PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[bobthecooldad]

we currently do not need any outside testers. No offense, just have to keep it tight for now.

you are free to test things on your own and report through PM or another way if you would like

i know you want to keep it quiet, would it be possible of you update the ps3 playground website you have a version number (somewhere on the index (maybe bottom right)) so we know if there has been a change or if not?

 

[esc0rtd3w]

yes i can do some form of versioning to keep track that is very non-disruptive. Maybe not versioning specifically, but something.

 

[PlayNStay11]

When do you think the whole working hack will go into full effect? September? October? And will this webkit hack feature an FTP server like the PS4 one?

Thanks and also nice work.

 

[Jaroslav01]

^ is that a joke, it will be VERY hard to make this, especially the filesystem thing...
And it will come out next year or longer I think..

 

[GrimDoe]

 

[esc0rtd3w]

updated test page on playground. This is just something a little extra for people to test on their own and try out some things if they wish!

still making progress, although no related information can be disclosed still, at this time

 

[Bhojraj]

Thanks dude, this what i am breaking my head for

 

[esc0rtd3w]

without disclosing too much info, i have discovered a lot more vulnerabilities and added them to the Private WebKit Testing page, including kernel crash dumps and other info, than are listed on the Public WebKit Testing page.

unfortunately, i cannot disclose more to most of these until we have several solid footholds into WebKit, the VSH, and other areas.

I am offering a WebKit UAF vulnerability that is not on the public page for anyone that has a DEX setup and is willing to do some testing to get userland memory dumping at the minimum using it. if anyone is interested, please PM me privately.

Thanks

 

[Gambt]

Keep up the good work ! Some progress is better than nothing. Hope soon we will find a way to get the idps on 4.81 among several other things.

 

[Reborn Persona]

Keep up the good work ! Some progress is better than nothing. Hope soon we will find a way to get the idps on 4.81 among several other things.

Err. Unless the PS3 patched their loaders extensively, it's far, far better than simply IDPS.

This could actually lead to an exploit just like HENKaku, except it should be a bit easier because a lot of the things the Vita uses are far, far, far greater security wise than what the PS3 does.

So don't be surprised if we see the late PSP 'LCFW' all over again.