PPPwn (CVE-2006-4304)
A kernel remote code execution exploit for PlayStation 4 up to firmware 11.00 via PPPoE.
What is PPPwn (CVE-2006-4304)?
PPPwn is a kernel remote code execution exploit for PlayStation 4 consoles that leverages a PPPoE vulnerability (CVE-2006-4304) to run arbitrary code on the system. It allows users to execute custom payloads, such as homebrew enablers, on supported firmware versions up to 11.00. The exploit works by intercepting and manipulating PPPoE network connections between a computer and the PS4.
Security researchers, PlayStation 4 homebrew developers, and enthusiasts interested in console hacking and firmware exploitation. It requires technical knowledge of networking, Linux, and exploit development.
PPPwn provides a reliable, open-source kernel RCE exploit for a wide range of PlayStation 4 firmware versions, with clear documentation and extensible payload support. It stands out for its detailed logging and community-driven firmware compatibility updates.
Overview
PPPwn - PlayStation 4 PPPoE RCE
Use Cases
Best For
- Executing custom homebrew payloads on PlayStation 4
- Security research on console kernel vulnerabilities
- Developing PlayStation 4 homebrew enablers like Mira
- Educational purposes in exploit development
- Testing PlayStation 4 firmware security
- Bypassing PlayStation 4 software restrictions for modding
Not Ideal For
- Users wanting a plug-and-play homebrew solution without manual configuration or Linux knowledge
- Non-technical enthusiasts uncomfortable with command-line networking and exploit synchronization
- Environments where physical Ethernet connections or Linux systems are unavailable
- Mac Apple Silicon owners without access to a Linux virtual machine or Docker setup
Pros & Cons
Pros
Supports PlayStation 4 firmware versions from 7.00 to 11.00 with detailed lists, and encourages community updates via PRs for more versions.
Provides verbose output during each stage (e.g., STAGE 0 to 4) as shown in the example run, aiding in debugging and understanding the exploit process.
Allows adaptation of the stage2.bin payload for launching custom homebrew enablers like Mira, enabling users to build upon the proof-of-concept foundation.
Leverages CVE-2006-4304 that was reported responsibly to PlayStation, ensuring ethical security research and community trust.
Cons
Requires a Linux system, physical Ethernet connection, specific PS4 network configuration (PPPoE), and manual compilation steps, making it inaccessible for casual users.
The included payload only prints 'PPPwned' on the PS4; users must manually adapt stage2.bin for practical homebrew applications, adding extra development overhead.
Does not natively support Mac Apple Silicon—requires Docker or Linux VM workarounds—and relies on Ethernet ports, which may not be available on modern laptops.
Frequently Asked Questions
Related Projects
krackattacks-scriptsThis project provides a suite of Python scripts to detect vulnerabilities related to the KRACK (Key Reinstallation Attack) against WPA2 Wi-Fi security. It allows security researchers and network administrators to test whether specific clients or access points are affected by critical CVEs like CVE-2017-13077 and CVE-2017-13080. ## Key Features - **Client Vulnerability Testing** — Seven distinct tests to check for key reinstallation vulnerabilities in Wi-Fi clients, including pairwise and group key handshake flaws. - **Access Point Testing** — Detects vulnerabilities in the FT (Fast Transition) handshake (802.11r) used by access points during roaming. - **Detailed Test Mapping** — Scripts correspond to official Wi-Fi Alliance test cases for standardized vulnerability assessment. - **Manual Verification Support** — Includes guidance for using additional monitoring interfaces to manually confirm script findings. - **Regulatory and Hardware Considerations** — Provides notes on hardware encryption, 5 GHz band limitations, and driver adjustments for accurate testing. ## Philosophy The project emphasizes responsible security testing by providing tools to verify patches and assess real-world vulnerability status, rather than functioning as attack scripts. It requires legitimate network credentials to operate.
fragattacksFragAttacks is a security testing tool that identifies vulnerabilities in Wi-Fi implementations related to frame fragmentation and aggregation. It can test both clients and access points for a range of flaws that impact WPA2 and WPA3 networks, helping security researchers and network administrators assess the security of their Wi-Fi devices. ## Key Features - **Fragmentation Attack Testing** — Tests for vulnerabilities where Wi-Fi frames are split into fragments and reassembled incorrectly. - **Aggregation (A-MSDU) Attack Testing** — Checks for flaws in handling aggregated MAC service data units. - **Mixed Key Attack Detection** — Identifies issues where fragments encrypted under different keys are accepted. - **Cache Attack Verification** — Tests whether fragments remain in memory after disassociation or reconnection. - **Plaintext Injection Checks** — Detects acceptance of plaintext frames in encrypted networks. - **Broadcast Fragment Testing** — Assesses vulnerabilities related to broadcast frame handling. - **EAPOL Frame Attack Simulation** — Tests for cloaking attacks using EAPOL frames within A-MSDU aggregates. - **Multiple Interface Modes** — Supports mixed mode (single card), injection mode (two cards), and experimental hwsim mode. - **Comprehensive Test Suite** — Includes sanity checks, basic behavior tests, and extended vulnerability tests. - **Driver and Firmware Patching** — Provides patched Linux drivers and firmware for compatible network cards. ## Philosophy FragAttacks aims to provide a rigorous, open-source tool for uncovering fundamental Wi-Fi security flaws, emphasizing practical testing over theoretical analysis to help secure real-world networks.
isfISF(Industrial Control System Exploitation Framework)，a exploitation framework based on Python
CVE-2016-6366Public repository for improvements to the EXTRABACON exploit
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.