Skip to content

Attack Chain — Principal

Current Path (Complete)

nmap (22,8080) → Jetty + pac4j-jwt/6.0.3 → app.js reveals auth flow + /api/auth/jwks → CVE-2026-29000: forge unsigned JWT → JWE encrypt with public key → Admin dashboard (ROLE_ADMIN) → /api/settings leaks encryptionKey: D3pl0y_$$H_Now42! → SSH as svc-deploy → Read CA private key (/opt/principal/ssh/ca) → Sign SSH cert for root principal → SSH as root

Branch Points

1. JWKS Discovery

  • Tried: /.well-known/jwks.json → 404
  • Solution: Read app.js from DevTools Network tab → found /api/auth/jwks
  • Lesson: Always check client-side JS for non-standard API paths

2. Token Forgery Method

  • Chosen: Manual craft via jwt.io + authgear JWE debugger
  • Key detail: "alg": "none" inner JWT + JWE wrap with RSA public key = CVE-2026-29000

3. SSH Password Discovery

  • Found: encryptionKey: D3pl0y_$$H_Now42! in /api/settings
  • Gotcha: $$ gets shell-expanded — must single-quote the password
  • Lesson: Secrets leaked in web admin panels often double as service account passwords

4. Privilege Escalation Vector

  • Chosen: SSH CA cert signing — svc-deploy (deployers group) can read CA private key
  • Method: ssh-keygen -s ca -I id -n root key.pub → SSH as root with signed cert
  • Lesson: Write to /tmp when target dir isn't writable