Search...

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)

2016-09-06T00:00:00

ID EDB-ID:44199
Type exploitdb
Reporter Exploit-DB
Modified 2016-09-06T00:00:00

Description

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC). Local exploit for Hardware platform

                                        
                                            PS4 3.55 Unsigned Code Execution
==============
This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. &lt;br /&gt;
This Exploit, is based-off [Henkaku's](https://henkaku.xyz/) WebKit Vulnerability for the Sony's PSVita. &lt;br /&gt;
It includes basic ROP and is able to return to normal execution. &lt;br /&gt;

Pre-Requisites:
==============
1. A PC
  1. Running Windows, macOS or Linux
  2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload
  3. [Python](https://www.python.org/downloads/) 2.7.X
    * Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7
2. A Sony PlayStation 4
  1. Running the following firmwares:
    * 3.15, 3.50 or 3.55
3. Internet Connection (PS4 and PC directly wired to the Router is the mostly preferred option)

Usage:
==============
There are two different methods to execute the Exploit, but first let's clarify how we will know which one to use. &lt;br /&gt;
If your PlayStation 4 has got an already set-up PlayStation Network Account on it, you should use method 1. &lt;br /&gt;
Else, if your PlayStation 4 -NEVER- had a PlayStation Network Account on it, you should use method 2. &lt;br /&gt;
Probably you will ask why, it's pretty much easy to explain and understand: &lt;br /&gt;
When you buy a PS4, comes unactivated, meaning that nobody has entered SEN Account on it. (Method 2) &lt;br /&gt;
Once you use a SEN Account on it, the PS4 becomes an activated console. (Method 1) &lt;br /&gt;
This doesn't affect the actual payload, but you should take in mind which method use. &lt;br /&gt;

Method 1:
==============
Run this command on the folder you've downloaded this repo: &lt;br /&gt;
`python server.py` &lt;br /&gt;
All the debug options will be outputted during the Exploit process. &lt;br /&gt;
Navigate to your PS4's Web Browser and simply type on the adress bar, your PC's IP Adress. &lt;br /&gt;
Wait until the exploit finishes, once it does, PS4 will return to it's normal state. &lt;br /&gt;
An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). &lt;br /&gt;

Method 2:
==============
A dns.conf file which is present on the source, needs to be edited accordingly your local PC's IP Adress. &lt;br /&gt;
PlayStation 4's DNS Settings must be changed in order to point the PC's IP Adress where the Exploit is located. &lt;br /&gt;
Once you've edited the dns.conf file, simply run the next command on the folder where you downloaded this repo: &lt;br /&gt;
`python fakedns.py -c dns.conf` &lt;br /&gt;
And then: &lt;br /&gt;
`python server.py` &lt;br /&gt;
All the debug options will be outputted during the Exploit process. &lt;br /&gt;
Once Python part is done, get into your PlayStation 4, navigate to the User's Guide page and wait until exploit finishes out. &lt;br /&gt;
An example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). &lt;br /&gt;

Miscellaneous:
==============
If you want to try the socket test, change the IP Address located at the bottom of the ps4sploit.html file with your computer's one and run this command: &lt;br /&gt;
`netcat -l 0.0.0.0 8989 -v`  &lt;br /&gt;
You should see something like: &lt;br /&gt;
```
Listening on [0.0.0.0] (family 0, port 8989)
Connection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)
Hello From a PS4!
```
Notes about this exploit:
==============
* Currently, the exploit does not work 100%, but is around 80% which is fine for our purposes. &lt;br /&gt;
* Although it is confirmed to work, sometimes will fail, just wait some seconds and re-run the payload. &lt;br /&gt;
* Performing too much memory allocation after sort() is called, can potentially lead to more instability and it may crash more. &lt;br /&gt;
* The process will crash after the ROP payload is done executing. &lt;br /&gt;
* This is only useful for researchers. There are many many more steps needed before this becomes useful to normal users. &lt;br /&gt;

Acknowledgements
================
xyz - Much of the code is based off of his code used for the Henkaku project  
Anonymous contributor - WebKit Vulnerability PoC  
CTurt - I basically copied his JuSt-ROP idea  
xerpi - Used his idea for the socket code  
rck\`d - Finding bugs such as not allocating any space for a stack on function calls  
Maxton - 3.50 support and various cleanup  
Thunder07 - 3.15 support


Contributing
================
The code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.

