Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor: 💡 Ignore initial PS4 PPOE requests to increase the chances of the exploit working #48

Merged
merged 4 commits into from
May 6, 2024
Merged

refactor: 💡 Ignore initial PS4 PPOE requests to increase the chances of the exploit working #48

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3b6d121
refactor: 💡 Ignore initial requests ppoe
maatthc May 5, 2024
84251e1
docs: ✏️ Add more details
maatthc May 5, 2024
e504c6a
fix: 🐛 Typo
maatthc May 5, 2024
7f3384f
refactor: 💡 Move ignore logic to while loop
maatthc May 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ make -C stage2 FW=1100 clean && make -C stage2 FW=1100

For other firmwares, e.g. FW 9.00, pass `FW=900`.

Run the exploit (see `ifconfig` for the correct interface):
DO NOT RUN the exploit just yet (don't press Enter yet) but prepare this command on your prompt (see `ifconfig` for the correct interface):

```sh
sudo python3 pppwn.py --interface=enp0s3 --fw=1100
Expand All @@ -66,11 +66,15 @@ On your PS4:
- Enter anything for `PPPoE User ID` and `PPPoE Password`
- Choose `Automatic` for `DNS Settings` and `MTU Settings`
- Choose `Do Not Use` for `Proxy Server`
- Click `Test Internet Connection` to communicate with your computer

If the exploit fails or the PS4 crashes, you can skip the internet setup and simply click on `Test Internet Connection`. If the `pppwn.py` script is stuck waiting for a request/response, abort it and run it again on your computer, and then click on `Test Internet Connection` on your PS4.
- Now, simultaneously press the 'X' button on your controler on `Test Internet Connection` and 'Enter' on your keyboard (on the computer you have your Python script ready to run).
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Controler typo

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maatthc Ironically, I never go to the Test Internet Connection page, I unplug/replug the ethernet cable on every attempt. Works like a charm.


If the exploit works, you should see an output similar to below, and you should see `Cannot connect to network.` followed by `PPPwned` printed on your PS4.
ALWAYS wait for you console to show the message "Cannot connect to network: (NW-31274-7)" before trying this PPOE injection again.

If the exploit fails or the PS4 crashes, you can skip the internet setup and simply click on `Test Internet Connection`. Kill the `pppwn.py` script and run it again on your computer, and then click on `Test Internet Connection` on your PS4: always simultaneously.


If the exploit works, you should see an output similar to below, and you should see `Cannot connect to network.` followed by `PPPwned` printed on your PS4, or the other way around.

### Example run

Expand Down
13 changes: 11 additions & 2 deletions pppwn.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,16 @@ def ipcp_negotiation(self):
id=pkt[PPP_IPCP].id,
options=pkt[PPP_IPCP].options))

def ppp_negotation(self, cb=None):
def ppp_negotation(self, cb=None, ignore_initial_reqs=False):
if ignore_initial_reqs: # Ignore initial requests in order to increase the chances of the exploit working
num_reqs_to_ignore = 6 # Tested from 6 to 8 on version 10.50 - all give best results then not ignoring
num_ignored_reqs = 0
print('[*] Ignoring initial {} PS4 requests..'.format(num_reqs_to_ignore))
while num_ignored_reqs < num_reqs_to_ignore:
pkt = self.s.recv()
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are those PADI requests that we're ignoring?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes.. there is timing issue somewhere but is seems to "alleviate" the problem..

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then add this to the loop below that checks for PADI

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TheOfficialFloW, done.

num_ignored_reqs+=1
print(num_ignored_reqs)
print('[*] Continuing...')
print('[*] Waiting for PADI...')
while True:
pkt = self.s.recv()
Expand Down Expand Up @@ -609,7 +618,7 @@ def run(self):
print('')
print('[+] STAGE 0: Initialization')

self.ppp_negotation(self.build_fake_ifnet)
self.ppp_negotation(self.build_fake_ifnet, True)
self.lcp_negotiation()
self.ipcp_negotiation()

Expand Down