Rocket Chat
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2Fpentest.eu%2FRENDER_WebSec_10fps_21sec_9MB_29042024.gif&width=768&dpr=4&quality=100&sign=bc0743d1&sv=1)
RCE
If you are admin inside Rocket Chat you can get RCE.
Got to
Integrations
and selectNew Integration
and choose any:Incoming WebHook
orOutgoing WebHook
./admin/integrations/incoming
According to the docs, both use ES2015 / ECMAScript 6 (basically JavaScript) to process the data. So lets get a rev shell for javascript like:
Configure the WebHook (the channel and post as username must exists):
Configure WebHook script:
Save changes
Get the generated WebHook URL:
Call it with curl and you shuold receive the rev shell
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2Fpentest.eu%2FRENDER_WebSec_10fps_21sec_9MB_29042024.gif&width=768&dpr=4&quality=100&sign=bc0743d1&sv=1)
Last updated