Hacking PS4 6.70 Research

[benaam433]

Thanks for sharing such a piece of useful information. It increased my knowledge a lot.

 

[wrsg]

https://github.com/gut5/cfw-writeups

 

[IndieDeveloper]

@KiiWii
You seem to me the best and very prepared. I did this thought.
An updated payload that applies the right patches to access the debug menu of system and escape sandbox should make the "0day" exploit work

 

[IndieDeveloper]

What do you think

 

[KiiWii]

What do you think

It’s all well and good saying “updated”, but how you gonna do dat?

First you need to find a “STABLE” web->userland->kernel exploit chain for your chosen firmware, craft ROP/gadgets, dump kernel, finally then you can use this to find the offsets to port existing payloads (debug or hen etc) to work on the firmware you have kernel access to.

It’s so simple to say, or ask for. But without relevant skill set it’s very difficult to implement.

 

[IndieDeveloper]

It’s all well and good saying “updated”, but how you gonna do dat?

First you need to find a “STABLE” web->userland->kernel exploit chain for your chosen firmware, craft ROP/gadgets, dump kernel, finally then you can use this to find the offsets to port existing payloads (debug or hen etc) to work on the firmware you have kernel access to.

It’s so simple to say, or ask for. But without relevant skill set it’s very difficult to implement.

thank you for your opinion. I don't want to imply it's easy, absolutely not. I wanted to know your opinion on this, instead of finding a new kernel exploit since in theory I thought that the existing one should work.
To find the necessary offsets you need kernel access, The chain always breaks without a kernel exploit on chosen firmware.
What I was thinking is to take advantage of the current kernel exploit, which should also work on newer firmware ( 6.XX -7.XX ?? ). Potentially there are many webkit exploits with userland access with ready-made ROPs, the problem would be the kernel exploit.
There must be a secondary road to update payload offsets for access to the system's debug menu, otherwise you are point and head

 

[KiiWii]

thank you for your opinion. I don't want to imply it's easy, absolutely not. I wanted to know your opinion on this, instead of finding a new kernel exploit since in theory I thought that the existing one should work.
To find the necessary offsets you need kernel access, The chain always breaks without a kernel exploit on chosen firmware.
What I was thinking is to take advantage of the current kernel exploit, which should also work on newer firmware ( 6.XX -7.XX ?? ). Potentially there are many webkit exploits with userland access with ready-made ROPs, the problem would be the kernel exploit.
There must be a secondary road to update payload offsets for access to the system's debug menu, otherwise you are point and head

The current (5.05) kex won’t work on >5.50.

ROP is bespoke afaik. I don’t think there can be “pre made” ROP that will magically work on PS4s environment, even if it is FBSD based.

I have heard there is a 0day USB based exploit for dumping apps and kernel, but I don’t know how far along it is or how high it functions on.

Offsets are pretty important, otherwise you would be blindly poking around hoping to hit a needle in a haystack. We have a dumped decrypted kernel for 7.xx, but even if you did port offsets using this, we have no public exploit to implement these ported payloads, even for testing.

It’s a chicken or egg scenario.

 

[IndieDeveloper]

The current (5.05) kex won’t work on >5.50.

ROP is bespoke afaik. I don’t think there can be “pre made” ROP that will magically work on PS4s environment, even if it is FBSD based.

I have heard there is a 0day USB based exploit for dumping apps and kernel, but I don’t know how far along it is or how high it functions on.

Offsets are pretty important, otherwise you would be blindly poking around hoping to hit a needle in a haystack. We have a dumped decrypted kernel for 7.xx, but even if you did port offsets using this, we have no public exploit to implement these ported payloads, even for testing.

It’s a chicken or egg scenario.

Very lucid explanation, some interesting information.
I will continue my research thanks @KiiWii

 

[schatzi24]

I will also search a PS4 with firmware 6.70 and i like the PS4 PRO Death Stranding in white and black.
Have this console a firmware under 7.02?

 

[RiPPERD]

well now the whole world is on lockdown... maybe something big will happen in the ps4 scene? that would be good lol

 

[KiiWii]

If people have time off: perhaps focus your boredom into learning how to code/exploit and start pushing the PS4 scene forward through homebrew and more.

Don’t join the ETA Wen army.

 

[RiPPERD]

lol yeah i tried helping the scene last year after some time out... got nothing but abuse so sacked it off

 

[chrisrlink]

Watch M0rph3us1987’s talk on PS4.

Sploit dem apps.

they still work? i'm supprised

 

[KiiWii]

they still work? i'm supprised

He recently said it should work with an updated exploit (as the apps use updated web kits) ... now thefl0w has a sploit.

 

[RY0M43CH1Z3N]

Hi to all,

So where am i ?

i try to get the 6.70 Webkit cause since the begin i work with the 6.50 or 7.00.

Since i don't have any interrest in 6.50 cause i don't own one i let you my research i made with this .

Thanks to liveoverflow for his exelent series on it.

it seems like it was patch in the 6.70, so if you have an adress other than : "[*] 0x7ff8000000000000" it should work .


Thanks you for the support and see y'a all.

Hello, i have a 6.50 PS4 to test things if you want me to try anything.

 

[RiPPERD]

@OP

have you seen this... not sure if its gong to help much

https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit

 

[RY0M43CH1Z3N]

Here i investigate something, this one from C0rpVultra works in 6.XX patched

@OP

have you seen this... not sure if its gong to help much

https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit

I think he can't try with it because he is in 6.70.

The only webkit public **i think** is bad hoist and he can test with it.

 

[ryuutseku85]

Hi to all,
The last time was not à good time for me... I have some infected person in my family and got it myself... Just getting à little better those Day but cant get my head clear enought time to do something...
See ya

 

[RY0M43CH1Z3N]

Don't worry @ryuutseku85 I wish your family are good

 

[TR_mahmutpek]

Hi to all,
The last time was not à good time for me... I have some infected person in my family and got it myself... Just getting à little better those Day but cant get my head clear enought time to do something...
See ya

I hope all of you will be ok soon.