Credentials — Principal¶
| User | Password/Hash | Type | Source | Access Granted | Tested |
|---|---|---|---|---|---|
| admin (forged) | JWT with alg:none | Forged JWE token | CVE-2026-29000 | Web admin dashboard | Yes - works |
| svc-deploy | D3pl0y_$$H_Now42! | Password (leaked as encryptionKey) | Admin settings page (/api/settings) | SSH shell | Yes - works (single-quote the $$!) |
| root | SSH cert signed by CA | SSH certificate | /opt/principal/ssh/ca (CA private key) | Root shell | Yes - works |
Notes¶
D3pl0y_$$H_Now42!listed asencryptionKeyin Security settings — could be SSH password for svc-deploy or the JWT encryption secretsvc-deployis a service account for "automated deployments via SSH certificate auth"- sshCertAuth: enabled, sshCaPath:
/opt/principal/ssh/ - SSH cert CA config at
/opt/principal/ssh/on the target
All Users (from /api/users)¶
| Username | Name | Role | Department | Status | Notes |
|---|---|---|---|---|---|
| admin | Sarah Chen | ROLE_ADMIN | IT Security | Active | |
| svc-deploy | Deploy Service | deployer | DevOps | Active | Service account for automated deployments via SSH certificate auth |
| jthompson | James Thompson | ROLE_USER | Engineering | Active | Team lead - backend services |
| amorales | Ana Morales | ROLE_USER | Engineering | Active | Frontend developer |
| bwright | Benjamin Wright | ROLE_MANAGER | Operations | Active | Operations manager |
| kkumar | Kavitha Kumar | ROLE_ADMIN | IT Security | Disabled | Security analyst - on leave until Jan 6 |
| mwilson | Marcus Wilson | ROLE_USER | QA | Active | QA engineer |
| lzhang | Lisa Zhang | ROLE_MANAGER | Engineering | Active | Engineering director |