cryptogenic/ps5-ipv6-kernel-exploitAn experimental webkit-based kernel exploit (Arb. R/W) for the PS5 on <= 4.51FW
This repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on TheFlow's IPV6 Use-After-Free (UAF), which was reported on HackerOne. The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to accommodate the annoying PS5 memory layout (for more see Research Notes section). It establishes an arbitrary read / (semi-arbitrary) write primitive. This exploit and its capabilities have a lot of limitations, and as such, it's mostly intended for developers to play with to reverse engineer some parts of the system.
With latest stability improvements, reliability is at about 80%. This document will contain research info about the PS5, and this exploit will undergo continued development and improvements as time goes on.
Those interested in contributing to PS5 research/dev can join a discord I have setup here.
Exploit should now support the following firmwares:
dns.conf to point manuals.playstation.net to your PCs IP addresspython fakedns.py -c dns.confpython host.py0.0.0.0
To use the ELF loader, run the exploit until completion. Upon completion it'll run a server on port :9020. Connect and send your ELF to the PS5 over that port and it'll run it. Assuming the ELF doesn't crash the browser, it can continue to run ELFs forever.
This exploit works in 5 stages, and for the most part follows the same exploit strategy as theflow's poc.
ip6_pktopts and get two sockets to point to the same pktopts / overlap (master socket <-> overlap spray socket)pktopts on the master socket and fake it with an ip6_rthdr spray containing a tagged tclass overlap.pktopts/rthdr overlap to leak a kqueue from the 0x200 slab and pktopts from the 0x100 slab.pktopts again and find the overlap socket to use IPV6_RTHDR as a read/write primitive.Stability for this exploit is at about 30% 80-90%, and has two potential points of failure. In order of observed descending liklihood:
It appears based on various testing and dumping with the read primitive, that the PS5 has reverted back to 0x1000 page size compared to the PS4's 0x4000.
It also seems on PS5 that adjacent pages rarely belong to the same slab, as you'll get vastly different data in adjacent pages. Memory layout seems more scattered.
Often when the PS5 panics (at least in webkit context), there will be awful audio output as the audio buffer gets corrupted in some way.
Sometimes this audio corruption persists to the next boot, unsure why.
Similar to PS4, the PS5 will require the power button to be manually pressed on the console twice to restart after a panic.
It is normal for the PS5 to take an absurd amount of time to reboot from a panic if it's isolated from the internet (unfortunately). Expect boot to take 3-4 minutes.