relapse-exploit-docker/docs/HANDOFF.md

Maintainer and agent handoff

Last updated: 2026-09-29

This file is the durable handoff for future sessions. Start work from this repository rather than from the upstream Relapse Exploit checkout.

Current status

The Docker wrapper has been created, committed, pushed to the local Gitea, and deployed successfully. The user confirmed that the exploit worked on the PS5 and that opening the PS5 User Guide reached an exploit page directly.

The exact destination selected by the external DNS was not independently verified. Do not assume that the User Guide page came from the local container merely because it displayed Relapse. The local container is confirmed at the raw IP URL below.

Repositories

Primary local workspace:

/var/www/code/others/relapse-exploit-docker

Gitea push remote:

[email protected]:TinyBacklog/relapse-exploit-docker.git

Gitea public clone URL:

http://192.168.20.20:3000/TinyBacklog/relapse-exploit-docker.git

Upstream submodule:

https://github.com/ntfargo/Relapse-Exploit.git

Pinned upstream commit:

09f10f5b58fab8a9ae9e8df214da37271290b13e

Repository-local Git identity:

kadinho <[email protected]>

Live deployment

• host: net-utils01;
• host IP: 192.168.20.30;
• SSH user used during setup: root;
• checkout: /opt/relapse-exploit-docker;
• service URL: http://192.168.20.30:8000/;
• image name: relapse-exploit:local;
• Compose service: relapse-exploit;
• container name generated by Compose: relapse-exploit-docker-relapse-exploit-1;
• host port: 8000/TCP;
• container port: 8080/TCP;
• restart policy: unless-stopped.

The same Compose project also runs ps5-guide-gateway, bound specifically to 192.168.20.30 on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves only manuals.playstation.net, returns NXDOMAIN for every other name, and redirects the User Guide to http://192.168.20.30:8000/.

Port 8080 on the host is already used by unifi-network-application; do not move this service there. At the last verification, the Relapse container was healthy, ran as 65532:65532, used a read-only root filesystem, and returned HTTP 200 over the LAN. /.git/config returned 404.

No firewall management tool was detected on net-utils01 during setup.

Deployment authentication detail

net-utils01 does not currently have a Gitea SSH client key authorized for cloning. The deployment clone therefore uses the public HTTP URL. Do not copy personal SSH private keys to the server or enable SSH agent forwarding as a workaround. If write or authenticated access becomes necessary, create a repository-scoped deploy key.

The Gitea server's SSH fingerprints were compared with the already trusted local host before its host keys were added to /root/.ssh/known_hosts on net-utils01.

Runtime design

The image is based on python:3.14-alpine and uses only Python's standard library. It copies these upstream assets into /srv/public:

• index.html;
• src/;
• offsets/;
• payloads/.

The build validates every payload listed in payloads.sha256. The server disables directory listing and caching, sends restrictive browser headers, and runs under numeric UID/GID 65532. Compose additionally makes the root filesystem read-only, drops all Linux capabilities, and enables no-new-privileges.

The base image tag is not digest-pinned in the Dockerfile. A prior successful build resolved python:3.14-alpine to:

sha256:9e9fde4d32eedce0b661d9ab91e826b62dddf28e928c230ec55f1866cac66b01

Treat that as historical build information, not as an instruction to pin it without checking architecture support and update policy.

Approved payload hashes

At the pinned upstream commit:

de5dd480d12637527ba2d75e35de851adbb59c455293fa32588c492ef6b44b81  payloads/elfldr-ps5-1360.elf
26034dfbb88dd8be344fee1876c387bfcba0386edb079014e18ec25580368f6d  payloads/etaHEN.elf
7cfb3a8cb86db67893c360ae3531f460f800e9f24039797038e6e81fc50f18a9  payloads/kexp_2026_05_25.bin
858880a8adbedaabfaced025384f4f6f908cfe44f1a049070ad8df911c22b972  payloads/kstuff.elf
0b30a1c23b83ebb2aa6523c8caaa5801ee89bde00e90cb36f392a29bb0bdb403  payloads/shadowmountplus.elf

The payloads are precompiled, stripped binaries. Hash matching proves consistency with the reviewed snapshot; it does not prove that the binaries are safe.

PS5 and DNS state

The local HTTP endpoint is available and verified at:

http://192.168.20.30:8000/

The upstream public DNS 45.56.67.85 was used initially, but the PS5 did not contact the local container. The local gateway was therefore added. Configure the PS5 with primary DNS 192.168.20.30 and secondary DNS 0.0.0.0, then restart the console and accept the self-signed certificate warning in the User Guide.

The gateway intentionally provides no recursive DNS forwarding. Only manuals.playstation.net resolves; all other names receive NXDOMAIN. This blocks PSN and update resolution and keeps the setup independent of a public DNS operator. The PS5 was identified as 192.168.10.26; requests from 192.168.10.6 seen earlier were from a different client.

Full PS5 instructions and DNS options are in docs/PS5_SETUP.md.

Common operations

Inspect the live service:

ssh net-utils01
cd /opt/relapse-exploit-docker
docker compose ps
docker compose logs -f

Synchronize documentation-only changes:

cd /opt/relapse-exploit-docker
git pull --ff-only
git submodule update --init --recursive

Deploy runtime changes:

cd /opt/relapse-exploit-docker
git pull --ff-only
git submodule update --init --recursive
docker compose up -d --build
docker compose ps
curl -I http://127.0.0.1:8000/

Stop or restart:

docker compose down
docker compose up -d
# or
docker compose restart

Known risks and review findings

The upstream project deliberately exploits WebKit and the PS5 kernel, escalates the browser process to root, escapes its sandbox, and executes ELF payloads.

Important upstream findings from the initial static review:

1. Payloads are executable privileged binaries without upstream signature verification or reproducible-build evidence.
2. The AIO cleanup path marks groups as defused even when cleanup reports failure, which can leave risky kernel state behind.
3. Some early kernel failures return a result that the UI can misreport as root and sandbox escape success.
4. The ELF loader on port 9021 is an arbitrary-payload interface by design.
5. ShadowMount+ includes an HTTP/JSON administration API; keep it on loopback or a trusted LAN and never expose it publicly.

The wrapper's checksum and container hardening mitigate host-side packaging risks; they do not correct these upstream kernel or payload risks.

Next-session checklist

1. Read this file, AGENTS.md, and docs/PS5_SETUP.md.
2. Run git status --short --branch and git submodule status.
3. Confirm the requested task's scope before changing the upstream submodule.
4. Preserve the payload-integrity and container-hardening invariants.
5. Validate proportionally to the change.
6. Update this handoff if infrastructure or operational state changes.
7. Push main to Gitea and, when appropriate, synchronize net-utils01.