Category PS4 Jailbreaking       Thread starter Foe       Start date Oct 9, 2016 at 11:36 PM       13,307       35            
Status
Not open for further replies.
All day PS4 dev @ryan111 (PS4Work Blog updates from him HERE and HERE) has been working on a PlayStation 4 4.0 jailbreak, and has come across a "command" in the web browser about: that gives you info about it.

Which reads:
Code:
AppVersion 5.0 (Playstation 4 4.00) AppleWebKit/537.78 (KHTML, like Gecko)
UserAgent Mozilla/5.0 (Playstation 4 4.0) AppleWebKit/537.78 (KHTML, like Gecko)
Language en-US
OnLine true
Now i did some research on this and this is what i came up with.

https://user-agents.me/useragent/mozilla50-macintosh-intel-mac-os-x-10_9_4-applewebkit537782-khtml-like-gecko-version706-safari537782

Which is about the WebKit and:

https://www.cvedetails.com/vulnerability-list/vendor_id-452/product_id-3264/version_id-112576/Mozilla-Firefox-5.0.html

Which are vulnerabilities for Mozilla 5.0.

Now im not sure if this has already been found but this is the first of me hearing it. Wanted to post this for people so they could know devs are working on a 4.0 JB and never give up hope.

Finally, below are some related Tweets from PlayStation 4 developer CTurt and the ReadMe file from the work-in-progress PS4 Playground 4.00 GIT via darkslake, to quote:

PS4 4.00 Unsigned Code Execution

This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50, 3.55 and 4.00-exploit-ps4.
This Exploit, is based-off Henkaku's WebKit Vulnerability for the Sony's PSVita. It includes basic ROP and is able to return to normal execution.

Pre-Requisites:
  1. A PC
    1. Running Windows, macOS or Linux
    2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload
    3. Python 2.7.X
      • Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7
  2. A Sony PlayStation 4
    1. Running the following firmwares:
      • 4.00
  3. Internet Connection (PS4 and PC directly wired to the Router is the mostly preferred option)
Usage:

There are two different methods to execute the Exploit, but first let's clarify how we will know which one to use. If your PlayStation 4 has got an already set-up PlayStation Network Account on it, you should use method 1.

Else, if your PlayStation 4 -NEVER- had a PlayStation Network Account on it, you should use method 2. Probably you will ask why, it's pretty much easy to explain and understand:

When you buy a PS4, comes unactivated, meaning that nobody has entered SEN Account on it. (Method 2) Once you use a SEN Account on it, the PS4 becomes an activated console. (Method 1) This doesn't affect the actual payload, but you should take in mind which method use.

Method 1:

Run this command on the folder you've downloaded this repo:
Code:
python server.py
All the debug options will be outputted during the Exploit process. Navigate to your PS4's Web Browser and simply type on the adress bar, your PC's IP Adress. Wait until the exploit finishes, once it does, PS4 will return to it's normal state. An example of what will look like found HERE.

Method 2:

A dns.conf file which is present on the source, needs to be edited accordingly your local PC's IP Address. PlayStation 4's DNS Settings must be changed in order to point the PC's IP Address where the Exploit is located. Once you've edited the dns.conf file, simply run the next command on the folder where you downloaded this repo:
Code:
python fakedns.py -c dns.conf
And then:
Code:
python server.py
All the debug options will be outputted during the Exploit process. Once Python part is done, get into your PlayStation 4, navigate to the User's Guide page and wait until exploit finishes out. An example of what will look like found HERE.

Miscellaneous:

If you want to try the socket test, change the IP Address located at the bottom of the ps4sploit.html file with your computer's one and run this command:
Code:
netcat -l 0.0.0.0 8989 -v
You should see something like:
Code:
Listening on [0.0.0.0] (family 0, port 8989)
Connection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)
Hello From a PS4!
Notes about this exploit:
  • Currently, the exploit does not work 100%, but is around 80% which is fine for our purposes.
  • Although it is confirmed to work, sometimes will fail, just wait some seconds and re-run the payload.
  • Performing too much memory allocation after sort() is called, can potentially lead to more instability and it may crash more.
  • The process will crash after the ROP payload is done executing.
  • This is only useful for researchers. There are many many more steps needed before this becomes useful to normal users.
Acknowledgements

xyz - Much of the code is based off of his code used for the Henkaku project
Anonymous contributor - WebKit Vulnerability PoC
CTurt - I basically copied his JuSt-ROP idea
xerpi - Used his idea for the socket code
rck`d - Finding bugs such as not allocating any space for a stack on function calls
Maxton - 3.50 support and various cleanup
Thunder07 - 3.15 support darkslake - 4.00 support and various cleanup

Contributing

The code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.

final-4.00-exploit-ps4
Ryan111 PlayStation 4 4.00 WebKit Development Update.jpg
 

Comments

Status
Not open for further replies.

PSXHAX

Staff Member
Moderator
Contributor
Verified
For your first article (that wasn't just news from Sony's blog like I so often post about :p) you did fine @Carnavs, as you write more articles you'll develop your own style of writing. :)

Over the last week @ryan111 has been sharing a lot more details with me in PM's, so I have a feeling we'll be hearing more soon... and maybe he'll (hopefully, eventually) update his blog (hint, hint) :D
 

PSXHAX

Staff Member
Moderator
Contributor
Verified
this is literally nothing ? Does it deserve to be on news section really ?
I think he's letting people on 4.00 know work still is being done with it, even though some Devs updated to 4.01 when a WebKit bug was found present in 4.01.

Here is a brief summary of some things @ryan111 did in recent weeks on his PlayStation 4 v4.00 setup:
  • FTP working on PS4 4.00
  • Runtime for PS4 4.00
  • Javascript code executing
  • Linux commands running through browser via HTML and webserver
  • Set up PHP webserver to execute the code
  • Access to different TMP directories via FileManager
  • FTP connected via OpenRoadFTP
  • Extracted the kernel from FreeBSD
  • Unpacked .KO files from kernel folder
  • Access to some browser commands
I think he plans to share the related file downloads at some point, and since sharing is caring that's always nice to hear ;)

:idea: Another great source for PS4 development news @VultraAID posted a few weeks ago in the Shoutbox, it's a good idea to check HERE for PS4 GIT updates often.

For example, I see a new set of experiments for the PS4's WebKit from Uint32Array that was committed in the last 24 hours... will definitely keep an eye on that to see what happens. :geek:
 
Status
Not open for further replies.
Recent Articles
PS5 DualShock 5 (DS5) Controller Images Surface in Japanese Patent
Following Sony's New Controller Patent, PS5 Devkit Prototype Leak and recent PS5 Transition Update in preparation for the PlayStation 5 2020 Launch today some PS5 DualShock 5 (DS5) Controller...
PlayStation Black Friday & Cyber Monday 2019 Deals Revealed!
We've seen the 2019 Black Friday Ad Scans featuring a $199 PS4 Bundle with 3 Games or PSVR Bundle with 5 Games and today Sony revealed their official PlayStation Black Friday & Cyber Monday 2019...
PSPlay: PS4 Remote Play App for Android Devices by Grill2010
Hi, In case someone is interested, after PSJoy which I've released one year ago and following my RemotePlayPrototype open source research project I have developed a new Android app called PSPlay...
PS4 Open-world RPG Shenmue III Joins New Games Next Week
Next week Yu Suzuki's open-world RPG series returns in the legendary Shenmue III on PS4 among the new video game releases! šŸ•¹ PlayStation 4 fans can catch up with Ryo Hazuki in his ongoing quest...
Top