Supervisor XML-RPC Authenticated Remote Command Execution

This repository is a small, focused exploit repo for CVE-2017-11610 in Supervisord. It contains one Python exploit script and one long README walkthrough. The main exploit file, exploit_supervisor.py, uses Python's xmlrpc.client to connect to a target Supervisord XML-RPC endpoint at /RPC2, then abuses recursive namespace traversal via the method path supervisor.supervisord.options.warnings.linecache.os.system to invoke os.system remotely with an attacker-supplied command. This provides remote command execution over the network against vulnerable, exposed Supervisord instances. Repository structure is minimal: README.md documents reconnaissance, validation of the exposed web UI and XML-RPC API, example target observations, impact, and remediation; exploit_supervisor.py is the operational entry point. The script accepts two command-line arguments: target_url and command. It prints status messages, builds a ServerProxy to <target_url>/RPC2, resolves the dangerous method path, and executes the provided command, reporting the returned exit code. The exploit capability is straightforward but real: arbitrary shell command execution in the privileges of the supervisord process, likely a low-privileged service account unless misconfigured. It is not a detection-only script and does not include post-exploitation automation, persistence, or payload staging, so OPERATIONAL is the best maturity fit rather than WEAPONIZED. The attack vector is network/web because exploitation occurs remotely over HTTP/XML-RPC on the Supervisord management port, typically 9001. Fingerprintable observables include the /RPC2 endpoint, the Supervisord web interface on port 9001, the recursive XML-RPC method path used for exploitation, and example targets such as http://192.168.3.137:9001 and http://127.0.0.1:9001. The README also references insecure binding to 0.0.0.0:9001 and example filesystem artifacts such as /tmp/nyx_success. Overall, this repo's purpose is to demonstrate and exploit unauthenticated remote code execution in vulnerable Supervisord deployments exposed via inet_http_server.