PsFree – Webkit exploit for PS4 6.00 to 9.60 and PS5 1.00 to 5.50 + QuickHEN toolkit announced

QuickHEN – an upcoming all-in-one webkit toolkit which will include the PsFree exploit

Developer CelesteBlue has announced PsFree, a brand new Webkit exploit for PS4 6.00 to 9.60. A release (or pre-release) of the exploit is already available. The exploit should also work on PS5 1.00 to 5.50.

This Webkit exploit is based on CVE-2022-22620 by security researchers Sergei Glazunov and Maddie Stone. the PS4/PS5 implementation was originally done by scene member “abc” on the PlayStation Devwiki Discord forum, with further improvements and implementation by CelesteBlue.

Furthermore, Celesteblue has announced QuickHEN PS4 (screenshot above), an upcoming all-in-one toolkit which will have all the necessary webkit exploits for PS4 3.15 to 9.60 (and will include kernel exploits for supported firmwares).

Disclaimer: at the time of publishing, the PsFree release is extremely recent and is still undergoing testing by the hacking community. Results aren’t guaranteed. If you can’t handle the uncertainty, please wait until the dust settles down on this, as I’m sure bug fixes will be coming soon. Testers are reporting errors and issues in the currently circulating release.

What is PsFree for PS4/PS5

PsFree is a (work in progress) webkit exploit for PS4 firmwares 6.00 to 9.60, and for PS5 1.00 to 5.50. It is based on CVE-2022-22620 by security researchers Sergei Glazunov and Maddie Stone. The PS4/PS5 version was implemented by abc and CelesteBlue.

A webkit exploit, in the context of PS4/PS5 hacking, is a usermode exploit. It allows limited access to run unsigned code on the console. While in theory it could be used to run homebrew games, in practice such exploits are typically used as entry points or attack vectors for privilege escalation (aka kernel exploits). In other words, a usermode exploit such as this one is usually not very useful on its own for the end user, but once combined with a kernel exploit, can lead to a Jailbreak of the console.

There are kernel exploits publicly available on the PS4 (up to firmware 9.00) and PS5 (up to Firmware 4.51) as of this writing. Although these kernel exploits are already used in combination with other usermode entry points, the benefits of this webkit exploit are as follows:

1. On firmwares with an existing entry point/kernel exploit combination, it could be used to replace the existing exploit, possibly offering a more stable implementation (see below)
2. On firmwares that do not yet have a kernel exploit, it can be used as an entry point in the future, once such kernel exploits are found. For security researchers, it also provides a ready-to use entry point to dig further into the machines

CelesteBlue says the exploit is extremely fast and stable. On PS4 in particular, it could replace the p00Bs4 exploit, which currently requires a usb key with a particular format. A reliable webkit exploit will be more convenient for lots of people.  Important Update: I got my kernel and user mixed up! pOOBs4 will of course still be required (and therefore, so will the usb key) since it is the kernel exploit!!! pOOBs4 already uses a Webkit exploit as its entry point currently, and only that part could potentially be replaced.

The developer has released a video showcasing the speed of the exploit.

Finally a fast and stable WebKit exploit for PS4 System Software versions 6.00 to 9.60. Credits to Sergei Glazunov and @maddiestone for discovering vulnerability, anonymous for writing PsFree exploit and to myself for testing, porting and improvements. Showcase on PS4 9.00: pic.twitter.com/5JgdomWr5P

— CelesteBlue (@CelesteBlue123) December 3, 2023

Current status of PsFree

Although CelesteBlue hasn’t provided an “official” download link yet, PsFree can be found on the relevant Discord servers, and has been circulating on twitter already. This might not be an “official” release yet though, and people have been reporting issues with what I personally would consider a beta at this point. Feel free to use it, but don’t expect stellar results for now.

“Failed Spray” error message – Source @Draqen88

PS5 tested 8.20 pic.twitter.com/yRPI8AgfDp

— Master (@master_s9) December 3, 2023

Download and test PsFree

Do keep the disclaimers above in mind, that this is a very recent release and results might vary at this point.

The easiest way to test the PSFree Webkit exploit is to point your PS4 or PS5’s web browser to Zecoxao’s public host at https://zecoxao.github.io/psfree/

To use your PS4/PS5 browser and redirect it to such a host, you’ll generally want to use a DNS which will redirect playstation.net to the host. Master_s9 has an alternate way to use the browser onPS5 as follows:

How to open the PS5 web browser 8.20 pic.twitter.com/7nbrAa5qC7

— Master (@master_s9) December 3, 2023

Alternatively if you want to host the exploit yourself, you can download it here. You’ll want to setup your own host locally.

• We have a guide on how to do that for PS5 here.

Source: Celesteblue