[+] Create SSH server with mickey user and provide it to the app
[+] Listen to the incoming SSH connection. Retrieve the public key used for authentication and the sent command 
echo NDH{a_WInN3r_15_A_Dr3AMeR > ~/flag_1.txt
```import socketfrom paramiko import paramikoimport threadingimport sysimport traceback# using the key from the Paramiko demo fileshost_key = paramiko.RSAKey(filename='test_rsa.key')paramiko.util.log_to_file("filename.log")class Server (paramiko.ServerInterface):    def __init__(self):        self.event = threading.Event()    def check_channel_request(self, kind, chanid):        if kind=='session':            return paramiko.OPEN_SUCCEEDED        return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED    def check_auth_none(self, user):        return paramiko.AUTH_FAILED    def check_auth_password(self,user, password):        print(user, password)        return paramiko.AUTH_FAILED    def check_auth_publickey(self, username, key):        print (key.public_numbers)        print('Auth attempt with key: ' + key.get_fingerprint().encode('hex'))        return paramiko.AUTH_SUCCESSFUL    def get_allowed_auths(self, username):        return 'password,publickey'    def check_channel_exec_request(self, channel, command):        print('Command:', command)        self.event.set()        return Trueserver = sys.argv[1]ssh_port = int(sys.argv[2])try:    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)    sock.bind((server, ssh_port))    sock.listen(100) # Wow so many connections    print ("[+] Listening for connection ...")    client, addr = sock.accept()except Exception, e:    print("[-] Listen failed: " + str(e))    traceback.print_stack()    sys.exit(1)print("[+] Got a connection!") # runs as except exitstry:    bhSession = paramiko.Transport(client)    bhSession.add_server_key(host_key)    server = Server()    try:        bhSession.start_server(server=server)    except paramiko.SSHException, x:        print("[-] SSH negotiation failed.")    print("[+] Authenticated!")    chan = bhSession.accept(20)    print(chan.recv(1024))except Exception, e:    print("[-] Caught exception: " + str(e))    try:        bhSession.close()    except:        pass    sys.exit(1)```
[+] Determine private exponent d using Boneh Durfee attack on RSA based on the given (e,n) from retrieved public key[https://github.com/mimoo/RSA-and-LLL-attacks/blob/master/boneh_durfee.sage](https://github.com/mimoo/RSA-and-LLL-attacks/blob/master/boneh_durfee.sage)
[+] Contruct private key mickey.key (PEM)
[+] ssh -i mickey.key [email protected] -p 2222 using mickey.key private key 
[+] cat flag_2.txt_Wh0_NeV3R_gIve5_uP}