CVE-2024-23222-Coruna-Exploit-Kit-Deobfuscated

Comprehensive deobfuscated research of the Coruna iOS exploit kit targeting CVE-2024-23222. Analysis of WebKit Type Confusion, PAC Bypass, and Sandbox Escape

The execution flow is divided into several sophisticated stages:

• Platform Detection: Identifying iOS versions, checking lockdown mode, and simulator status via platform_module.js.
• Stage 1: WASM Memory Primitives: Utilizing WASM-based memory corruption to build addrof and fakeobj primitives.
• Stage 2: PAC Bypass: Corrupting Intl.Segmenter iterator vtables to redirect virtual method calls through ARM64 gadgets for PAC signing.
• Stage 3: Sandbox Escape: Orchestrating Mach-O parsing and symbol resolution to escape the WebKit sandbox.
• Stages 4-6: Payload Delivery: Final delivery of the encrypted binary blob and the PLASMAGRID stager.

📂 Repository Structure

📊 MITRE ATT&CK® Mapping

• Initial Access: T1190 - Exploit Public-Facing Application
• Execution: T1059 - Command and Scripting Interpreter (JavaScript)
• Privilege Escalation: T1068 - Exploitation for Privilege Escalation
• Defense Evasion: T1574.001 - Hijack Execution Flow: Code Cache Poisoning

🧪 Deobfuscation Methodology

The analysis involved reversing several layers of obfuscation applied to the original source:

• XOR-Encoded Strings: Mapping character codes to bypass static analysis.
• SHA1-Keyed Module System: Identifying asynchronous modules via SHA256 filename hashing.
• XOR-Masked Constants: Decoding numeric values hidden via bitwise XOR operations.

⚠️ Disclaimer

This research is for educational and defensive security purposes only. Unauthorized testing on third-party devices is strictly prohibited and may be illegal.