PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[Andrew92]

So the end goal is basically jailbreaking through the browser? Sorry, new to this

yes it looks so. the weakest part of the ps3 is the web browser. he was never updated. and that was even very smart from sony. because the more they update it, the more vulnerabilities there is. as you can see at the ps4.

we just have to return to the time, which had worked well before. and as you can see we have done a lot through a lot of sweat and effort. if sony the browser would update then they would only be angled on their own, because then it would be much much easier than now. everything is just a matter of time.

there is no the ps3 will never be open. the ps3 will be open. tomorrow, 3 days in 3 months or 3 years. but she will

 

[Jaroslav01]

is the webbrowser not a "she" ?

 

[ShadixAced]

Holes ???
*bubbles*

cough*unix-based xmb have some*cough

 

[purplekillaz1]

i am having trouble understanding whats the problem from keeping you from releasing it just wondering because my little brother will not stop asking me about when this webkit is gonna be released o yea and good job always thought it was impossible to make a webkit for the ps3

 

[k9mo]

i will just say that "access" is different than "control"

we have several options currently, patch appldr, soft downgrade to 3.55 [up to 25xx], 4.21/4.31 for 30xx, 40xx, 41xx [all except 42xx??] to take advantage of RSX exploit and patch lv1/lv0. also can extract IDPS, and chain any syscall to another.

only time will tell....just know that it's movin along nicely!

What about 42xxx and 43xxx can you downgrade them to 4.60 because that is the base firmware for them.

 

[esc0rtd3w]

i am having trouble understanding whats the problem from keeping you from releasing it just wondering because my little brother will not stop asking me about when this webkit is gonna be released o yea and good job always thought it was impossible to make a webkit for the ps3

the main reason is that all team members must approve before release to the public. the 2nd reason is we need to get a graceful return back from exploit in order to enable things like buttons for doing stuff on web page. if it comes down to it, we may release with dumping IDPS to USB or patching lv2/appldr and rebooting using syscall.

What about 42xxx and 43xxx can you downgrade them to 4.60 because that is the base firmware for them.

i think we can downgrade to minver for all consoles

 

[esc0rtd3w]

as promised.........added Stack Exhaustion DoS Test [CVE-2010-0050] to the PS3 Playground Public Testing Page :D

this is a memory corruption vulnerability

​

go out there and play kids!!!

 

[Noe0304]

YES YES YES IT'S WORK IT'S WOOOORRRKK , NO CAPTCHA YES IT'S WORK

 

[LightningMods]

Honestly would have rather you released the soft downgrade instead

 

[ItZzVast]

Would be nice but ya know.