Rocket - CVE-2021-22911 NoSQL Injection + Ruby cap_setuid to Root | TryHackMe

It sounds like you've provided an in-depth walkthrough of a penetration testing scenario, focusing on exploiting vulnerabilities within a Dockerized Rocket.Chat environment to gain administrative access and move laterally to other services running internally. Let's break down the key points and steps involved:

1. Initial Exploitation

Blind NoSQL Injection:

• The initial phase involves extracting reset tokens for both low-privilege ([email protected]) and admin accounts via a blind NoSQL injection attack.
• This is achieved by sending crafted requests to the password reset endpoint, which allows incremental matching of characters in the stored token.

Webhook Creation & Shell Execution:

• Once the admin account's password is changed, an integration webhook is created within Rocket.Chat.
• A reverse shell payload is triggered via this webhook, establishing a connection back to the attacker’s machine (listening on port 4444).

2. Post-Exploitation

Container Environment Inspection:

• Upon gaining access inside the Docker container, environment variables reveal internal network details:
  • MongoDB instance at 172.17.0.2:27017
  • Mongo Express interface at `172.

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.