TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record PS5 payload and Y2JB tests

Browse Source
This commit is contained in:
kadinho
2026-10-02 20:14:53 +01:00
parent bb6b46969f
commit 38e68cf165
6 changed files with 662 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+120 -3
View File
@@ -1,6 +1,6 @@
# Maintainer and agent handoff
Last updated: 2026-10-01
Last updated: 2026-10-02
This file is the durable handoff for future sessions. Start work from this
repository rather than from the upstream Relapse Exploit checkout.
@@ -132,8 +132,32 @@ auto-loader because those optional payloads caused compatibility issues. The pag
now stops after starting the ELF loader; any additional reviewed ELF must be sent
externally to the PS5 on TCP port 9021.
## External payload candidate evidence
A controlled intake and startup smoke test was completed on 2026-10-02 for
kstuff-lite v1.11 and ShadowMountPlus 1.7beta3. Locally calculated SHA-256 digests
matched the digests published by GitHub's release API. The verified ELFs were sent
once from `net-utils01` to `192.168.40.14:9021`, in that order and separated by
more than two seconds. Both connected and returned successful startup output;
ShadowMountPlus identified firmware 13.20, installed its hooks, synchronized an
empty game library and bound its API only to `127.0.0.1:10101`. The temporary
server copies were removed, and no downloaded binary is stored in this repository.
The normalized, machine-readable evidence and the proposed payload-manager import
contract and test limitations are in
[`docs/payload-evidence/`](payload-evidence/README.md). The required order is
kstuff-lite first, followed by ShadowMountPlus only after kstuff startup has been
confirmed. Catalog entries remain disabled and non-favorite by default despite the
successful smoke test; user selection is separate from evidence.
## PS5 and DNS state
The PS5 now uses the static address:
```text
192.168.40.14
```
The local HTTP endpoint is available and verified at:
```text
@@ -148,11 +172,104 @@ accept the self-signed certificate warning in the User Guide.
The gateway intentionally provides no recursive DNS forwarding. Only
`manuals.playstation.net` resolves; all other names receive NXDOMAIN. This blocks
PSN and update resolution and keeps the setup independent of a public DNS operator.
The PS5 was identified as `192.168.10.26`; requests from `192.168.10.6` seen earlier
were from a different client.
The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from a different client. Those addresses
are historical and must not be used as the current payload destination.
The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On
2026-10-01, a connection-only probe from `net-utils01` to
`192.168.40.14:9021` succeeded after inter-VLAN access was enabled. The probe
used `nc -vz`, sent no ELF payload, and confirmed that a new TCP connection from
the server VLAN to the console VLAN was permitted. `netcat-openbsd` is installed
on `net-utils01` for this diagnostic. Keep the applicable network policy limited
to the required LAN source, destination and TCP port; never expose port `9021`
to the Internet.
The inter-VLAN firewall policy reported as configured is:
| Source | Destination | Protocol/port | Purpose/state |
| --- | --- | --- | --- |
| `net-utils01` (`192.168.20.30`) | PS5 (`192.168.40.14`) | TCP `9021` | payload manager to ELF loader; active |
| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active |
| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase |
| PS5 (`192.168.40.14`) | remaining `192.168.20.0/24` hosts | all | blocked |
| hosts other than `net-utils01` | PS5 (`192.168.40.14`) | TCP `9021` | blocked |
The specific allow rules must be evaluated before the broader deny rules. Keep
TCP `8001` disabled until phase 5 has a reviewed service that requires it. The
successful TCP `9021` probe independently verifies that particular allow path;
the complete firewall policy was not audited from this repository.
Full PS5 instructions and DNS options are in `docs/PS5_SETUP.md`.
### Y2JB controlled test (2026-10-02; kernel/loader startup verified)
The PS5 Pro is on firmware 13.20. Its separate offline test user is `PLAYER1`
(slot 2); ActRemoteLink activated that slot and enabled user/global Remote Play.
Fake sign-in was **not** executed: reviewed implementations also write base
registry state, so isolation from the existing personal account is unproven.
Remote Play pairing remains untested.
The local YouTube PKG metadata identifies `PPSA01652`, version `01.000.030`,
Content ID `JA0004-PPSA01652_00-YOUTUBESIEJA0000`, despite its filename saying EUR.
