Kernel Privilege Escalation in Apple OSes (CVE-2024-23208)

This repository is a proof-of-concept (PoC) exploit for CVE-2024-23208, a vulnerability in Apple's flow-divert kernel subsystem affecting iOS and possibly macOS. The project is structured as an Xcode workspace with two main components: 'usprebooter' (an iOS/macOS app) and 'keyboardy' (a custom keyboard extension). The exploit leverages extensive entitlements (as seen in ent.plist) to gain privileged access to kernel and XPC interfaces, which are not available to standard apps. The core exploit logic is implemented in Objective-C (usprebooter/thing.m and keyboardy/bruh.m). The exploit establishes a Unix domain socket (group.pisshill/socket2.text) for inter-process communication between the app and the keyboard extension, passing file descriptors and manipulating socket options to interact with the kernel's flow-divert control interface (com.apple.flow-divert). The code demonstrates the ability to extract sensitive kernel data (such as PCB hash values) and manipulate kernel state, which could be used for privilege escalation or further exploitation. The repository includes Swift UI code for the app interface and logging, but the main exploit logic is in the Objective-C files. The exploit is not weaponized for remote exploitation; it is a local privilege escalation PoC requiring installation on a vulnerable device with appropriate entitlements. No network endpoints or remote attack vectors are present; all communication is local via Unix domain sockets and kernel interfaces. The repository is well-structured for research and demonstration purposes, with clear separation between UI, exploit logic, and entitlements.