Download:

JSON Vulners Source

Initial Source

{"id": "EDB-ID:44199", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)", "description": "Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC). Local exploit for Hardware platform", "published": "2016-09-06T00:00:00", "modified": "2016-09-06T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://www.exploit-db.com/exploits/44199/", "reporter": "Exploit-DB", "references": [], "cvelist": [], "lastseen": "2018-02-28T15:20:48", "viewCount": 6, "enchantments": {"score": {"value": -0.1, "vector": "NONE", "modified": "2018-02-28T15:20:48", "rev": 2}, "dependencies": {"references": [], "modified": "2018-02-28T15:20:48", "rev": 2}, "vulnersScore": -0.1}, "sourceHref": "https://www.exploit-db.com/download/44199/", "sourceData": "PS4 3.55 Unsigned Code Execution\r\n==============\r\nThis GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. \r\nThis Exploit, is based-off [Henkaku's](https://henkaku.xyz/) WebKit Vulnerability for the Sony's PSVita. \r\nIt includes basic ROP and is able to return to normal execution. \r\n\r\nPre-Requisites:\r\n==============\r\n1. A PC\r\n 1. Running Windows, macOS or Linux\r\n 2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload\r\n 3. [Python](https://www.python.org/downloads/) 2.7.X\r\n * Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7\r\n2. A Sony PlayStation 4\r\n 1. Running the following firmwares:\r\n * 3.15, 3.50 or 3.55\r\n3. Internet Connection (PS4 and PC directly wired to the Router is the mostly preferred option)\r\n\r\nUsage:\r\n==============\r\nThere are two different methods to execute the Exploit, but first let's clarify how we will know which one to use. \r\nIf your PlayStation 4 has got an already set-up PlayStation Network Account on it, you should use method 1. \r\nElse, if your PlayStation 4 -NEVER- had a PlayStation Network Account on it, you should use method 2. \r\nProbably you will ask why, it's pretty much easy to explain and understand: \r\nWhen you buy a PS4, comes unactivated, meaning that nobody has entered SEN Account on it. (Method 2) \r\nOnce you use a SEN Account on it, the PS4 becomes an activated console. (Method 1) \r\nThis doesn't affect the actual payload, but you should take in mind which method use. \r\n\r\nMethod 1:\r\n==============\r\nRun this command on the folder you've downloaded this repo: \r\n`python server.py` \r\nAll the debug options will be outputted during the Exploit process. \r\nNavigate to your PS4's Web Browser and simply type on the adress bar, your PC's IP Adress. \r\nWait until the exploit finishes, once it does, PS4 will return to it's normal state. \r\nAn example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). \r\n\r\nMethod 2:\r\n==============\r\nA dns.conf file which is present on the source, needs to be edited accordingly your local PC's IP Adress. \r\nPlayStation 4's DNS Settings must be changed in order to point the PC's IP Adress where the Exploit is located. \r\nOnce you've edited the dns.conf file, simply run the next command on the folder where you downloaded this repo: \r\n`python fakedns.py -c dns.conf` \r\nAnd then: \r\n`python server.py` \r\nAll the debug options will be outputted during the Exploit process. \r\nOnce Python part is done, get into your PlayStation 4, navigate to the User's Guide page and wait until exploit finishes out. \r\nAn example of what will look like found [HERE](https://gist.github.com/Fire30/2e0ea2d73d3a1f6f95d80aea77b75df8). \r\n\r\nMiscellaneous:\r\n==============\r\nIf you want to try the socket test, change the IP Address located at the bottom of the ps4sploit.html file with your computer's one and run this command: \r\n`netcat -l 0.0.0.0 8989 -v` \r\nYou should see something like: \r\n```\r\nListening on [0.0.0.0] (family 0, port 8989)\r\nConnection from [192.168.1.72] port 8989 [tcp/sunwebadmins] accepted (family 2, sport 59389)\r\nHello From a PS4!\r\n```\r\nNotes about this exploit:\r\n==============\r\n* Currently, the exploit does not work 100%, but is around 80% which is fine for our purposes. \r\n* Although it is confirmed to work, sometimes will fail, just wait some seconds and re-run the payload. \r\n* Performing too much memory allocation after sort() is called, can potentially lead to more instability and it may crash more. \r\n* The process will crash after the ROP payload is done executing. \r\n* This is only useful for researchers. There are many many more steps needed before this becomes useful to normal users. \r\n\r\nAcknowledgements\r\n================\r\nxyz - Much of the code is based off of his code used for the Henkaku project \r\nAnonymous contributor - WebKit Vulnerability PoC \r\nCTurt - I basically copied his JuSt-ROP idea \r\nxerpi - Used his idea for the socket code \r\nrck\\`d - Finding bugs such as not allocating any space for a stack on function calls \r\nMaxton - 3.50 support and various cleanup \r\nThunder07 - 3.15 support\r\n\r\n\r\nContributing\r\n================\r\nThe code currently is a bit of a mess, so if you have any improvements feel free to send a pull request or make an issue. Also I am perfectly fine if you want to fork and create your own project.\r\n\r\nDownload:", "osvdbidlist": [], "immutableFields": []}

Sony Playstation 4 (PS4) 3.15 &lt; 3.55 - WebKit Code Execution (PoC)

Description

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC). Local exploit for Hardware platform

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)