80 lines
2.1 KiB
Markdown
80 lines
2.1 KiB
Markdown
# Relapse Exploit Docker
|
|
|
|
Container packaging for [PS5 Relapse Exploit](https://github.com/ntfargo/Relapse-Exploit).
|
|
The upstream project is pinned as a Git submodule, and the image build verifies the
|
|
SHA-256 digest of every executable payload before including it.
|
|
|
|
Use this only on consoles you own or are authorized to test. The exploit can panic
|
|
the console, corrupt kernel state, expose administrative services, and execute
|
|
arbitrary code with elevated privileges.
|
|
|
|
For the complete PS5, DNS, deployment, operation, and troubleshooting guide, see
|
|
[docs/PS5_SETUP.md](docs/PS5_SETUP.md).
|
|
|
|
## Clone and build
|
|
|
|
```sh
|
|
git clone --recurse-submodules <repository-url>
|
|
cd relapse-exploit-docker
|
|
docker compose build
|
|
```
|
|
|
|
For an existing clone:
|
|
|
|
```sh
|
|
git submodule update --init --recursive
|
|
docker compose build
|
|
```
|
|
|
|
## Run
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
Open `http://HOST-IP:8000/` from the PS5. View the service status with:
|
|
|
|
```sh
|
|
docker compose ps
|
|
docker compose logs -f
|
|
```
|
|
|
|
Stop it with `docker compose down`.
|
|
|
|
By default, port 8000 is exposed on every host interface so the PS5 can reach it.
|
|
Restrict it to one host address when possible:
|
|
|
|
```sh
|
|
HOST_BIND=192.168.1.10 HOST_PORT=8000 docker compose up -d
|
|
```
|
|
|
|
Do not expose this service to the internet. Prefer an isolated local network.
|
|
|
|
## Update upstream
|
|
|
|
Review upstream changes before updating because the served JavaScript and payloads
|
|
ultimately execute with kernel privileges.
|
|
|
|
```sh
|
|
git -C app fetch origin
|
|
git -C app checkout <reviewed-commit>
|
|
sha256sum app/payloads/*
|
|
```
|
|
|
|
After reviewing the new binaries, update `payloads.sha256`, rebuild, test, and commit
|
|
both the submodule pointer and checksum changes together.
|
|
|
|
## Container hardening
|
|
|
|
The runtime image:
|
|
|
|
- contains only the files required by the exploit page;
|
|
- runs as numeric user/group `65532:65532`;
|
|
- has a read-only filesystem, all Linux capabilities dropped, and no-new-privileges;
|
|
- disables directory listings and browser caching;
|
|
- adds restrictive browser security headers;
|
|
- does not expose the upstream `.git` directory.
|
|
|
|
These controls protect the host-side web server. They do not make the PS5 exploit or
|
|
its precompiled payloads intrinsically safe.
|