HackTheBox – Principal (by IppSec) Walkthrough | pac4j-jwt, SSH CA Exploitation

In this HackTheBox machine, we enumerate a web application to discover pac4j-jwt version 6.0.3 running alongside pac4j v1 2.0, analyze JavaScript source code to find the JWKS endpoint, research and exploit CVE-2026-29000 for authentication bypass to extract encryption keys and user credentials, use NetExec to validate SSH access with discovered credentials, enumerate group memberships to find the deployers group has access to SSH Certificate Authority (CA) keys, generate SSH key pairs, sign our public key with the stolen CA to create a certificate for the root user, and finally authenticate as root using the signed SSH certificate. This machine covers modern authentication bypass vulnerabilities and advanced SSH certificate exploitation. If you're learning web exploitation, privilege escalation, OSCP, or just love seeing machines get popped... this one's for you. 📂 Scripts and Commands: https://strikoder.com/writeups/principal 🏠 Room Link: https://www.hackthebox.com/machines/p... -------- ⏱️ Timestamps: 00:00 - Intro & Target Overview 02:41 - Web Enumeration & Version Discovery 06:15 - JavaScript Source Code Analysis 07:12 - Finding JWKS Endpoint 13:44 - CVE-2026-29000 Research 17:22 - Understanding pac4j-jwt Vulnerability 21:54 - User Credential Discovery 26:45 - SSH Access as User 35:02 - Group Membership Enumeration 44:52 - Signing Certificate with CA & Authenticating as Root -------- Follow me for more real-world hacking walkthroughs, live streams, and cert prep content 👇 💻 Labs GitHub: https://github.com/strikoder 🎥 Streams & Short Content Twitch:   / strikoder   Instagram:   / strikoder   TikTok:   / strikoder   💬 Community & Discussions Discord Server:   / discord   X (Twitter): https://x.com/Strikoder 📨 Official Contact LinkedIn:   / strikoder   Email: strikoder@gmail.com More videos coming soon on PNPT and OSCP prep. Stay tuned, and thanks for the support! #oscp #pac4j #cve2026 #authenticationbypass #sshca #certificateexploitation #jwks #pt1 #hackthebox #tryhackme #portswigger #portswiggeracademy #activedirectory #linux #windows #ethicalhacking #cybersecurity #pentesting #ctf #infosec #enumeration #privilegeescalation #windowshacking #networksecurity #bugbounty #RedTeam #capturetheflag #hackingtools #cyberseclabs #hackermindset #Nmap #terminal #strikoder