# Maintainer and agent handoff Last updated: 2026-09-29 This file is the durable handoff for future sessions. Start work from this repository rather than from the upstream Relapse Exploit checkout. ## Current status The Docker wrapper has been created, committed, pushed to the local Gitea, and deployed successfully. The user confirmed that the exploit worked on the PS5 and that opening the PS5 User Guide reached an exploit page directly. The exact destination selected by the external DNS was not independently verified. Do not assume that the User Guide page came from the local container merely because it displayed Relapse. The local container is confirmed at the raw IP URL below. ## Repositories Primary local workspace: ```text /var/www/code/others/relapse-exploit-docker ``` Gitea push remote: ```text gitea@192.168.20.20:TinyBacklog/relapse-exploit-docker.git ``` Gitea public clone URL: ```text http://192.168.20.20:3000/TinyBacklog/relapse-exploit-docker.git ``` Upstream submodule: ```text https://github.com/ntfargo/Relapse-Exploit.git ``` Pinned upstream commit: ```text 09f10f5b58fab8a9ae9e8df214da37271290b13e ``` Repository-local Git identity: ```text kadinho ``` ## Live deployment - host: `net-utils01`; - host IP: `192.168.20.30`; - SSH user used during setup: `root`; - checkout: `/opt/relapse-exploit-docker`; - service URL: `http://192.168.20.30:8000/`; - image name: `relapse-exploit:local`; - Compose service: `relapse-exploit`; - container name generated by Compose: `relapse-exploit-docker-relapse-exploit-1`; - host port: `8000/TCP`; - container port: `8080/TCP`; - restart policy: `unless-stopped`. The same Compose project also runs `ps5-guide-gateway`, bound specifically to `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves only `manuals.playstation.net`, returns NXDOMAIN for every other name, and redirects the User Guide to `http://192.168.20.30:8000/`. Port `8080` on the host is already used by `unifi-network-application`; do not move this service there. At the last verification, the Relapse container was healthy, ran as `65532:65532`, used a read-only root filesystem, and returned HTTP 200 over the LAN. `/.git/config` returned 404. No firewall management tool was detected on `net-utils01` during setup. ## Deployment authentication detail `net-utils01` does not currently have a Gitea SSH client key authorized for cloning. The deployment clone therefore uses the public HTTP URL. Do not copy personal SSH private keys to the server or enable SSH agent forwarding as a workaround. If write or authenticated access becomes necessary, create a repository-scoped deploy key. The Gitea server's SSH fingerprints were compared with the already trusted local host before its host keys were added to `/root/.ssh/known_hosts` on `net-utils01`. ## Runtime design The image is based on `python:3.14-alpine` and uses only Python's standard library. It copies these upstream assets into `/srv/public`: - `index.html`; - `src/`; - `offsets/`; - `payloads/`. The build validates every payload listed in `payloads.sha256`. The server disables directory listing and caching, sends restrictive browser headers, and runs under numeric UID/GID 65532. Compose additionally makes the root filesystem read-only, drops all Linux capabilities, and enables `no-new-privileges`. The base image tag is not digest-pinned in the Dockerfile. A prior successful build resolved `python:3.14-alpine` to: ```text sha256:9e9fde4d32eedce0b661d9ab91e826b62dddf28e928c230ec55f1866cac66b01 ``` Treat that as historical build information, not as an instruction to pin it without checking architecture support and update policy. ## Approved payload hashes At the pinned upstream commit: ```text de5dd480d12637527ba2d75e35de851adbb59c455293fa32588c492ef6b44b81 payloads/elfldr-ps5-1360.elf 26034dfbb88dd8be344fee1876c387bfcba0386edb079014e18ec25580368f6d payloads/etaHEN.elf 7cfb3a8cb86db67893c360ae3531f460f800e9f24039797038e6e81fc50f18a9 payloads/kexp_2026_05_25.bin 858880a8adbedaabfaced025384f4f6f908cfe44f1a049070ad8df911c22b972 payloads/kstuff.elf 0b30a1c23b83ebb2aa6523c8caaa5801ee89bde00e90cb36f392a29bb0bdb403 payloads/shadowmountplus.elf ``` The payloads are precompiled, stripped binaries. Hash matching proves consistency with the reviewed snapshot; it does not prove that the binaries are safe. ## PS5 and DNS state The local HTTP endpoint is available and verified at: ```text http://192.168.20.30:8000/ ``` The upstream public DNS `45.56.67.85` was used initially, but the PS5 did not contact the local container. The local gateway was therefore added. Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the console and accept the self-signed certificate warning in the User Guide. The gateway intentionally provides no recursive DNS forwarding. Only `manuals.playstation.net` resolves; all other names receive NXDOMAIN. This blocks PSN and update resolution and keeps the setup independent of a public DNS operator. The PS5 was identified as `192.168.10.26`; requests from `192.168.10.6` seen earlier were from a different client. Full PS5 instructions and DNS options are in `docs/PS5_SETUP.md`. ## Common operations Inspect the live service: ```sh ssh net-utils01 cd /opt/relapse-exploit-docker docker compose ps docker compose logs -f ``` Synchronize documentation-only changes: ```sh cd /opt/relapse-exploit-docker git pull --ff-only git submodule update --init --recursive ``` Deploy runtime changes: ```sh cd /opt/relapse-exploit-docker git pull --ff-only git submodule update --init --recursive docker compose up -d --build docker compose ps curl -I http://127.0.0.1:8000/ ``` Stop or restart: ```sh docker compose down docker compose up -d # or docker compose restart ``` ## Known risks and review findings The upstream project deliberately exploits WebKit and the PS5 kernel, escalates the browser process to root, escapes its sandbox, and executes ELF payloads. Important upstream findings from the initial static review: 1. Payloads are executable privileged binaries without upstream signature verification or reproducible-build evidence. 2. The AIO cleanup path marks groups as defused even when cleanup reports failure, which can leave risky kernel state behind. 3. Some early kernel failures return a result that the UI can misreport as root and sandbox escape success. 4. The ELF loader on port 9021 is an arbitrary-payload interface by design. 5. ShadowMount+ includes an HTTP/JSON administration API; keep it on loopback or a trusted LAN and never expose it publicly. The wrapper's checksum and container hardening mitigate host-side packaging risks; they do not correct these upstream kernel or payload risks. ## Next-session checklist 1. Read this file, `AGENTS.md`, and `docs/PS5_SETUP.md`. 2. Run `git status --short --branch` and `git submodule status`. 3. Confirm the requested task's scope before changing the upstream submodule. 4. Preserve the payload-integrity and container-hardening invariants. 5. Validate proportionally to the change. 6. Update this handoff if infrastructure or operational state changes. 7. Push `main` to Gitea and, when appropriate, synchronize `net-utils01`.