Vulnerabilities: Difference between revisions
Cfwprophet (talk | contribs) |
No edit summary |
||
| Line 1: | Line 1: | ||
== WebKit == | == WebKit/Userland Exploits == | ||
=== Int32 bug === | |||
[[Internet_Browser#Webkit_exploit|WebKit/536.26 exploit]] on [[System Firmware]] [[1.760.000]] and lower '''(patched in [[2.000.000]])''' | [[Internet_Browser#Webkit_exploit|WebKit/536.26 exploit]] on [[System Firmware]] [[1.760.000]] and lower '''(patched in [[2.000.000]])''' | ||
<br/>http://wololo.net/2014/10/24/webkit-exploit-confirmed-to-run-on-ps4-firmware-1-76/ | <br/>http://wololo.net/2014/10/24/webkit-exploit-confirmed-to-run-on-ps4-firmware-1-76/ | ||
=== CVE 2014-1303 === | |||
[[Internet_Browser#Webkit_exploit|WebKit/537.73 exploit]] on [[System Firmware]] [[2.040.000]] and lower '''(patched in [[2.508.000]])''' | [[Internet_Browser#Webkit_exploit|WebKit/537.73 exploit]] on [[System Firmware]] [[2.040.000]] and lower '''(patched in [[2.508.000]])''' | ||
<br/>https://github.com/Fire30/PS4-2014-1303-POC | <br/>https://github.com/Fire30/PS4-2014-1303-POC | ||
=== FireKaku === | |||
[[Internet_Browser#Webkit_exploit|WebKit/??? exploit]] on [[System Firmware]] [[3.550.000]] and lower '''(patched in [[4.000.000]])''' | [[Internet_Browser#Webkit_exploit|WebKit/??? exploit]] on [[System Firmware]] [[3.550.000]] and lower '''(patched in [[4.000.000]])''' | ||
<br/>https://github.com/Fire30/PS4-3.55-Code-Execution-PoC | <br/>https://github.com/Fire30/PS4-3.55-Code-Execution-PoC | ||
== Kernel | |||
=== | |||
=== Additional Information === | |||
On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution. | |||
== Kernel Exploits == | |||
=== Dynamic Library Prepare Close (dlclose) === | |||
==== Analysis ==== | ==== Analysis ==== | ||
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by '''CTurt''' with the help of '''qwertyoruiop''')] | [http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by '''CTurt''' with the help of '''qwertyoruiop''')] | ||
| Line 21: | Line 26: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' | '''Yes''' in 2.00 FW | ||
| Line 33: | Line 39: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' | '''Yes''' in 2.00 FW | ||
=== Additional Information === | |||
It seems at some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel. This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory. | |||
== First Steps == | == First Steps == | ||
Revision as of 05:59, 10 December 2016
WebKit/Userland Exploits
Int32 bug
WebKit/536.26 exploit on System Firmware 1.760.000 and lower (patched in 2.000.000)
http://wololo.net/2014/10/24/webkit-exploit-confirmed-to-run-on-ps4-firmware-1-76/
CVE 2014-1303
WebKit/537.73 exploit on System Firmware 2.040.000 and lower (patched in 2.508.000)
https://github.com/Fire30/PS4-2014-1303-POC
FireKaku
WebKit/??? exploit on System Firmware 3.550.000 and lower (patched in 4.000.000)
https://github.com/Fire30/PS4-3.55-Code-Execution-PoC
Additional Information
On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution.
Kernel Exploits
Dynamic Library Prepare Close (dlclose)
Analysis
Source
Patched
Yes in 2.00 FW
BadIntegerReturn (badIRET)
Analysis
Hacking the PS4, part 3 - Kernel exploitation (by CTurt)
Source
Patched
Yes in 2.00 FW
Additional Information
It seems at some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel. This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory.
First Steps
VidNow
A possible exploit has been found in VidNow App in the Playstation Store App .
PATCHED: Sony has hotfixed this exploit via content hashing the file while in transit.
UPDATE: Some have managed to reverse the hotfix but the method is not known - the PS4 checks the content
hash HTTP header from the HMAC header.
SnagFilms
A possible exploit has been found in the SnagFilms App in the Playstation Store App.
Arbitrary code execution in memory has been demonstrated, although so far the system will throw an exception in the programs memory before the payload finishes loading.
If you craft a small enough payload and/or a payload that load's without causing an exception in program memory you can most likely get code execution working.
http://i.imgur.com/5OrSFCa.jpg
| |||||||||||||||||||||||||||||||||||||||||||||
