@CTurtE

hacking at *undisclosed*

cturt.github.io/
Joined October 2013
  • Tweets269
  • Following616
  • Followers15.8K
18Media
CTurt retweeted
Mochi
@madebymochiOct 21
PS4 GAME ON PS5 WITHOUT A JAILBREAK ghostldr gets Ghost of Tsushima running through Star Wars Racer Revenge using the Luac0re exploit it's limited to the 4.5GB RAM available inside that game, so memory-heavy titles may struggle video and repo by asylumexp
12
18
5
401
37,831
Cool to see the N64 cartridge swap exploit finally released publicly. I originally found this back in 2024, but couldn’t publicly release it for contractual reasons. Here’s an old demo using it for region lock bypass, chained with RCE from shogihax: youtu.be/09TN1CvoWo0
Ted@goilupMay 26
Replying to @goilup
Sorry I did not realize the reach this post would have, here's the github repo, please support the original developer github.com/mntorankusu/N64-S…

GitHub - mntorankusu/N64-SwapDumper: Cartridge dumper for N64 games, requiring only a flash cart.

Cartridge dumper for N64 games, requiring only a flash cart. - mntorankusu/N64-SwapDumper

github.com
5
29
1
267
52,609
… and just a couple of months later @gezine_dev managed to exploit the compiler process too! This completes the mast1c0re exploit chain for the first time, allowing for arbitrary native userland code execution on the latest PS4 / PS5 firmwares, without needing a kernel exploit
CTurt@CTurtEJan 13
Very cool to see new progress with the mast1c0re exploit :)
43
60
5
576
86,550
Very cool to see new progress with the mast1c0re exploit :)
This quoted post is unavailable.
Try viewing anyway · View on X
7
8
1
190
117,747
Interesting FreeBSD advisory: freebsd.org/security/advisor… It’s the first path traversal I’ve seen where the kernel itself is returning filenames with ../ (normally path traversal bugs are at the application-level). ‘Universal Path Traversal’ (akin to UXSS) could be a new bug class?
6
13
1
127
19,187
i'm excited to share Collateral Damage, a kernel exploit for SystemOS on Xbox One/Series consoles! this initial release is mostly intended for developers, but i hope people will enjoy playing around with it! writeup and more updates in the near future :) github.com/exploits-forsale/…

GitHub - exploits-forsale/collateral-damage: Kernel exploit for Xbox SystemOS using CVE-2024-30088

Kernel exploit for Xbox SystemOS using CVE-2024-30088 - exploits-forsale/collateral-damage

github.com
58
285
21
1,201
191,342
finally... hello, PS5 PSP :)
127
237
50
1,486
354,484
CTurt retweeted
CTurt@CTurtE2 Apr 2023
Part 2 - Attacking the compiler process: cturt.github.io/mast1c0re-2.… Ultimately I didn't finish the exploit, but hopefully it's still interesting, and maybe we will see a full exploit implementation from someone else in the future.
38
91
4
357
65,260
New blog post! Part 1 in my new PlayStation hacking series: An **unpatched** PS4 / PS5 userland exploit that also allows pirating PS2 games. mast1c0re: Hacking the PS4 / PS5 through the PS2 emulator - Part 1 - Escape: cturt.github.io/mast1c0re.ht… Video demo: youtube.com/watch?v=GIl1mR0H…
61
299
20
1,196
Part 2 - Attacking the compiler process: cturt.github.io/mast1c0re-2.… Ultimately I didn't finish the exploit, but hopefully it's still interesting, and maybe we will see a full exploit implementation from someone else in the future.
38
91
4
357
65,260
For a variety of reasons, it’s time for me to move on from the PlayStation hacking scene. I’m very thankful to have met some great people through this hobby over the years, and for the boost it’s given my security career. Some of the highlights for me were:
116
49
7
656
99,887
more replies
mast1c0re: The first public PS4/5 userland exploit targeting a game instead of part of the operating system, making it the only one still unpatched on the latest firmware versions.
CTurt@CTurtE14 Sep 2022
New blog post! Part 1 in my new PlayStation hacking series: An **unpatched** PS4 / PS5 userland exploit that also allows pirating PS2 games. mast1c0re: Hacking the PS4 / PS5 through the PS2 emulator - Part 1 - Escape: cturt.github.io/mast1c0re.ht… Video demo: youtube.com/watch?v=GIl1mR0H…
2
100
21,023
Working with the PlayStation team through the bug bounty program and successfully being awarded several $10k bounties.
CTurt@CTurtE11 Mar 2022
6 months later and I’m still receiving new bounties from PlayStation. Just wanted to say: I’m very happy with my interactions with this team, and I can’t wait to disclose some of the findings!
2
1
105
18,047
This will be my last month at Google! (my decision was unrelated to layoffs) So thankful to have had the opportunity to work with such incredible colleagues, and contribute to such an impactful mission. Looking forward to starting my next adventure.
37
7
1
265
46,430
Very cool to see public reimplementations of the first part of my mast1c0re exploit chain, especially when tested on the latest PS5 firmware.
McCaulay
@_mccaulay24 Jan 2023
PS5 (latest firmware) PoC for mast1c0re vulnerabilities. Arbitrary PS2 code execution and native PS5 ROP chain execution. Technical details on @CTurtE's blog post: cturt.github.io/mast1c0re.ht…
26
71
2
467
107,999
1/ Last week I open sourced a library I wrote at Google to mitigate a class of YAML injection vulnerabilities (github.com/google/safetext).

GitHub - google/safetext

Contribute to google/safetext development by creating an account on GitHub.

github.com
1
13
103
2/ It's a common pattern in Go code to use text/template from the standard library to produce YAML. Since text/template is just intended for plaintext manipulation and has no awareness of YAML syntax, this pattern is at high risk of injections. Example: go.dev/play/p/G1j4s_YpS0I

Go Playground - The Go Programming Language

go.dev
1
14
3/ These YAML injection vulnerabilities can have impact as severe as Remote Code Execution! In these instances, safetext/yamltemplate can instead be used as a drop-in-replacement for text/template, that will refuse to return results where a YAML injection would have occurred.
13
Load more