Y2JB 1.6 was initially placed under `PPSA01650`. A subsequent PSN/DNS dialog loop
persisted with both local restricted DNS and primary DNS `127.0.0.2`.
At that point neither the cause nor successful Y2JB launch had been established;
the later successful run is recorded in
[`docs/Y2JB_TEST_2026-10-02.md`](Y2JB_TEST_2026-10-02.md).
The approved directory correction placed the verified Y2JB 1.6 file at
`/user/download/PPSA01652/download0.dat` (336789504 bytes). Its source and complete
destination reread matched SHA-256
`946fb64427d340a1a302d260e0cc448b50fe15cfcff8ea167a0d33d3aa76f39d`.
An existing, different file was preserved on the PS5 as
`/user/download/PPSA01652/download0.dat.before-y2jb-20261002T150112Z`;
its reread SHA-256 is
`dc553ea85aab9da884316c0fe9bb222da3e8d384ddf2c1fd119779b11c8a79c1`.
The original `PPSA01650` copy remains untouched. Do not delete the backup without
approval. After a normal reboot the user's screenshot confirmed Y2JB 1.6,
firmware 13.20, Title ID PPSA01652, app version 01.000.030, popups disabled, and
Remote JS Loader listening at `192.168.40.14:50000`. This demonstrates working
userland startup without fake sign-in; the exact cause of the earlier loop is
not isolated because both directory and file contents differed.
After the user enabled a temporary net-utils01 → PS5 TCP 50000 exception,
`edisnord/relapse-y2jb` v1.0.0 `relapse.js` (261458 bytes, SHA-256
`f85129b861f43a19f6810be5182aecdcf82a25e59ee5fbcd0604e4a4e2a40d69`)
was sent once. Output identified 13.20 offsets, kernel privileges ready, kexp
return zero, restored eboot descriptors, both real pipe buffers restored with
10/10 writes verified, completed teardown and ELF loader on 9021. A subsequent
connection-only TCP 9021 probe succeeded. The JS temporary copy was removed.
This is a startup smoke test, not proof of long-term stability, safe app closure
on this firmware, Remote Play pairing or homebrew operation in this boot.
The payload leaves three kernel sysctl OIDs modified until reboot, including
`kern.smp.cpus` returning a kernel address instead of a CPU count. App-close safety
is asserted by the output but upstream measured it only on 12.60; do not present
that as independently verified on 13.20. Do not send another kernel exploit in
an already exploited session. Disable temporary TCP 50000 when not needed.
FTP used `ps5-payload-dev/ftpsrv` v0.21.1, SHA-256
`7d4b31c83eae4e056580482a3a074e1db25922efc74ac1e439473b45d71a5938`.
Active-mode tests failed with `550 Bad file descriptor`; passive mode succeeded.
Temporary pfSense exceptions from net-utils01 to PS5 are TCP 2121 and
49152–65535, restricted to those two IPs. FTP was terminated with KILL. Disable
these rules when the test is complete; TCP 31337 (ActRemoteLink) is also temporary.
The obsolete reverse active-FTP exception PS5 → net-utils01 TCP 20212 is not needed.
PKG Manager v1.4.1 runs in memory on PS5 TCP 8844, with Direct Install TCP 18842;
restart the reviewed payload after a PS5 reboot. Access through loopback SSH
forwards, with matching net-utils01 → PS5 firewall exceptions only. This does not
install or start the Y2JB autoloader. itsPLK autoloader v0.9.1 has no supported
kernel exploit for 13.20; v1.0.0-dev-794049f adds Relapse but remains experimental
and has not been installed in this test.
**Server memory constraint:** net-utils01 has about 1.9 GiB RAM and no swap;
`/tmp` is tmpfs. Staging approximately 622 MiB of Y2JB files there caused severe
memory pressure with SSH/HTTP stalls; removal restored SSH. Use a verified
disk-backed path instead (`/var/tmp` is currently on ext4 `/dev/sda1`, about 70 GiB
free). Check memory and mount type before future payload staging. Test downloads
must be removed explicitly after verification; do not clear service-owned tmp dirs.
## Common operations
Inspect the live service: