Rat5ak

CORUNA_IOS-MACOS_FULL_DUMP. Recovered samples, extracted Wasm/binaries, decoded payloads & analysis scripts from the Coruna iOS/macOS exploit kit (b27.icu). 28 JS modules, 6 Wasm, 13 ARM64 binaries.

CORUNA_TECHNICAL_ANALYSIS. A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain

CVE-2026-50343-InstallService-EoP. CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM

CVE-2025-55182-React2Shell-RCE-POC. This repository documents research into deserialization behavior within Next.js React Server Components (RSC) using the Flight protocol. It focuses on how malformed multipart bodies combined with Server Action request handling can lead to prototype traversal and execution primitives on certain builds.

StorSvc-EoP-PoC. StorSvc SprintCSP.dll DLL Hijack - Local Privilege Escalation (Standard User to SYSTEM/Admin)

NadsAI. One prompt → scaffolded app. Flask + Socket.IO UI; GPT-4o/Claude do the heavy lifting.

TryHackMe---Pyrat-Write-Up-Chaos-Path. “why doesn’t curl work??”

TPOT-OTX-Publisher. Off-box publisher stack for T-Pot + Cisco ASA that turns SSH / ADBHoney / ASA / full-honeypot telemetry into chunky, deduped AlienVault OTX pulses (IPs, URLs, hashes). Runs on its own VM over an SSH tunnel, with systemd’d schedulers and an AI-assisted brain doing the enrichment, tagging, and monthly “big boi” pulse rollups for you.

CVE-2026-31413-BPF-Container-Escape. CVE-2026-31413: BPF verifier soundness bug - container escape

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover. QNAP password reset URL injection writeup + PoC.