search

xfangfang / PPPwn_cpp

C++ rewrite of PPPwn (PlayStation 4 PPPoE RCE)
GNU General Public License v3.0
383 stars 51 forks source link

PPPwn trought VLAN and Managed Switch #66

Open Gouster4 opened 3 months ago

Gouster4 commented 3 months ago

Hello. I successfully jailbroken my PS4 using direct connection to PC with PPPwn_cpp. I would like to run jailbreak from my OPNSense firewall/router. Its FreeBSD based OS. I compiled PPPwn_cpp directly on router, and it seems to be running.
But im stuck at: [*] Waiting for PADR...

I do not have direct connection to PS4, and that can be a problem.

I am using VLANS on OPNSense, and assigning them as Untagged on Cisco managed switch.

So, PS4 is on my LAN, which is vlan1 interface on OPNSense, and its Untagged on multiple ports of managed switch. As its untagged, PS4 has no clue that traffic comes from VLAN.

Is there any way to get this working over VLAN? If so, are there some recommendations about settings that can possibly prevent it working trought VLAN?

xfangfang commented 3 months ago

I suggest not introducing too many variables. First, test whether it can work under freebsd before considering the issue of VLAN. I forgot where I saw it, but someone has said that he can run pppwnd_cpp normally using VLAN

Gouster4 commented 3 months ago

I suggest not introducing too many variables. First, test whether it can work under freebsd before considering the issue of VLAN. I forgot where I saw it, but someone has said that he can run pppwnd_cpp normally using VLAN

Thank you for suggestion. I can try it with USB Ethernet adapter.

Gouster4 commented 3 months ago

With usb ethernet adapter its working. So, i can confirm OPNSense/FreeBSD compatibility. This means root of issue can be: -VLAN itself (unlikely as some users reported it is working over vlan) -Running it on firewall, so some traffic can be possibly blocked -Running trought managed switch, so there can be also some traffic not being passed.

So, i would like to ask, what kind of traffic does PPPwn require? IGMP or ICMP, or UDP port or TCP port, or some combination of them? Target specific ip, or multicast/unicast or whatever can it be?

I dont understand how those works, specially multicast. but i know both Firwall and managed swithch have separate settings for it, so can possibly block that traffic.

Gouster4 commented 3 months ago

So, I tried it from FreeBSD without VLAN, and it was working. But once I added VLAN, it stopped working. I also tried regular PPPoE server, which was working with and without VLAN.

Only thing comes to my mind is some limits in PPPoE packets, as PPPwn is regular PPPoE, but it's pushing it to the limits. One example I noticed is service name length. Maybe other things that I didn't noticed.

I don't know what exactly can be reason, but I thought about MTU. What is minimal recommended MTU? Jumbo frames are required?

xfangfang commented 3 months ago

if you always stuck at: [*] Waiting for PADR... when using VLAN, Then it shouldn't be a problem with MTU. (btw 1500 is fine)

I think the problem may be related to multicast.

This is the post I saw where someone said he can use VLAN to run pppwn (in Chinese): https://tieba.baidu.com/p/9015522053

Gouster4 commented 3 months ago

Interesting. I don't understand much about multicast. I tried some settings, but without any success. But PPPoE server (mpd5 for internet access) is working. Is there something related to multicast that differs on PPPwn and regular PPPoE (for internet connection)?

xfangfang commented 3 months ago

A real pppoe server will use the real MAC address of your device. But pppwn will use some fake MAC address. These fake MAC addresses are multicast MAC address.

Gouster4 commented 3 months ago

Thank

A real pppoe server will use the real MAC address of your device. But pppwn will use some fake MAC address. These fake MAC addresses are multicast MAC address.

Thank you. This seems to be most likely reason. Currently I'm having trouble with Multicast settings, as I never used it before. Can you please leave this Open, so once I figure out multicast in my network, I can confirm it working or keep looking for other possible reason. Thank you.

Gouster4 commented 3 months ago

I can't get it working. But once I get home, I will try dedicated USB Ethernet adapter for PPPwn, connected to untagged vlan port (same vlan as PS4), and see if it works. Now I'm running PPPwn on device which has tagged VLANs. Maybe PPPwn isn't able to change mac adress to multicast one, as VLAN interfaces share Mac address with their parent interface. I thought about using VLANs, because I got low speed over USB adapter. But for PPPwn it should be enought, and then for PPPoE server I will use tagged vlan.

So, my problem seems to be not running thought VLAN, but having tagged VLAN on device which runs PPPwn I guess.

EDIT: maybe I can create bridge, with VLAN as it's member, and set Mac address on that bridge I guess.

Gouster4 commented 1 month ago

So, I wasn't able to figure out how get PPPwn working thought LAGG and VLAN using managed switch. Not even using dedicated USB Ethernet adapter to managed switch with untagged vlan port. But I can run mpd5 (pppoe server) on that vlan. So for now I'm using dumb gigabit switch, where I have connected managed switch for pppoe server (internet connection), and dedicated USB Ethernet adapter for pppwn, so I can jailbreak PS4, and then use vlan for internet access on PS4 at highest possible speed, as USB adapter is just USB 2.0.

But, when connected thought dumb switch and dedicated USB Ethernet, pppwn is working. But once connected thought managed switch, it's not. So it is clearly related to some issue on managed switch itself. (Maybe not only issue, as there is also LAGG in way if I wouldn't use USB ethernet, but that would be maybe next issue I would face once I figure out USB Ethernet working thought managed switch).