Vulnerabilities: Difference between revisions
Cfwprophet (talk | contribs) (→Kaku) |
Cfwprophet (talk | contribs) |
||
| Line 13: | Line 13: | ||
== Kernel Sploits == | == Kernel Sploits == | ||
=== DynamicalLibraryPepareClose (dlclose) === | |||
==== Analysis ==== | |||
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by '''CTurt''' with the help of '''qwertyoruiop''')] | |||
==== | ==== Source ==== | ||
[https://github.com/kR105/PS4-dlclose Public release by '''kR105'''] | |||
==== Patched ==== | |||
'''Yes''' around FW 2.00 | |||
=== BadIntegerReturn (badIRET) === | |||
==== Analysis ==== | |||
[http://cturt.github.io/ps4-3.html Hacking the PS4, part 3 - Kernel exploitation (by '''CTurt''')] | |||
==== Source ==== | |||
[http://seclists.org/oss-sec/2015/q3/66 CVE-2014-9322] | |||
<br/>[http://www.filedropper.com/ps4-bad-iret-5fs Public binary] | |||
==== Patched ==== | |||
'''Yes''' around FW 2.00? (do work on 1.76) | |||
== First Steps == | == First Steps == | ||
Revision as of 02:10, 28 September 2016
WebKit
Int32 bug
WebKit/536.26 exploit on System Firmware 1.760.000 and lower (patched in 2.000.000)
http://wololo.net/2014/10/24/webkit-exploit-confirmed-to-run-on-ps4-firmware-1-76/
CVE 2014-1303
WebKit/537.73 exploit on System Firmware 2.040.000 and lower (patched in 2.508.000)
https://github.com/Fire30/PS4-2014-1303-POC
FireKaku
WebKit/??? exploit on System Firmware 3.550.000 and lower (patched in 4.000.000)
https://github.com/Fire30/PS4-3.55-Code-Execution-PoC
Kernel Sploits
DynamicalLibraryPepareClose (dlclose)
Analysis
Source
Patched
Yes around FW 2.00
BadIntegerReturn (badIRET)
Analysis
Hacking the PS4, part 3 - Kernel exploitation (by CTurt)
Source
Patched
Yes around FW 2.00? (do work on 1.76)
First Steps
VidNow
A possible exploit has been found in VidNow App in the Playstation Store App .
PATCHED: Sony has hotfixed this exploit via content hashing the file while in transit.
UPDATE: Some have managed to reverse the hotfix but the method is not known - the PS4 checks the content
hash HTTP header from the HMAC header.
SnagFilms
A possible exploit has been found in the SnagFilms App in the Playstation Store App.
Arbitrary code execution in memory has been demonstrated, although so far the system will throw an exception in the programs memory before the payload finishes loading.
If you craft a small enough payload and/or a payload that load's without causing an exception in program memory you can most likely get code execution working.
http://i.imgur.com/5OrSFCa.jpg
| |||||||||||||||||||||||||||||||||||||||||||||
