relapse-exploit-docker/README.md

Relapse Exploit Docker

Container packaging for PS5 Relapse Exploit. The upstream project is pinned as a Git submodule, and the image build verifies the SHA-256 digest of every executable payload before including it.

The Compose stack also includes a local PS5 User Guide gateway: authoritative DNS for manuals.playstation.net, HTTP/HTTPS redirect to the local exploit, and NXDOMAIN for every other domain so the console cannot resolve PSN or update services.

Use this only on consoles you own or are authorized to test. The exploit can panic the console, corrupt kernel state, expose administrative services, and execute arbitrary code with elevated privileges.

Documentation:

• PS5 setup, DNS, deployment, and troubleshooting
• Maintainer and agent handoff
• Y2JB / Relapse controlled test record
• External payload candidate evidence
• Repository instructions for coding agents

Clone and build

git clone --recurse-submodules <repository-url>
cd relapse-exploit-docker
docker compose build

For an existing clone:

git submodule update --init --recursive
docker compose build

Run

docker compose up -d

Open http://HOST-IP:8000/ from the PS5. View the service status with:

docker compose ps
docker compose logs -f

Stop it with docker compose down.

By default, port 8000 is exposed on every host interface so the PS5 can reach it. Restrict it to one host address when possible:

HOST_BIND=192.168.1.10 HOST_PORT=8000 docker compose up -d

Do not expose this service to the internet. Prefer an isolated local network.

Update upstream

Review upstream changes before updating because the served JavaScript and payloads ultimately execute with kernel privileges.

git -C app fetch origin
git -C app checkout <reviewed-commit>
sha256sum app/payloads/*

After reviewing the new binaries, update payloads.sha256, rebuild, test, and commit both the submodule pointer and checksum changes together.

The currently pinned upstream snapshot includes only the kernel exploit payload and the ELF loader. It no longer bundles etaHEN, KStuff, or ShadowMount+ because upstream removed those compatibility-sensitive payloads. After the loader starts, send any separately reviewed ELF to the PS5 on TCP port 9021 with an external payload sender.

Container hardening

The runtime image:

• contains only the files required by the exploit page;
• runs as numeric user/group 65532:65532;
• has a read-only filesystem, all Linux capabilities dropped, and no-new-privileges;
• disables directory listings and browser caching;
• adds restrictive browser security headers;
• does not expose the upstream .git directory.

These controls protect the host-side web server. They do not make the PS5 exploit or its precompiled payloads intrinsically safe.