PS4 Webkit Bad_Hoist 6.72 Exploit Port WIP by Sleirsgoevy & 6.72 Dumps

Proceeding his PS4 ROP 8CC Port and the 7.02 PS4 Kernel Exploit (KEX) release, PlayStation 4 scene developer sleirsgoevy added a work-in-progress (WIP) port of the PS4 Webkit Bad_Hoist 6.XX Exploit by Fire30 to his Github repository noting it should work up to 6.72 but requires some minor changes and offset adjustments.

In related news, @zecoxao shared via Twitter a PS4 dump file pack including webkit, libc, libkernel, gadgets and syscalls from 6.72 Firmware and kernel, libc, libkernels and libSceWebkits decrypted from 7.00 Firmware which can also be found below.

Download: bad_hoist-master.zip / GIT / 6.72 Payload Ports / dumps_672.7z (41.41 MB) / 700.7z (46.84 MB) - 6.72 Contents:

gadgets.txt
libc.bin
libc.elf
libc-gadgets.txt
libkernel.bin
libkernel.elf
syscalls.txt
webkit-gadgets.txt
webkit.bin
webkit.elf

7.00 Contents:

80010002.elf
libc.sprx
libkernel.sprx
libkernel_sys.sprx
libkernel_web.sprx
libSceWebKit2.sprx
libSceWebKit2ForVideoService.sprx
libSceWebKit2Secure.sprx

As covered previously, it's recommended not to update your Firmware until a full PS4 6.72 jailbreak is publicly released.

And from the README.md: bad_hoist

This is an actually working implementation of Fire30's bad_hoist exploit.

Supported firmwares

This exploit has been tested and proven to be working on FW 6.51. This should work up to 6.72 with minor changes, however various offsets need to be adjusted.

ROP compiler setup

In order to run the ROP compiler you need to have dumps of WebKit, libc & libkernel.

Run make and follow instructions to obtain the dumps.

Dependencies: python3, gcc, ROPgadget

Assembly-like ROP format

This toolchain uses assembly-like ROP format that is briefly described below.

<label>:

Declare a label. Labels are global and should be valid Python identifiers.

<asm_instr>

Find a gadget that looks like asm_instr ; ret and insert its address. Will error out if the gadget is not found inside the dumps.

Note: after dumping you can find a dumps/gadgets.txt file.

# comment

For each line, every character after the first # is considered a comment.

db <expr>

(<expr>) must be a valid Python expression that evaluates to a collection of integers in range(256). The corresponding bytes will be written into the ropchain.

Examples: db 1, 2, 3, db bytes(256)

dq <expr>

<expr> must be a valid Python expression that evaluates to an integer. The integer will be written into the ropchain as a 64-bit little-endian value.

dp <expr>

Same as above, but <expr> should evaluate to an offset from the start of the ropchain. This will result in an absolute address being written.

For example, the commands

pop rsp
dp label_to_jump_to

will perform a jump.

$<expr>

<expr> should be a JavaScript expression that evaluates to an integer. The expression will be executed inside the exploited WebKit and the result will be written into the ropchain as a 64-bit little-endian value.

Example: $infloop_addr

Note: in JavaScript numbers only have 52-bit precision.

$$<expr>

<expr> will be inserted into the resulting JavaScript code literally.

If <expr> reads exactly pivot(ropchain);, the final pivot statement will be omitted.

Example:

$$function(some_params)
$${
...ropchain...
$$pivot(ropchain);
$$}

See examples of this language in the rop/ directory.

ROP compiler usage

usage: python3 rop/compiler.py <rop_source> <gadgets.txt> > <rop_js>

<rop_source> is the ropchain source code in the format described above.

<gadgets.txt> should point to dumps/gadgets.txt (or an alternative gadgets file in the same format).

<rop_js> is the resulting JavaScript file that should be executed.

Running ropchains

To run a compiled ROP chain, add the corresponding <script> tag to the end of index.html, then load that page in the PS4 web browser.

Use the following Ghidra script on a decrypted libkernel_sys.sprx loaded with GhidraOrbis to add mast1c0re support for other firmware versions (Dumps the `***/include/offsets/ps/libkernel/psx/xx.xx.hpp` file)

• DumpLibKernelExports.py

 

[PSXHAX]

I wouldn't update anything until a full jailbreak is released to be safe.

 

[Lunares]

GREAT DAY THANKS A LOT

 

[scorpion175]

we have kernel and webkit exploit, i think is a matter of days for devs to make a loader

 

[karakral]

Great news

 

[daniplayer]

Let's hope it's days and not another months just to get it work on at least 6.72...

 

[jose gozalez]

i mean ps4 uses FreeBSD 9 and ps5 uses FreeBSD 12, this vulnerability is good for both, already checked and confirmed, so we would have a good basis for ps5, fire30 found it and decided to keep it hidden until the output of ps5 and do half the work, they spoke with theflow0 so that he would not release it until he worked on ps5, and he acted from behind and now sony covers it on ps5, nails the dagger, takes the money and leaves. For those who do not know, there is a kernel hack until 7.51 already confirmed. in short, he is a traitor.

 

[UltraLex]

So, is that news good for us?

 

[H3RB4LS]

Much appreciated to all those involved. Take your time, people have been waiting 2 years, another few months isn't going to hurt anyone.

 

[Ismas]

Thank you to all involved for your hard work !!

 

[seanp2500]

Gosh traitor is such a strong word. But yes I have come to the conclusion that in the game of the cat and the mouse this was the wrong move. At least from a hacker perspective compared to the corporation. A lot of variables here. You cannot control a hacker’s motivations as a scene.

Some have said we need to use crowd funding as a solution but gosh people as SO stingy! But i worry cooperating with these corporations is just not good for us as humans/owners. Alas the flow has done amazing work and has gone the route he chose. I feel he has betrayed no one. He did what he did for his reasons.

Problem being that it is possible simply waiting a few more months could have meant 0 day ps5. I suppose the game of the cat and the mouse is now affected by the $. Which spells bad news I feel for modded consoles this next gen. Not because hackers collect bounties. But their openness and cooperation with the corporations will strengthen their security methods and measures.