ID

VAR-E-201609-0007

EDB ID

44199

TITLE

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC) - Hardware local Exploit

DESCRIPTION

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC).. local exploit for Hardware platform

AFFECTED PRODUCTS

EXPLOIT

PS4 3.55 Unsigned Code Execution
==============
This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. <br />
This Exploit, is based-off [Henkaku's](https://henkaku.xyz/) WebKit Vulnerability for the Sony's PSVita. <br />
It includes basic ROP and is able to return to normal execution. <br />

Pre-Requisites:
==============
1. A PC
1. Running Windows, macOS or Linux
2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload
3. [Python](https://www.python.org/downloads/) 2.7.X
* Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7
2. A Sony PlayStation 4
1. Running the following firmwares:
* 3.15, 3.50 or 3.55
3. Internet Connection (PS4 and PC directly wired to the Router is the mostly preferred option)

Usage:
==============
There are two different methods to execute the Exploit, but first let's clarify how we will know which one to use. <br />
If your PlayStation 4 has got an already set-up PlayStation Network Account on it, you should use method 1. <br />
Else, if your PlayStation 4 -NEVER- had a PlayStation Network Account on it, you should use method 2. <br />
Probably you will ask why, it's pretty much easy to explain and understand: <br />
When you buy a PS4, comes unactivated, meaning that nobody has entered SEN Account on it. (Method 2) <br />
Once you use a SEN Account on it, the PS4 becomes an activated console. (Method 1) <br />
This doesn't affect the actual payload, but you should take in mind which method use. <br />

Method 1:
==============
Run this command on the folder you've downloaded this repo: <br />
`python server.py` <br />
All the debug options will be outputted during the Exploit process. <br />
Navigate to your PS4's Web Browser and simply type on the adress bar, your PC's IP Adress. <br />
Wait until the exploit finishes, once it does, PS4 will return to it's normal state. <br />
An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). <br />

Method 2:
==============
A dns.conf file which is present on the source, needs to be edited accordingly your local PC's IP Adress. <br />
PlayStation 4's DNS Settings must be changed in order to point the PC's IP Adress where the Exploit is located. <br />
Once you've edited the dns.conf file, simply run the next command on the folder where you downloaded this repo: <br />
`python fakedns.py -c dns.conf` <br />
And then: <br />
`python server.py` <br />
All the debug options will be outputted during the Exploit process. <br />
Once Python part is done, get into your PlayStation 4, navigate to the User's Guide page and wait until exploit finishes out. <br />
An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). <br />

Miscellaneous:
==============
If you want to try the socket test, change the IP Address located at the bottom of the ps4sploit.html file with your computer's one and run this command: <br />
`netcat -l 0.0.0.0 8989 -v` <br />
You should see something like: <br />
```
Listening on [0.0.0.0] (family 0, port 8989)
Connection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)
Hello From a PS4!
```
Notes about this exploit:
==============
* Currently, the exploit does not work 100%, but is around 80% which is fine for our purposes. <br />
* Although it is confirmed to work, sometimes will fail, just wait some seconds and re-run the payload. <br />
* Performing too much memory allocation after sort() is called, can potentially lead to more instability and it may crash more. <br />
* The process will crash after the ROP payload is done executing. <br />
* This is only useful for researchers. There are many many more steps needed before this becomes useful to normal users. <br />

Acknowledgements
================
xyz - Much of the code is based off of his code used for the Henkaku project
Anonymous contributor - WebKit Vulnerability PoC
CTurt - I basically copied his JuSt-ROP idea
xerpi - Used his idea for the socket code
rck\`d - Finding bugs such as not allocating any space for a stack on function calls
Maxton - 3.50 support and various cleanup
Thunder07 - 3.15 support

Contributing
================
The code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.

Download:

EXPLOIT LANGUAGE

md

PRICE

free

TYPE

WebKit Code Execution (PoC)

TAGS

CREDITS

TJ Corley

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2022-07-27T09:51:47.980000+00:00

SOURCES RELEASE DATE