PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[Jaroslav01]

hosting down probably?? its free. i gotta check

the SVG thing acts weird, sometimes asks for storage media??

i will add a couple more tests from the private testing page for you guys to play with to keep ya busy while you wait.... at least one good one with a CVE or maybe you will find something else cool

Private testing page?, are you talking about "http://websploit.org/ps3/ps3-playground/" ?

 

[esc0rtd3w]

Private testing page?, are you talking about "http://websploit.org/ps3/ps3-playground/" ?

that is the Public one. The private one is only for a select few at the moment

i will have some time today to add a couple more to the Public page. The only reason more are not added is because for one, most people i assume cannot take advantage of them, and you just get a crash....cool

The second reason being that if $ony updates some stuff, we don't want to give them too many hints

 

[Andrew92]

I have so many respect to you esc0rtd3w. You are doing great work. I have no idea of the whole. You will accomplish what great. Thank you for your time and effort. I find like geohot the playstation should be an open system just like the pc. Freedom is the will of all people. I believe in you and many people like you just want freedom.

When Sony released the Ps3 and they brought up support for another os, I thought it would be their own thought, but unfortunately she was ultimately more interested in money than what her basic thought was, fun and freedom.

 

[thejman98]

this is true

additional details cannot be revealed at this time.....yet.

more testing and work is still needed before any type of PoC or release to the public.

once things are finalized, the plan is to put all code onto GitHub from the team

What is the next step after kernel access?

 

[esc0rtd3w]

What is the next step after kernel access?

i will just say that "access" is different than "control"

we have several options currently, patch appldr, soft downgrade to 3.55 [up to 25xx], 4.21/4.31 for 30xx, 40xx, 41xx [all except 42xx??] to take advantage of RSX exploit and patch lv1/lv0. also can extract IDPS, and chain any syscall to another.

only time will tell....just know that it's movin along nicely!

 

[Andrew92]

I love you ^^ we stand by you. You're doing great, I just want to thank you. I give you a cheesburger from rest you times a bit from the whole stress. someone has to massage you while you do it all ^ ^

 

[bonayzah]

hey esc0rdrtd3w i m stuck on my ps3 because i cant buy a e3 flaser i hope there wil come a way to downgrade since sony removed my otherOs im on 4.81 firmware if you need to test let me no i.m very sad

 

[Andrew92]

Hey bonayzah everything will be fine again. He works for a long time and his team. Please be patient. Sony has neglected the webbroser very much, that is our chance. Actually sony is not dumb, or is it? Just what the ps4 is concerned, perhaps there are more weak spots there.

 

[thejman98]

So the end goal is basically jailbreaking through the browser? Sorry, new to this

 

[Piper2603]

Yes, this is the goal