// the find
TheOfficialFloW/PPPwn
PPPwn - PlayStation 4 PPPoE RCE
PPPwn is a kernel RCE exploit for PS4 firmware 7.00 through 11.00, targeting a heap overflow in the PPPoE network stack (CVE-2006-4304). It's a proof-of-concept from a responsible disclosure to Sony — it prints 'PPPwned' on screen and nothing more. The audience is PS4 homebrew developers who want to adapt the stage2 payload for Mira or similar.
The exploit chain is well-staged and transparent — KASLR defeat, heap grooming, and arbitrary payload execution are all discrete steps with logged output so you can see exactly where a failure occurs. Supporting 20+ firmware versions with per-version offset tables in offsets.py is genuinely useful maintenance work. The Mac ARM workaround via Docker and the build-macarm.sh script shows someone actually thought about the developer experience beyond 'just use Linux'. Responsible disclosure to PlayStation before release is worth noting.
This is a PoC with no payload — it proves the bug works but shipping something useful requires separate work to port or write a stage2 binary, which is completely undocumented here. The exploit is timing-sensitive and non-deterministic; the README admits it can fail silently and you just retry, which is a bad sign for anything built on top of this. Linux-only for the attacker machine (or a VM with bridged networking) is a real friction point that the Docker workaround only partially solves. Last commit was June 2024 and FW 11.00 is the ceiling — if Sony ships 11.50 or 12.x, this is dead with no clear path to update the offsets.