Principal — HTB Writeup | The Hack Sparrow

Executive summary — Principal exposes a Java (Jetty) app protected by pac4j-jwt 6.0.3, vulnerable to CVE-2026-29000: a bug in how JWE tokens are processed that lets an unsigned inner JWT (alg: none) slip through and get accepted anyway, granting ROLE_ADMIN with no credentials at all. The admin panel leaks an «encryptionKey» that is actually a real, reused password, which a password spray against SSH reveals for the svc-deploy service account. From there, the private key of an SSH certificate CA turns out to be readable by group — combined with a missing AuthorizedPrincipalsFile, that allows signing a certificate with principal=root and authenticating straight as root.

Platform	Hack The Box
Operating system	Linux (Ubuntu 24.04.4 LTS)
Difficulty	Medium
Status	Retired
Target IP	`10.129.244.220`

Attack map

[8080] Principal Internal Platform — pac4j-jwt 6.0.3 (JWE)
   │  CVE-2026-29000 — unsigned inner JWT (alg:none) inside a valid JWE
   ▼
[BYPASS]  Forged admin authentication, no credentials
   │  /api/settings leaks an "encryptionKey" that is actually a real password
   ▼
[SSH]  Password spraying (hydra) → svc-deploy (user.txt)
   │  SSH certificate CA readable by the deployers group
   │  No AuthorizedPrincipalsFile → any signed principal maps to any system user
   ▼
[ROOT]  SSH certificate signed for principal=root

1. Reconnaissance

nmap -p- --min-rate 10000 -oN nmap_all_ports.txt 10.129.244.220

PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

nmap -sCV -p 22,8080 -oN nmap_sCV.txt 10.129.244.220

22/tcp   open  ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
8080/tcp open  http-proxy Jetty
X-Powered-By: pac4j-jwt/6.0.3
Location: /login
http-title: Principal Internal Platform - Login

The X-Powered-By: pac4j-jwt/6.0.3 header is the key clue: it reveals the Java pac4j auth framework (JWT module), version 6.0.3, vulnerable to an authentication bypass in its JWE handling.

Resumen ejecutivo — Principal expone una app Java (Jetty) protegida con pac4j-jwt 6.0.3, vulnerable a CVE-2026-29000: un bug al procesar tokens JWE que permite colar un JWT interno sin firma (alg: none) y que el servidor lo acepte igualmente, dando rol ROLE_ADMIN sin ninguna credencial. El panel de administración filtra un «encryptionKey» que en realidad es una contraseña real reutilizada, que un password spraying contra SSH revela para la cuenta de servicio svc-deploy. Desde ahí, la clave privada de una CA de certificados SSH resulta legible por grupo — combinada con la ausencia de AuthorizedPrincipalsFile, permite firmar un certificado con principal=root y autenticarse directamente como root.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu 24.04.4 LTS)
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.244.220`

Mapa del ataque

[8080] Principal Internal Platform — pac4j-jwt 6.0.3 (JWE)
   │  CVE-2026-29000 — JWT interno sin firma (alg:none) dentro de un JWE válido
   ▼
[BYPASS]  Autenticación admin falsificada, sin credenciales
   │  /api/settings filtra un "encryptionKey" que en realidad es una contraseña real
   ▼
[SSH]  Password spraying (hydra) → svc-deploy (user.txt)
   │  CA de certificados SSH legible por el grupo deployers
   │  Sin AuthorizedPrincipalsFile → cualquier principal firmado vale para cualquier usuario
   ▼
[ROOT]  Certificado SSH firmado para principal=root

1. Reconocimiento

nmap -p- --min-rate 10000 -oN nmap_all_ports.txt 10.129.244.220

PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

nmap -sCV -p 22,8080 -oN nmap_sCV.txt 10.129.244.220

22/tcp   open  ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
8080/tcp open  http-proxy Jetty
X-Powered-By: pac4j-jwt/6.0.3
Location: /login
http-title: Principal Internal Platform - Login

El header X-Powered-By: pac4j-jwt/6.0.3 es la pista clave: revela el framework de autenticación Java pac4j (módulo JWT), versión 6.0.3, vulnerable a un bypass de autenticación en el manejo de JWE.

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account