To the best of my knowledge, it's just the black gun powder in the center exploding. And you hear it after seeing it because it's far away, and sound is slooooooooow.
Anything you here is a result of a pressure wave propagating through the air.
When the explosive charge in a firework ignites the combustion wants to rapid expand and occupy a much larger volume of space, but initially it is contained in a very small space defined by the firework's packaging.
When the pressure from the explosive combustion reaches a critical threshold, the firework's packaging fails and the combustion rapidly expands into a much greater space/volume. In doing so, the pressure immediately around the explosive event is increased dramatically and in order to equalize the pressure at the point of the event to that of where you are standing (listening) this pressure produces a pressure wave (imagine spherical shells of decreasing pressure from the point of the firework explosion to a point where you are standing.
Its much like a cone driver in a speaker, really. I voice-coil servers to push air immediately in front of the cone and in doing so increases the atmospheric pressure at the cone's outer surface. This increased pressure equalizes as it propagates away from the driver.
What makes the boom in a firework is the minature built-in subwoofer that produces a single 40hz transient @ over 100db that then incinerates during the blast.
The firework industry works for the government in testing the devasting micro woofers capable of subsonic SPL of over 150db from a 1" driver.
I have 2 of these drivers myself and I put them in my cellphone that will sound when the president calls me.