Privileged Code Execution via Kernel Memory Corruption in Apple iOS/OS X/tvOS/watchOS

This repository contains a local privilege escalation exploit for OS X Yosemite 10.10.5 (build 14F27), targeting CVE-2016-1758 (kernel info leak) and CVE-2016-1828 (use-after-free in OSUnserializeBinary). The exploit is implemented in C and consists of several components: - `main.c`: Entry point, orchestrates the exploit steps. - `kernel_image.c/h`: Loads the kernel binary and resolves symbols/gadgets needed for the ROP chain. - `kernel_slide.c/h`: Leaks kernel memory to recover the kernel slide (ASLR offset) using CVE-2016-1758. - `kernel_rop.c/h`: Constructs and executes a ROP payload that manipulates kernel structures to set the saved user ID to 0, exploiting CVE-2016-1828. - `Makefile`: Builds the exploit as a 32-bit binary with special linker flags to allow mapping the NULL page, which is required for the exploit to work. The exploit works by leaking the kernel slide, building a ROP chain in the NULL page, and triggering a use-after-free in the kernel to execute the ROP chain. If successful, it escalates privileges and spawns a root shell (`/bin/sh`). The exploit is operational and requires local access to a vulnerable system. No network endpoints are involved; all actions are performed locally. The code is well-structured and modular, with clear separation between kernel parsing, info leak, ROP construction, and exploit orchestration.