Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Apr 21, 2016 at 9:12 PM       10,390       10            
Following news of the PS4 Dlclose Exploit for 1.76 and more recently the Entry Point findings, today Wololo reports that PlayStation 4 developer Fire30 made available a PS4 Webkit Exploit proof-of-concept for PlayStation 4 Firmware 2.XX.

Download: PS4-2014-1303-POC-master.zip / PS4-2014-1303-POC GIT

From the ReadMe file: CVE 2014-1303 Proof Of Concept for PS4

This repository contains a poc for the CVE 2014-1303 originally disclosed by Liang Chen. It has been tested to work on system firmware 2.03, but should work for systems on a firmware < 2.50, the ROP test will however only work on 2.03.

Usage

You need to edit the dns.conf to point to the ip address of your machine, and modify your consoles dns settings to point to it as well. Then run
Code:
python fakedns.py -c dns.conf
then
Code:
python server.py
Debug output will come from this process.

Navigate to the User's Guide page on the PS4 and various information should be printed to the console. The ROP test will print what is stored in the rsp register. Continuing execution after rsp is pivoted still needs to be done.

Acknowledgements

Liang Chen
thexyz
dreadlyei

Fire30 also notes, to quote: This implementation will not work on the vita as it uses a different memory allocator. In fact I am using the same exploit that is used in https://github.com/Hykem/vitasploit for 3.36, so that is the farthest this vulnerability will go.

Thanks to CnCore for the tip in the PSXHAX.COM Shoutbox! :D

CVE-2014-1303.jpg
 

Comments

Fimo

Senior Member
Contributor
Open the webkit..
Open the ofw...
Open the hdd...
Create the cfw...
Great ......
Jailbreak...
Bingo....
You're forgeting the most important part, the kernel exploit ! max 2.03 OFW for dlclose exploit and max 2.xx for the 80% completed badiret expoit.
 

mcmrc1

Senior Member
Contributor
Verified
and i think first we need keys to create a cfw and decrypt files and so one...

without keys no cfw if iam not wrong
 

Fimo

Senior Member
Contributor
What about 2.57 ?
- Badiret patch released on FreeBSD 9 (Orbis) = 2015-08-25
- 2.57 = Jully 2015
A JB may come soon for 2.03 with the dlclose exploit with the help of FIRE30.

A POC has been posted on twitter of POC 3.50 webkit exploit (twit deleted). With a Badiret exploit, there is still hope for a 2.57 (even 3.00 ?) Jailbreak.
 
Recent Articles
IG Tools: Insomniac Games Reversing and Modding PS4 Tools
Following recent Spiderman PS4 Decryption and PS4 Remote Play Protocol Reverse-Engineering development comes IG Tools this weekend by doesthisusername, which are a collection of Kaitai Struct /...
FFVII Dreamake: Final Fantasy 7 Remake in Dreams by Sosetsuken5360
Last month we saw a Metal Gear Solid HD Remake playable in Dreams on PS4, and this weekend another noteworthy creation dubbed FFVII Dreamake (a fan-made Final Fantasy 7 Remake) by Sosetsuken5360...
PlayStation Store Flash Sale Offers Up to 75% Off PSN Games
Summer is heating up with record high temperatures and some hot PSN deals on select PlayStation Store titles featuring PS4, PS3 and PS Vita games in the mix! ☀ 🔥 🥵 🍹 Below is the full lineup of...
The Diamond Casino & Resort Hits GTA Online on PS4 July 23rd
Proceeding the opening of the GTA Online PS4 After Hours Nightclub and GTA V PS4 Glitches discovered, today RockStar announced that the Diamond Casino & Resort grand opening will be on July 23rd...
Top