145 lines
5.3 KiB
Markdown
145 lines
5.3 KiB
Markdown
# Relapse Exploit Docker
|
|
|
|
Container packaging for [PS5 Relapse Exploit](https://github.com/ntfargo/Relapse-Exploit).
|
|
The upstream project is pinned as a Git submodule, and the image build verifies the
|
|
SHA-256 digest of every executable payload before including it.
|
|
|
|
The Compose stack also includes a local PS5 User Guide gateway: authoritative DNS
|
|
for `manuals.playstation.net`, HTTP/HTTPS redirect to the local exploit, allowlisted
|
|
DNS forwarding for the homebrew store, and NXDOMAIN for every other domain so the
|
|
console cannot resolve PSN or update services.
|
|
|
|
Use this only on consoles you own or are authorized to test. The exploit can panic
|
|
the console, corrupt kernel state, expose administrative services, and execute
|
|
arbitrary code with elevated privileges.
|
|
|
|
Documentation:
|
|
|
|
- [PS5 setup, DNS, deployment, and troubleshooting](docs/PS5_SETUP.md)
|
|
- [Maintainer and agent handoff](docs/HANDOFF.md)
|
|
- [Y2JB / Relapse controlled test record](docs/Y2JB_TEST_2026-10-02.md)
|
|
- [External payload candidate evidence](docs/payload-evidence/README.md)
|
|
- [Repository instructions for coding agents](AGENTS.md)
|
|
|
|
## Current deployment
|
|
|
|
The maintained LAN deployment runs on `net-utils01` from
|
|
`/opt/relapse-exploit-docker`:
|
|
|
|
| Service | LAN endpoint | Purpose |
|
|
| --- | --- | --- |
|
|
| Relapse page | `http://192.168.20.30:8000/` | Exploit page and payload assets |
|
|
| Restricted DNS | `192.168.20.30:53` UDP/TCP | User Guide override and store allowlist |
|
|
| User Guide gateway | `192.168.20.30:80` and `:443` TCP | Redirect to the local Relapse page |
|
|
|
|
Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
|
|
The DNS gateway resolves `manuals.playstation.net` locally and forwards only
|
|
`homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`,
|
|
`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its
|
|
configured upstream resolver. These names cover the homebrew store, the official
|
|
PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and
|
|
update endpoints; every other name receives NXDOMAIN.
|
|
|
|
The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
|
|
`192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to
|
|
the six allowlisted domains; no WAN ingress rule is required. The server needs DNS
|
|
egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).
|
|
|
|
The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
|
|
allowed automatically: review the repository JSON, payload URLs, checksums, and
|
|
redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`.
|
|
|
|
Spectrum Library is distributed without source code in its repository. Static
|
|
review of its 1.4.8 ELF identified `store.spectrumlibrary.online` for its API and
|
|
`api.github.com` for update checks. Catalog responses can supply additional cover,
|
|
manifest, and package URLs; these unknown hosts remain blocked until observed and
|
|
reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS
|
|
availability alone does not guarantee that its catalog will load.
|
|
|
|
To deploy a reviewed commit:
|
|
|
|
```sh
|
|
ssh net-utils01
|
|
cd /opt/relapse-exploit-docker
|
|
git pull --ff-only
|
|
git submodule update --init --recursive
|
|
docker compose up -d --build
|
|
docker compose ps
|
|
curl -I http://127.0.0.1:8000/
|
|
```
|
|
|
|
Both Compose services must report `healthy`. Runtime changes require the rebuild
|
|
above; documentation-only changes need only the fast-forward pull.
|
|
|
|
## Clone and build
|
|
|
|
```sh
|
|
git clone --recurse-submodules <repository-url>
|
|
cd relapse-exploit-docker
|
|
docker compose build
|
|
```
|
|
|
|
For an existing clone:
|
|
|
|
```sh
|
|
git submodule update --init --recursive
|
|
docker compose build
|
|
```
|
|
|
|
## Run
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
Open `http://HOST-IP:8000/` from the PS5. View the service status with:
|
|
|
|
```sh
|
|
docker compose ps
|
|
docker compose logs -f
|
|
```
|
|
|
|
Stop it with `docker compose down`.
|
|
|
|
By default, port 8000 is exposed on every host interface so the PS5 can reach it.
|
|
Restrict it to one host address when possible:
|
|
|
|
```sh
|
|
HOST_BIND=192.168.1.10 HOST_PORT=8000 docker compose up -d
|
|
```
|
|
|
|
Do not expose this service to the internet. Prefer an isolated local network.
|
|
|
|
## Update upstream
|
|
|
|
Review upstream changes before updating because the served JavaScript and payloads
|
|
ultimately execute with kernel privileges.
|
|
|
|
```sh
|
|
git -C app fetch origin
|
|
git -C app checkout <reviewed-commit>
|
|
sha256sum app/payloads/*
|
|
```
|
|
|
|
After reviewing the new binaries, update `payloads.sha256`, rebuild, test, and commit
|
|
both the submodule pointer and checksum changes together.
|
|
|
|
The currently pinned upstream snapshot includes only the kernel exploit payload and
|
|
the ELF loader. It no longer bundles etaHEN, KStuff, or ShadowMount+ because upstream
|
|
removed those compatibility-sensitive payloads. After the loader starts, send any
|
|
separately reviewed ELF to the PS5 on TCP port 9021 with an external payload sender.
|
|
|
|
## Container hardening
|
|
|
|
The runtime image:
|
|
|
|
- contains only the files required by the exploit page;
|
|
- runs as numeric user/group `65532:65532`;
|
|
- has a read-only filesystem, all Linux capabilities dropped, and no-new-privileges;
|
|
- disables directory listings and browser caching;
|
|
- adds restrictive browser security headers;
|
|
- does not expose the upstream `.git` directory.
|
|
|
|
These controls protect the host-side web server. They do not make the PS5 exploit or
|
|
its precompiled payloads intrinsically safe.
|