Skip to content

Commit ec3466a

Browse files
SoftwareRatSoftwareRat
committed
Merge commit 'cf6ffc92505f67fc6d4a16f2dcc2a0456fb6c1ab' as 'stage1'
2 parents 428fde1 + cf6ffc9 commit ec3466a

File tree

20 files changed

+3426
-0
lines changed

20 files changed

+3426
-0
lines changed

‎stage1/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
__pycache__/
2+
*.o
3+
*.elf
4+
*.bin

‎stage1/.gitmodules‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "freebsd-headers"]
2+
path = freebsd-headers
3+
url = https://github.com/OpenOrbis/freebsd-headers

‎stage1/Dockerfile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM --platform=amd64 ubuntu:latest
2+
ARG PS4FWVER=1100
3+
RUN apt update && apt install -y build-essential
4+
RUN mkdir /build
5+
COPY . ./build
6+
WORKDIR /build
7+
RUN mkdir /output
8+
RUN make -C stage1 FW=$PS4FWVER clean && make -C stage1 FW=$PS4FWVER && cp stage1/stage1.bin /output
9+
RUN make -C stage2 FW=$PS4FWVER clean && make -C stage2 FW=$PS4FWVER && cp stage2/stage2.bin /output
10+
ENTRYPOINT ["/bin/sh", "-c", "cp -Rvr /output/* /host"]

