PS5 Relapse Exploit

PS5 Relapse Exploit PS5 Relapse 漏洞利用

Supported firmware: 7.00 through 13.60. 支持的固件版本：7.00 至 13.60。

Usage 使用方法

In the network settings, set Primary DNS to 45.56.67.85 (Recommended). Run python serve.py locally, or open https://ntfargo.github.io/Relapse-Exploit/ on the PS5. The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021. 在网络设置中，将首选 DNS 设置为 45.56.67.85（推荐）。在本地运行 python serve.py，或者在 PS5 上打开 https://ntfargo.github.io/Relapse-Exploit/。默认的 Payload 存储在 payloads/ 文件夹中；运行成功后，ELF 加载器将监听 9021 端口。

Stability notes 稳定性说明

Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens. Webkit 可能需要多次尝试才能成功，如果浏览器卡住，请刷新页面。内核漏洞利用可能会导致主机死机或内核崩溃（Panic），如果发生这种情况，请重启后再试。

Exploit chain 漏洞利用链

Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an aio_multi_wait uaf race to establish kernel r/w. 浏览器阶段利用 JSC 信息泄露和结构化克隆对象池不匹配来破坏 TypedArray。内核阶段结合了地址泄露和 aio_multi_wait 的 UAF（释放后重用）竞争条件，从而建立内核读写权限。

Credits 致谢

ntfargo, ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion. ntfargo, ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion。

Disclaimer 免责声明

This project is intended for educational and security research purposes only. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations. The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage. 本项目仅用于教育和安全研究目的。它不支持盗版、未经授权的访问或滥用商业设备。请仅在您拥有或获得授权测试的设备上使用，并遵守相关法律法规。本软件按“原样”提供，不提供任何保证。您需自行承担使用风险，包括系统不稳定、数据丢失和账号封禁等。维护者不对由此产生的任何损害承担责任。