CVE-2025-24085

This exploit leverages a vulnerable macOS LaunchDaemon plist configuration to execute arbitrary commands with root privileges. It creates a root payload script that adds a root shell binary, creates an admin user, and installs a persistent LaunchDaemon backdoor for root access.

This repository contains a detailed writeup of the Glass Cage exploit chain targeting iOS 18.2.1, which involves a zero-click PNG-based attack leveraging CVE-2025-24085 (Core Media privilege escalation) and CVE-2025-24201 (WebKit RCE). The attack chain is described as being used in the wild and includes steps for achieving root access and persistence.

This repository contains a detailed technical analysis of a zero-click RCE exploit chain (CVE-2025-24085 and CVE-2025-24201) targeting iOS 18.2.1 via malicious PNG files sent through iMessage. The report includes exploit chain breakdown, log evidence, and mitigation recommendations.