Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)

• Exploit Database
• 94 阅读

• 作者： TJ Corley
  日期： 2016-09-06
• 类别：

  • local
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/44199/

• PS4 3.55 Unsigned Code Execution
  ==============
  This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. <br />
  This Exploit, is based-off [Henkaku's](https://henkaku.xyz/) WebKit Vulnerability for the Sony's PSVita. <br />
  It includes basic ROP and is able to return to normal execution. <br />
  
  Pre-Requisites:
  ==============
  1. A PC
  1. Running Windows, macOS or Linux
  2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload
  3. [Python](https://www.python.org/downloads/) 2.7.X
  * Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7
  2. A Sony PlayStation 4
  1. Running the following firmwares:
  * 3.15, 3.50 or 3.55
  3. Internet Connection (PS4 and PC directly wired to the Router is the mostly preferred option)
  
  Usage:
  ==============
  There are two different methods to execute the Exploit, but first let's clarify how we will know which one to use. <br />
  If your PlayStation 4 has got an already set-up PlayStation Network Account on it, you should use method 1. <br />
  Else, if your PlayStation 4 -NEVER- had a PlayStation Network Account on it, you should use method 2. <br />
  Probably you will ask why, it's pretty much easy to explain and understand: <br />
  When you buy a PS4, comes unactivated, meaning that nobody has entered SEN Account on it. (Method 2) <br />
  Once you use a SEN Account on it, the PS4 becomes an activated console. (Method 1) <br />
  This doesn't affect the actual payload, but you should take in mind which method use. <br />
  
  Method 1:
  ==============
  Run this command on the folder you've downloaded this repo: <br />
  `python server.py` <br />
  All the debug options will be outputted during the Exploit process. <br />
  Navigate to your PS4's Web Browser and simply type on the adress bar, your PC's IP Adress. <br />
  Wait until the exploit finishes, once it does, PS4 will return to it's normal state. <br />
  An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). <br />
  
  Method 2:
  ==============
  A dns.conf file which is present on the source, needs to be edited accordingly your local PC's IP Adress. <br />
  PlayStation 4's DNS Settings must be changed in order to point the PC's IP Adress where the Exploit is located. <br />
  Once you've edited the dns.conf file, simply run the next command on the folder where you downloaded this repo: <br />
  `python fakedns.py -c dns.conf` <br />
  And then: <br />
  `python server.py` <br />
  All the debug options will be outputted during the Exploit process. <br />
  Once Python part is done, get into your PlayStation 4, navigate to the User's Guide page and wait until exploit finishes out. <br />
  An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). <br />
  
  Miscellaneous:
  ==============
  If you want to try the socket test, change the IP Address located at the bottom of the ps4sploit.html file with your computer's one and run this command: <br />
  `netcat -l 0.0.0.0 8989 -v`<br />
  You should see something like: <br />
  ```
  Listening on [0.0.0.0] (family 0, port 8989)
  Connection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)
  Hello From a PS4!
  ```
  Notes about this exploit:
  ==============
  * Currently, the exploit does not work 100%, but is around 80% which is fine for our purposes. <br />
  * Although it is confirmed to work, sometimes will fail, just wait some seconds and re-run the payload. <br />
  * Performing too much memory allocation after sort() is called, can potentially lead to more instability and it may crash more. <br />
  * The process will crash after the ROP payload is done executing. <br />
  * This is only useful for researchers. There are many many more steps needed before this becomes useful to normal users. <br />
  
  Acknowledgements
  ================
  xyz - Much of the code is based off of his code used for the Henkaku project
  Anonymous contributor - WebKit Vulnerability PoC
  CTurt - I basically copied his JuSt-ROP idea
  xerpi - Used his idea for the socket code
  rck\`d - Finding bugs such as not allocating any space for a stack on function calls
  Maxton - 3.50 support and various cleanup
  Thunder07 - 3.15 support
  
  
  Contributing
  ================
  The code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.
  
  Download:
  

  Python

  Copy