{"id":13837647,"url":"https://github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit","last_synced_at":"2025-07-10T18:34:06.489Z","repository":{"id":60689753,"uuid":"542265087","full_name":"Cryptogenic/PS5-IPV6-Kernel-Exploit","owner":"Cryptogenic","description":"An experimental webkit-based kernel exploit (Arb. R/W) for the PS5 on \u003c= 4.51FW","archived":false,"fork":false,"pushed_at":"2024-02-07T03:26:04.000Z","size":149,"stargazers_count":857,"open_issues_count":2,"forks_count":86,"subscribers_count":40,"default_branch":"main","last_synced_at":"2024-02-17T12:34:39.516Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Cryptogenic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-27T19:53:44.000Z","updated_at":"2024-05-30T06:29:23.541Z","dependencies_parsed_at":"2024-05-30T06:44:43.625Z","dependency_job_id":null,"html_url":"https://github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS5-IPV6-Kernel-Exploit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS5-IPV6-Kernel-Exploit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS5-IPV6-Kernel-Exploit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS5-IPV6-Kernel-Exploit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Cryptogenic","download_url":"https://codeload.github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225653891,"owners_count":17502939,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T15:01:18.553Z","updated_at":"2024-11-21T00:30:54.768Z","avatar_url":"https://github.com/Cryptogenic.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"# PS5 3.xx / 4.xx Kernel Exploit\r\n---\r\n## Summary\r\nThis repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on **TheFlow's IPV6 Use-After-Free (UAF)**, which was [reported on HackerOne](https://hackerone.com/reports/1441103). The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to accommodate the annoying PS5 memory layout (for more see *Research Notes* section). It establishes an arbitrary read / (semi-arbitrary) write primitive. This exploit and its capabilities have a lot of limitations, and as such, it's mostly intended for developers to play with to reverse engineer some parts of the system.\r\n\r\nWith latest stability improvements, reliability is at about 80%. This document will contain research info about the PS5, and this exploit will undergo continued development and improvements as time goes on.\r\n\r\nThose interested in contributing to PS5 research/dev can join a discord I have setup [here](https://discord.gg/kbrzGuH3F6).\r\n\r\nExploit should now support the following firmwares:\r\n\r\n- 3.00\r\n- 3.10\r\n- 3.20\r\n- 3.21\r\n- 4.00\r\n- 4.02\r\n- 4.03\r\n- 4.50\r\n- 4.51\r\n\r\n\r\n\r\n\r\n## Currently Included\r\n\r\n- Obtains arbitrary read/write and can run a basic RPC server for reads/writes (or a dump server for large reads) (must edit your own address/port into the exploit file on lines 673-677)\r\n- Enables debug settings menu (note: you will have to fully exit settings and go back in to see it).\r\n- Gets root privileges\r\n\r\n\r\n\r\n\r\n## Limitations\r\n- This exploit achieves read/write, **but not code execution**. This is because we cannot currently dump kernel code for gadgets, as kernel .text pages are marked as eXecute Only Memory (XOM). Attempting to read kernel .text pointers will panic!\r\n- As per the above + the hypervisor (HV) enforcing kernel write protection, this exploit also **cannot install any patches or hooks into kernel space**, which means no homebrew-related code for the time being.\r\n- Clang-based fine-grained Control Flow Integrity (CFI) is present and enforced.\r\n- Supervisor Mode Access Prevention/Execution (SMAP/SMEP) cannot be disabled, due to the HV.\r\n- The write primitive is somewhat constrained, as bytes 0x10-0x14 must be zero (or a valid network interface).\r\n  - Though due to newer work using pipes, full arbitrary read/write is now possible\r\n\r\n\r\n\r\n\r\n## How to use\r\n\r\n1. Configure fakedns via `dns.conf` to point `manuals.playstation.net` to your PCs IP address\r\n2. Run fake dns: `python fakedns.py -c dns.conf`\r\n3. Run HTTPS server: `python host.py`\r\n4. Go into PS5 advanced network settings and set primary DNS to your PCs IP address and leave secondary at `0.0.0.0`\r\n   1. Sometimes the manual still won't load and a restart is needed, unsure why it's really weird\r\n5. Go to user manual in settings and accept untrusted certificate prompt, run\r\n6. Optional: Run rpc/dump server scripts (note: address/port must be substituted in binary form into exploit.js).