‎stage1/LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (C) 2024 Andy Nguyen
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎stage1/README.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# PPPwn - PlayStation 4 PPPoE RCE
2+
PPPwn is a kernel remote code execution exploit for PlayStation 4 up to FW 11.00. This is a proof-of-concept exploit for [CVE-2006-4304](https://hackerone.com/reports/2177925) that was reported responsibly to PlayStation.
3+
4+
Supported versions are:
5+
- FW 7.00 / 7.01 / 7.02
6+
- FW 7.50 / 7.51 / 7.55
7+
- FW 8.00 / 8.01 / 8.03
8+
- FW 8.50 / 8.52
9+
- FW 9.00
10+
- FW 9.03 / 9.04
11+
- FW 9.50 / 9.51 / 9.60
12+
- FW 10.00 / 10.01
13+
- FW 10.50 / 10.70 / 10.71
14+
- FW 11.00
15+
- more can be added (PRs are welcome)
16+
17+
The exploit only prints `PPPwned` on your PS4 as a proof-of-concept. In order to launch Mira or similar homebrew enablers, the `stage2.bin` payload needs to be adapted.
18+
19+
## Requirements
20+
- A computer with an Ethernet port
21+
- USB adapter also works
22+
- Ethernet cable
23+
- Linux
24+
- You can use VirtualBox to create a Linux VM with `Bridged Adapter` as network adapter to use the ethernet port in the VM.
25+
- `git`, `gcc` and `make` installed
26+
- *(Optional. Not required if you only want to compile the payloads.)* `python3` and `pip` installed
27+
28+
## Usage
29+
30+
On your computer, clone the repository:
31+
32+
```sh
33+
git clone --recursive -b goldhen https://github.com/SiSTR0/PPPwn
34+
```
35+
36+
Change the directory to the cloned repository:
37+
38+
```sh
39+
cd PPPwn
40+
```
41+
42+
Compile the payloads:
43+
44+
```sh
45+
make -C stage1 FW=1100 clean && make -C stage1 FW=1100
46+
make -C stage2 FW=1100 clean && make -C stage2 FW=1100
47+
```
48+
49+
For other firmwares, e.g. FW 9.00, pass `FW=900`.
50+
51+
If you further want to run the exploit from within this repository, install the requirements:
52+
53+
```sh
54+
sudo pip install -r requirements.txt
55+
```
56+
57+
DO NOT RUN the exploit just yet (don't press Enter yet) but prepare this command on your prompt (see `ifconfig` for the correct interface):
58+
59+
```sh
60+
sudo python3 pppwn.py --interface=enp0s3 --fw=1100
61+
```
62+
63+
For other firmwares, e.g. FW 9.00, pass `--fw=900`.
64+
65+
On your PS4:
66+
67+
- Go to `Settings` and then `Network`
68+
- Select `Set Up Internet connection` and choose `Use a LAN Cable`
69+
- Choose `Custom` setup and choose `PPPoE` for `IP Address Settings`
70+
- Enter anything for `PPPoE User ID` and `PPPoE Password`
71+
- Choose `Automatic` for `DNS Settings` and `MTU Settings`
72+
- Choose `Do Not Use` for `Proxy Server`
73+
74+
- Now, simultaneously press the 'X' button on your controller on `Test Internet Connection` and 'Enter' on your keyboard (on the computer you have your Python script ready to run).
75+
76+
ALWAYS wait for the console to show the message "Cannot connect to network: (NW-31274-7)" before trying this PPPOE injection again.
77+
78+
If the exploit fails or the PS4 crashes, you can skip the internet setup and simply click on `Test Internet Connection`. Kill the `pppwn.py` script and run it again on your computer, and then click on `Test Internet Connection` on your PS4: always simultaneously.
79+
80+
81+
If the exploit works, you should see an output similar to below, and you should see `Cannot connect to network.` followed by `PPPwned` printed on your PS4, or the other way around.
82+
83+
### Example run
84+
85+
```sh
86+
[+] PPPwn - PlayStation 4 PPPoE RCE by theflow
87+
[+] args: interface=enp0s3 fw=1100 stage1=stage1/stage1.bin stage2=stage2/stage2.bin
88+
89+
[+] STAGE 0: Initialization
90+
[*] Waiting for PADI...
91+
[+] pppoe_softc: 0xffffabd634beba00
92+
[+] Target MAC: xx:xx:xx:xx:xx:xx
93+
[+] Source MAC: 07:ba:be:34:d6:ab
94+
[+] AC cookie length: 0x4e0
95+
[*] Sending PADO...
96+
[*] Waiting for PADR...
97+
[*] Sending PADS...
98+
[*] Waiting for LCP configure request...
99+
[*] Sending LCP configure ACK...
100+
[*] Sending LCP configure request...
101+
[*] Waiting for LCP configure ACK...
102+
[*] Waiting for IPCP configure request...
103+
[*] Sending IPCP configure NAK...
104+
[*] Waiting for IPCP configure request...
105+
[*] Sending IPCP configure ACK...
106+
[*] Sending IPCP configure request...
107+
[*] Waiting for IPCP configure ACK...
108+
[*] Waiting for interface to be ready...
109+
[+] Target IPv6: fe80::2d9:d1ff:febc:83e4
110+
[+] Heap grooming...done
111+
112+
[+] STAGE 1: Memory corruption
113+
[+] Pinning to CPU 0...done
114+
[*] Sending malicious LCP configure request...
115+
[*] Waiting for LCP configure request...
116+
[*] Sending LCP configure ACK...
117+
[*] Sending LCP configure request...
118+
[*] Waiting for LCP configure ACK...
119+
[*] Waiting for IPCP configure request...
120+
[*] Sending IPCP configure NAK...
121+
[*] Waiting for IPCP configure request...
122+
[*] Sending IPCP configure ACK...
123+
[*] Sending IPCP configure request...
124+
[*] Waiting for IPCP configure ACK...
125+
[+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141
126+
127+
[+] STAGE 2: KASLR defeat
128+
[*] Defeating KASLR...
129+
[+] pppoe_softc_list: 0xffffffff884de578
130+
[+] kaslr_offset: 0x3ffc000
131+
132+
[+] STAGE 3: Remote code execution
133+
[*] Sending LCP terminate request...
134+
[*] Waiting for PADI...
135+
[+] pppoe_softc: 0xffffabd634beba00
136+
[+] Target MAC: xx:xx:xx:xx:xx:xx
137+
[+] Source MAC: 97:df:ea:86:ff:ff
138+
[+] AC cookie length: 0x511
139+
[*] Sending PADO...
140+
[*] Waiting for PADR...
141+
[*] Sending PADS...
142+
[*] Triggering code execution...
143+
[*] Waiting for stage1 to resume...
144+
[*] Sending PADT...
145+
[*] Waiting for PADI...
146+
[+] pppoe_softc: 0xffffabd634be9200
147+
[+] Target MAC: xx:xx:xx:xx:xx:xx
148+
[+] AC cookie length: 0x0
149+
[*] Sending PADO...
150+
[*] Waiting for PADR...
151+
[*] Sending PADS...
152+
[*] Waiting for LCP configure request...
153+
[*] Sending LCP configure ACK...
154+
[*] Sending LCP configure request...
155+
[*] Waiting for LCP configure ACK...
156+
[*] Waiting for IPCP configure request...
157+
[*] Sending IPCP configure NAK...
158+
[*] Waiting for IPCP configure request...
159+
[*] Sending IPCP configure ACK...
160+
[*] Sending IPCP configure request...
161+
[*] Waiting for IPCP configure ACK...
162+
163+
[+] STAGE 4: Arbitrary payload execution
164+
[*] Sending stage2 payload...
165+
[+] Done!
166+
```
167+
168+
## Notes for Mac Apple Silicon Users (arm64 / aarch64)
169+
The code will not compile on Apple Silicon and requires AMD64 architecture.
170+
There is a workaround using docker which will build the bin files required.
171+
Clone this repository to your mac system, then from the repo folder run `./build-macarm.sh`. This will build the binaries for PS4 FW 1100 and place the necessary files into the correct folders. To build the binaries for a different version, i.e. 900, run the command as such: `./build-macarm.sh 900`. Once built, copy this folder structure into the Linux VM and execute as instructed above.
172+
This has been tested using VMware Fusion 13.5.1, with the VM Guest as Ubuntu 24.04, and the host machine is MacOS 14.4.1
173+
174+
## Notes for GoldHEN version
175+
This loader only supports payloads with a kernel entrypoint.
176+
177+
The custom version of stage2 first looks for the payload in the root directory of the USB drive, and if found, it is copied to the internal HDD at this path: `/data/GoldHEN/payloads/goldhen.bin`. The internal payload is then loaded and is no longer needed on the external USB drive.
178+
179+
Supported versions are:
180+
- FW 7.00 / 7.01 / 7.02 / 7.50 / 7.51 / 7.55
181+
- FW 8.00 / 8.01 / 8.03 / 8.50 / 8.52
182+
- FW 9.00 / 9.03 / 9.04 / 9.50 / 9.51 / 9.60
183+
- FW 10.00 / 10.01 / 10.50 / 10.70 / 10.71
184+
- FW 11.00

‎stage1/build-macarm.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
DESIREDVER=${1-1100}
3+
echo "Building for $DESIREDVER . To use another PS4 Firwmare Version, execute this script as so: $0 <version>"
4+
pwd=$(pwd)
5+
docker build --build-arg="PS4FWVER=$DESIREDVER" -t pppwn-docker . --platform linux/amd64
6+
docker run -v "$pwd:/host" pppwn-docker
7+
mv stage1.bin stage1
8+
mv stage2.bin stage2

‎stage1/freebsd-headers‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Subproject commit ad8cef9530ec4d7d603be0d5736c732455865345

0 commit comments

Comments
 (0)