PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[ZeroFadedBlaze]

@esc0rtd3w Wish you guys the best of luck in developing this stuff!

 

[esc0rtd3w]

Honestly would have rather you released the soft downgrade instead

i mean i can just stop posting anything all together. i thought others may want to test some stuff, i guess not

Would be nice but ya know.

 

[ItZzVast]

I was implying somethings have to be kept private for a certain amount of time before being publicly released.

 

[LightningMods]

Dont have to be a dick about it remember "This is for the community"

 

[xandawg]

I dont really sign up for too many sites or forums but just wanted to say thanks and give respect to esc0rtd3w and all involved in this project.

i bought a psp and ps3 together thinking id be able to mod both, not knowing the ps3 was still so locked down.. just wanna say again MUCH RESPECT and thank you for all your work and i dont know really anything about the ins and outs of it or what can be done or tested but if you need anything im willing to brick the ps3 or whatever else it would take to move this along even tho im sure theres nothing i could possibly do to help.

 

[esc0rtd3w]

Dont have to be a dick about it remember "This is for the community"

likewise

i believe you said something along the lines of.......

Honestly would have rather you released the soft downgrade instead

and to that, kind sir, I say "we don't have that ready yet!"

 

[Ploggy]

Whats currently possible with this Exploit?

 

[Soar18]

Whats currently possible with this Exploit?

Quoted from last Sunday:

more specifically, we plan on enabling CFW type features and more on all OFW as an end goal, simply put. But its a bit more complex than that.

we have to do everything in stages. Stage 1 was finding an entry point, done! Stage 2 was getting userland control and memory dumping, done! Stage 3 was getting access to root syscalls, done! Stage 4 was building working ROP chain to control all registers, done! Stage 5 is tricky and we have several options available currently using syscall chaining and other things......no spoilers, yet! <-- probably missed a few stages haha

Oh, and did i mention testing and lots and lots of time, blood, sweat, tears from the whole team!

Not much to update with yet other than we are still working very hard to get a public release when we can

The project itself likely won't be released until the end goal mentioned above is reached, so nothing to do right now but wait for them to finish. They could release all of their current completed progress on Github, but if Sony saw this and decided to send out a 4.82 update that patched the vulnerabilities before Esc0 (or someone else) could reach the end goal, then the people who unknowingly updated would be SOL and it'd be a lot of wasted effort from our spiky-haired friend and his team.

So nothing to do but encourage them, thank them for their hard work and keeping us updated, and be patient. He didn't give an ETA, but expect this to be finished within Q1 of 2018. At least then, people won't be restless. ¯\_(ツ)_/¯

 

[esc0rtd3w]

@Soar18 well said

 

[Ploggy]

@Soar18 well said

Yeah thats great and all but I wanted to know was what can you guys actually do now.?

Not what are your plans for the future

Thanks.