\r\n\r\n\r\n\r\n## Future work\r\n- [x] ~~Fix-up sockets to exit browser cleanly (top prio)~~\r\n- [x] ~~Write some data patches (second prio)~~\r\n  - [x] ~~Enable debug settings~~\r\n  - [x] ~~Patch creds for uid0~~\r\n  - [x] ~~Jailbreak w/ cr_prison overwrite~~\r\n- [x] ~~Improve UAF reliability~~\r\n- [x] ~~Improve victim socket reliability (third prio)~~\r\n- [x] ~~Use a better / more consistent leak target than kqueue~~ (no longer necessary)\r\n- [x] Make ELF loader support relocations\r\n  - [ ] Add support for more relocations and possibly full dynamic linkage?\r\n\r\n\r\n\r\n\r\n## Using ELF Loader\r\n\r\nTo use the ELF loader, run the exploit until completion. Upon completion it'll run a server on port `:9020`. Connect and send your ELF to the PS5 over that port and it'll run it. Assuming the ELF doesn't crash the browser, it can continue to run ELFs forever.\r\n\r\n\r\n\r\n## Exploit Stages\r\nThis exploit works in 5 stages, and for the most part follows the same exploit strategy as theflow's poc.\r\n1) Trigger the initial UAF on `ip6_pktopts` and get two sockets to point to the same `pktopts` / overlap (master socket \u003c-\u003e overlap spray socket)\r\n2) Free the `pktopts` on the master socket and fake it with an `ip6_rthdr` spray containing a tagged `tclass` overlap.\r\n3) Infoleak step. Use `pktopts`/`rthdr` overlap to leak a kqueue from the 0x200 slab and `pktopts` from the 0x100 slab.\r\n4) Arbitrary read/write step. Fake `pktopts` again and find the overlap socket to use `IPV6_RTHDR` as a read/write primitive.\r\n4) Cleanup + patch step. Increase refcount on corrupted sockets for successful browser exit + patch data to enable debug menu and patch ucreds for uid0.\r\n4) Run ELF loader server that will accept and load/run ELFs. Currently WIP, does not support relocations at the moment.\r\n\r\n\r\n\r\n## Stability Notes\r\nStability for this exploit is at about ~~30%~~ 80-90%, and has two potential points of failure. In order of observed descending liklihood:\r\n1) *Stage 1* fails to reclaim the UAF, causing immediate crash or latent corruption that causes crash.\r\n2) *Stage 4* fails to find a victim socket\r\n\r\n\r\n\r\n## Research Notes\r\n- ~~It appears based on various testing and dumping with the read primitive, that the PS5 has reverted back to 0x1000 page size compared to the PS4's 0x4000.~~\r\n  - After further research, the page size is indeed still 0x4000, however due to some insane allocator changes, different slabs can be allocated in the same virtual page.\r\n\r\n- It also seems on PS5 that adjacent pages rarely belong to the same slab, as you'll get vastly different data in adjacent pages. Memory layout seems more scattered.\r\n- Often when the PS5 panics (at least in webkit context), there will be awful audio output as the audio buffer gets corrupted in some way.\r\n- Sometimes this audio corruption persists to the next boot, unsure why.\r\n- Similar to PS4, the PS5 will require the power button to be manually pressed on the console twice to restart after a panic.\r\n- It is normal for the PS5 to take an absurd amount of time to reboot from a panic if it's isolated from the internet (unfortunately). Expect boot to take 3-4 minutes.\r\n\r\n\r\n\r\n## Contributors / Special Thanks\r\n- [Andy Nguyen / theflow0](https://twitter.com/theflow0) - Vulnerability and exploit strategy\r\n- [ChendoChap](https://github.com/ChendoChap) - Various help with testing and research\r\n- [Znullptr](https://twitter.com/Znullptr) - Research/RE\r\n- [sleirsgoevy](https://twitter.com/sleirsgoevy) - Research/RE + exploit strat ideas\r\n- [bigboss](https://twitter.com/psxdev) - Research/RE\r\n- [flatz](https://twitter.com/flat_z) - Research/RE + help w/ patches\r\n- [zecoxao](https://twitter.com/notzecoxao) - Research/RE\r\n- [SocracticBliss](https://twitter.com/SocraticBliss) - Research/RE\r\n- laureeeeeee - Background low-level systems knowledge and assistance\r\n\r\n\r\n\r\n## Thanks to testers\r\n\r\n- Dizz (4.50/4.51)\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCryptogenic%2FPS5-IPV6-Kernel-Exploit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCryptogenic%2FPS5-IPV6-Kernel-Exploit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCryptogenic%2FPS5-IPV6-Kernel-Exploit/lists"}