J.Rafa Ramón

Ingeniero. Desarrollador de software. Organizador y liante oficial de eventos de birras. Escéptico, campechano, revoltoso y atolondrado. Newbie hacker.

[J.Rafa Ramón @jrafaramon]

Corrección y bajonazo. Kernel dump Ring 3.

[J.Rafa Ramón @jrafaramon]

Lo que tengo:
1. UAF + ARW
2. Resolución dinámica de bases
3. Tabla de syscalls userland
4. Gadgets ROP userland básicos (6/26)
5. Dump RAM kernel 13.02 Ghidra
6. Dumpeador funcional
Lo que me falta:
1. Vector de ataque al kernel 13.02
2. Gadgets ROP userland restantes (~20)

[J.Rafa Ramón @jrafaramon]

@ElkinIdarragaV Perdona, pero no entiendo la pregunta.

[J.Rafa Ramón @jrafaramon]

@Lawrence_Ortiz Son las referencias que usa poopsploit 26 gadgets. De momento solo tengo 6, utiles para tartar de actualizar las referencias y ver si sigue funcionando.

[J.Rafa Ramón @jrafaramon]

Avance:

[J.Rafa Ramón @jrafaramon]

@cjtl_2 La verdad es que no tengo nada. Pero día a día avanzo en este nuevo vicio de tratar de entender y sacar algo de provecho. Soy nuevo completamente, pero por cabezon lo saco. Me cansé de esperar la update y luego a Gezine. Si el puede el resto también.

[J.Rafa Ramón @jrafaramon]

No se lo que tengo entre manos… 13.02

[J.Rafa Ramón @jrafaramon]

Confirmed, it is the kernel.

[J.Rafa Ramón @jrafaramon]

@Slient_Logic If you have kernel 13.02, it would save me the trouble of trying to figure out whether or not that I have is the kernel 13.02.

[J.Rafa Ramón @jrafaramon]

@Danielxdddq Pues en teoría es un dump del kernel pero no estoy seguro.

[J.Rafa Ramón @jrafaramon]

@Slient_Logic @Online_guy1256 Right!

[J.Rafa Ramón @jrafaramon]

@RoshiYujin40025 I will send you the guide. But from now, burn the images and check if something happens.

[J.Rafa Ramón @jrafaramon]

If you have a PS4 running version 13.02 and a Blu-ray burner, I need your help:

https://t.co/mCDHo5uGZF

[J.Rafa Ramón @jrafaramon]

@JatinVe53647442 @theflow0 @gezine_dev @MODDED_WARFARE @Haideraloba @RobinsonPauli18 https://t.co/ZJu1KLicii

[Gezine @gezine_dev]

Thanks SiSTRo for providing new 13.50 goldhen beta

[J.Rafa Ramón @jrafaramon]

@JatinVe53647442 @theflow0 @gezine_dev @MODDED_WARFARE @Haideraloba @RobinsonPauli18 Gezine has already finished the entire workflow, as he mentioned in a post, but he's not going to share it. This is for those of us who started the sequence without him and without the scene.

[J.Rafa Ramón @jrafaramon]

@okaua021 6. an internal analysis to search for the KEX, if it exists. And this is the best-case scenario. As you can see, it takes time and luck, and now you need a Blu-ray burner to get started.

[J.Rafa Ramón @jrafaramon]

@okaua021 5. If a KEX is found, we’ll need to figure out how to trigger a payload to load the GoldHen version on 13.02. Current status: we’ve managed to open the vault door; next step is to figure out how to open each of the padlocked boxes inside the vault. We still need to perform

[J.Rafa Ramón @jrafaramon]

@okaua021 4. tested it. If it works, this could let you read memory and access files that you previously listed but couldn’t read. If this works, you’ll be able to obtain system files, run them through Ghidra to view their contents, and decompile them to try to find a KEX (Kernel exploit)

[J.Rafa Ramón @jrafaramon]

@okaua021 3.or at least I haven’t managed to achieve it.

On the other hand, there’s Gezine’s BDJ. This allows you to enter from the reader with root permissions (UUID=0, privilege escalation), unlike on the web where you’re just a web user (UUID=1). In theory, at least, since I haven’t

[J.Rafa Ramón @jrafaramon]

@okaua021 2.After reviewing WebKit, vue-after-free remains a valid method for uploading payloads and auditing the web user and the WebKit environment, which is contained within a jail—and I haven’t been able to escape from there. There’s no privilege escalation

[J.Rafa Ramón @jrafaramon]

@okaua021 1.Let me explain the current situation with 13.02, or at least what I’ve observed while trying to make some progress.