Red Team // Adversary Emulator // Maintained by byt3n33dl3
Practical technique to abuse Active Directory policy, as swag-*ss AdverXarial we can abuse it to take advantage of a user's edit rights on a Group Policy Object (GPO). This attack path can be seen from:
Prototype attack-chain allows remote execution! (RCE) in a popular workflow automation tools like n8n. Allowing adversaries to execute arbitrary code on the underlying server via expression injection in workflow definitions, under CWE/CWSS based A05:2025 Injection and A08:2025.
Most exploited React F.K.A React2Shell vulnerability, which absolute. . .blasting-ly viral on Twitter, LinkedIn, BreachFor*ms, etc. Although there is more advanced tool out-there, I believe my Python script are much reliable due to singular file.
Most of the time Pentester are using Kali, or ParrotOS. This blog are tutorial of how to download winrmrelayx from @byt3n33dl3's GitHub page, and make it ready for attack.
At the time I make this ports Kali latest version are 2025.4 the method are the same for 2025.2.
A practical scenario when having Pwn3d! indication in NetExec MSSQL protocols, most of us would run mssqlclient.py and run everything internally to get reverse-shell. This posts is an alternative to make your hands not dirty with NetExec.