Remote command execution in Supervisor XML-RPC

This is a deliberately vulnerable training environment with a standalone exploit, not an exploit-framework module. Its 33 files include 16 code/build files: one Python exploit, six shell scripts, seven Terraform configurations, one Ruby Vagrantfile, and one Dockerfile. Remaining files provide deployment manifests, metadata, documentation, and licensing. The main exploit, app/poc.py, abuses CVE-2017-11610: the XML-RPC dispatcher resolves dotted method names through Python object attributes, exposing os.system. It reads the existing daemon log, discovers its configured path, executes a supplied command piped through tee -a, rereads the log, and prints the appended segment. This supports remote command execution with stdout retrieval, but not automatic interactive-shell establishment. Stderr is not explicitly redirected, concurrent log activity can contaminate results, and the script has no argument validation or exception handling. Exploit validity is supported by static inspection; no execution was performed. app/ contains the vendored exploit, an original Compose file, and English/Chinese walkthroughs. base/ documents the vulnerable Python 2.7/Supervisor 3.3.2 image and startup as nobody. isoloom.yml defines the lab, while .isoloom/ contains generated Docker, Kubernetes, Vagrant, Proxmox, and six cloud-provider deployments. checks/version.sh only verifies the reported version; generated checks test availability and outbound isolation, rather than proving exploitation. GitHub workflows validate deployments and publish approved labs, and .ctf/ supplies challenge metadata. Generated Docker deployments remove the target's default route, and Kubernetes manifests restrict egress subject to network-policy enforcement. Cloud deployments restrict SSH and port 9001 using an operator-supplied CIDR, whereas the original app/docker-compose.yml publishes port 9001 without a loopback restriction. The image is pinned by tag, not digest. Cleanup commands in CI and provisioning are consistent with lab maintenance and do not indicate a fake exploit. No hardcoded attacker host, exfiltration service, or reverse-shell callback appears in the exploit. The analyzed repository's original URL, git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata. UPSTREAM.md identifies the vendored source as https://github.com/vulhub/vulhub at commit 8fd63916f7a8711e2e01dda0d27237e4d6175d38, not necessarily the analyzed repository's own reference.

This repository is a small, focused exploit repo for CVE-2017-11610 in Supervisord. It contains one Python exploit script and one long README walkthrough. The main exploit file, exploit_supervisor.py, uses Python's xmlrpc.client to connect to a target Supervisord XML-RPC endpoint at /RPC2, then abuses recursive namespace traversal via the method path supervisor.supervisord.options.warnings.linecache.os.system to invoke os.system remotely with an attacker-supplied command. This provides remote command execution over the network against vulnerable, exposed Supervisord instances. Repository structure is minimal: README.md documents reconnaissance, validation of the exposed web UI and XML-RPC API, example target observations, impact, and remediation; exploit_supervisor.py is the operational entry point. The script accepts two command-line arguments: target_url and command. It prints status messages, builds a ServerProxy to <target_url>/RPC2, resolves the dangerous method path, and executes the provided command, reporting the returned exit code. The exploit capability is straightforward but real: arbitrary shell command execution in the privileges of the supervisord process, likely a low-privileged service account unless misconfigured. It is not a detection-only script and does not include post-exploitation automation, persistence, or payload staging, so OPERATIONAL is the best maturity fit rather than WEAPONIZED. The attack vector is network/web because exploitation occurs remotely over HTTP/XML-RPC on the Supervisord management port, typically 9001. Fingerprintable observables include the /RPC2 endpoint, the Supervisord web interface on port 9001, the recursive XML-RPC method path used for exploitation, and example targets such as http://192.168.3.137:9001 and http://127.0.0.1:9001. The README also references insecure binding to 0.0.0.0:9001 and example filesystem artifacts such as /tmp/nyx_success. Overall, this repo's purpose is to demonstrate and exploit unauthenticated remote code execution in vulnerable Supervisord deployments exposed via inet_http_server.

This repository contains a single Metasploit module: modules/exploits/linux/http/supervisor_xmlrpc_exec.rb. The module exploits CVE-2017-11610, a vulnerability in Supervisor's XML-RPC interface (versions 3.0a1 to 3.3.2) that allows authenticated (or unauthenticated, if misconfigured) remote code execution via crafted XML-RPC requests. The exploit sends a malicious XML payload to the /RPC2 endpoint (default port 9001), causing supervisord to execute arbitrary shell commands as its running user. The module supports command stagers and can deliver a Meterpreter reverse shell or other payloads. The exploit requires either valid HTTP basic authentication credentials or that the server is running without authentication. The code is written in Ruby and leverages Metasploit's HttpClient and CmdStager mixins for network communication and payload delivery. The repository is weaponized, allowing for easy payload customization and integration into offensive operations.