diff --git a/README.md b/README.md index b4b26d47..a0203f6e 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# PPPwn - PlayStation 4 PPPoE RCE +# PPPwn - PlayStation 4 PPPoE RCE ON BOOT WORKING! , PPPwn is a kernel remote code execution exploit for PlayStation 4 up to FW 11.00. This is a proof-of-concept exploit for [CVE-2006-4304](https://hackerone.com/reports/2177925) that was reported responsibly to PlayStation. Supported versions are: @@ -172,4 +172,4 @@ This has been tested using VMware Fusion 13.5.1, with the VM Guest as Ubuntu 24. ## Notes for GoldHEN version This loader only supports payloads with a kernel entrypoint. The custom version of stage2 first looks for the payload in the root directory of the USB drive, and if found, it is copied to the internal HDD at this path: /data/GoldHEN/payloads/goldhen.bin. The internal payload is then loaded and is no longer needed on the external USB drive. -At the moment, only firmware versions 9.00 and 11.00 are supported. Soon, versions 10.00/10.01 will also be supported. \ No newline at end of file +At the moment, only firmware versions 9.00 and 11.00 are supported. Soon, versions 10.00/10.01 will also be supported. diff --git a/pppwn.py b/pppwn.py index a43f1026..b75e62ae 100644 --- a/pppwn.py +++ b/pppwn.py @@ -667,7 +667,7 @@ def run(self): # reason, this causes scheduling on CPU 0 at some point, which makes # the next allocation use the same per-CPU cache. for i in range(self.PIN_NUM): - if i % 0x100 == 0: + if i % 0x200 == 0: # make the target more busy print('[*] Pinning to CPU 0...{}%'.format(100 * i // self.PIN_NUM), end='\r', @@ -681,8 +681,8 @@ def run(self): print('[+] Pinning to CPU 0...done') - # LCP fails sometimes without the wait - sleep(1) + # wait 20 secs to continue the pppoe hack because the system not loaded all modules + sleep(20) # Corrupt in6_llentry object overflow_lle = self.build_overflow_lle() diff --git a/stage2/stage2.c b/stage2/stage2.c index 1a66f0b3..f5b3cdda 100644 --- a/stage2/stage2.c +++ b/stage2/stage2.c @@ -28,9 +28,10 @@ #define PS4_PAGE_SIZE 0x4000 #define ROUND_PG(x) (((x) + (PS4_PAGE_SIZE - 1)) & ~(PS4_PAGE_SIZE - 1)) -#define PAYLOAD_NAME "goldhen.bin" -#define PAYLOAD_EXT_PATH "/mnt/usb0/" PAYLOAD_NAME -#define PAYLOAD_INT_PATH "/data/GoldHEN/payloads/" PAYLOAD_NAME +//not only goldhen will exist , making my one +#define PAYLOAD_NAME "payload.bin" +#define PAYLOAD_EXT_PATH "/mnt/usb0/payload.bin" PAYLOAD_NAME +#define PAYLOAD_INT_PATH "/data/payloads/" PAYLOAD_NAME // by OSM-Made typedef struct {