Supported firmware: 7.00 through 13.60.

Usage

In the network settings, set Primary DNS to 45.56.67.85 (Recommended)

Run python serve.py locally, or open https://ntfargo.github.io/Relapse-Exploit/ on the PS5.

The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021 .

Stability notes

Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.

Exploit chain

Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an aio_multi_wait uaf race to establish kernel r/w.

Credits

ntfargo, ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.

Disclaimer

This project is intended for educational and security research purposes only .…