This is for the Pwners : Exploiting a WebKit 0-day in PlayStation 4

Presented at Black Hat Europe 2020 Virtual, Dec. 10, 2020, 10:20 a.m. (40 minutes).

Despite an active console hacking community, only few public PlayStation 4 exploits have been released. The exposed WebKit-based browser is usually the entrypoint of a fullchain attack: from browser exploitation to kernel exploitation. However, browser-engine hardening techniques together with the total absence of debugging capabilities make it very hard to successfully exploit bugs in the latest PS4 firmwares. In this talk, we will present how we managed to debug then exploit a 0-day WebKit vulnerability on 6.xx firmwares. The bug has been reported by our fuzzers and is currently under the process of responsible disclosure.

The bug is a Use-after-Free (UAF) vulnerability in WebKit engine. The exploitation of this bug requires a deep understanding of WebKit's primary heap allocator. The key concepts of the allocator as well as the primitives required to massage the heap will be introduced to the audience.

In this talk, we will introduce the root cause of the bug. This bug provides limited exploitation primitives. However, thanks to a weakness we identified in ASLR mechanism, we were able to make this bug exploitable. In this presentation, we will focus on the exploitation strategy we adopted to get code execution in the context of the browser process and how we turned in particular a Use-After-Free into a R/W primitive leading to code execution. We will conclude our talk by outlining some of the hurdles we faced while attempting to port the exploit on the latest PS4 firmware.


Presenters:

  • Quentin Meffre - Security Researcher, Synacktiv
    Quentin Meffre is a computer security researcher at Synacktiv. His main interests are vulnerability research, exploit development, and software programming. He especially likes browser security.
  • Mehdi Talbi - Security Researcher, Synacktiv
    Mehdi Talbi, PhD, is a computer security researcher at Synacktiv. His main interests are vulnerability research, exploit development, reverse engineering, and source code auditing. Mehdi has published his work in several peer-reviewed journals (Journal in computer Virology) and magazines (Phrack). He has also presented his work at several international conferences including Infiltrate, Warcon, Virus Bulletin, SSTIC, etc. Mehdi is one of the contributor to the Haka open source project showcased at DEF CON and Black Hat Arsenal.

Links:

Similar Presentations: