A LOT more stable then the last time I used it, it never crashes for me anymore.
 
Got a ps4 pro running on 10.01. I didn't bother with the update to 11.00 and went straight for jb. Used pppwn tinker gui, had a lot failed attempts at stage 2 then i left it at retry and after 15 mins came back to loaded, everything works great! Apart from some homebrews like ps4 tools crashing and one wake up from rest crash. I have no other noticable stability issues.
 
As for jailbreaking, I found that my old/slow PC would fail with jailbreaking quite often and such failure would result in the PS4 just powering down a lot, forcing me to restart the entire process again. I find that the router jailbreak method succeeds a lot more often and is usually able to jailbreak much faster than my PC was able to. I'm on jailbreak for 11.00 by the way.

As for the linux payload thing... I have found that since my entire linux distribution is on my USB3 external SSD HDD device, that having things plugged into the other USB ports actually has a very strong correlation with if the Linux distribution booting would fail or not. So, I used to have an additional external harddrive, playstation controller, cellphone, usb thumb drive and keyboard/mouse dongle usually plugged in while I attempted to get the Linux environment to boot up and it would fail a lot and I had to start the whole jailbreak process over again.

However, I found that if I ONLY plugged in the external SSD HDD into the PS4 Pro and unplugged everything else, the Linux distrubution has a MUCH higher chance of sucessfully booting up.

Now all I need to do is to get the internet passthrough for my LAN port to work and playstation VR working with the Linux boot-up process, everything will be pretty seamless. If anyone else had internet passthrough/VR box problems and found solutions please let me know.
 
Status
Not open for further replies.

PSXHAX Categories

PS4 Jailbreak Status
PS5 Jailbreak Status

Share This Page

Back
Top