rop.js - Contains a framework for ROP chains.

Note: It's been patched in the 6.50 firmware update. Credit for the bug discovery is to lokihardt from Google Project Zero (p0). It will then setup a framework to run ROP chains in index.html and by default will provide two hyperlinks to run test ROP chains - one for running the sys_getpid() syscall, and the other for running the sys_getuid() syscall to get the PID and user ID of the process respectively.Įach file contains a comment at the top giving a brief explanation of what the file contains and how the exploit works. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.js. This repo contains a proof-of-concept (PoC) RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441.