System Requirements:
Ubuntu 12.04 LTS Desktop (64Bit) w/ 2 CPU, 2GB Memory, and 20GB Partition
Install Ubuntu
:: Once Ubuntu is launched, press Ctrl-Alt-t for a Terminal
Enter new ‘root’ password
# sudo passwd
# su – <Enter root password>
Upgrade all your Ubuntu packages
# apt-get update
# apt-get upgrade
Install Python packages
# apt-get install python python-magic python-dpkt python-mako
Install tcpdump (Ubuntu already has this, so you may not need it)
# apt-get install tcpdump
# setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
Install git to download from repositories
# apt-get install git
# cd /opt
Install Cuckoo Sandbox
# git clone git://github.com/cuckoobox/cuckoo.git
Cloning into ‘cuckoo’…
remote: Counting objects: 3363, done.
remote: Compressing objects: 100% (1250/1250), done.
remote: Total 3363 (delta 2137), reused 3229 (delta 2008)
Receiving objects: 100% (3363/3363), 3.71 MiB | 438 KiB/s, done.
Resolving deltas: 100% (2137/2137), done.
Install Oracle VirtualBox (All Distributions)
# wget http://download.virtualbox.org/virtualbox/4.1.16/VirtualBox-4.1.16-78094-Linux_amd64.run
# chmod u+x VirtualBox-4.1.16-78094-Linux_amd64.run
# ./VirtualBox-4.1.16-78094-Linux_amd64.run
Verifying archive integrity… All good.
Uncompressing VirtualBox for Linux installation………..
VirtualBox Version 4.1.16 r78094 (2012-02-20T13:13:38Z) installer
Installing VirtualBox to /opt/VirtualBox
Install Oracle VirtualBox (SDK)
# wget http://download.virtualbox.org/virtualbox/4.1.16/VirtualBoxSDK-4.1.16-78094.zip
# unzip VirtualBoxSDK-4.1.16-78094.zip
# cd /opt/sdk/installer
# python vboxapisetup.py install
Traceback (most recent call last):
File “vboxapisetup.py”, line 76, in <module>
main(sys.argv)
File “vboxapisetup.py”, line 50, in main
raise Exception(“No VBOX_INSTALL_PATH defined, exiting”)
Exception: No VBOX_INSTALL_PATH defined, exiting
Opps! Add the required ‘VBOX_INSTALL_PATH’ path
# VBOX_INSTALL_PATH=/opt/VirtualBox python vboxapisetup.py install
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/vboxapi
copying vboxapi/VirtualBox_constants.py -> build/lib.linux-x86_64-2.7/vboxapi
copying vboxapi/__init__.py -> build/lib.linux-x86_64-2.7/vboxapi
running install_lib
copying build/lib.linux-x86_64-2.7/vboxapi/VirtualBox_constants.py -> /usr/local/lib/python2.7/dist-packages/vboxapi
copying build/lib.linux-x86_64-2.7/vboxapi/__init__.py -> /usr/local/lib/python2.7/dist-packages/vboxapi
byte-compiling /usr/local/lib/python2.7/dist-packages/vboxapi/__init__.py to __init__.pyc
running install_egg_info
Removing /usr/local/lib/python2.7/dist-packages/vboxapi-1.0.egg-info
Writing /usr/local/lib/python2.7/dist-packages/vboxapi-1.0.egg-info
Relocate SDK files into VirtualBox install directory
# mv sdk /opt/VirtualBox/sdk
Modify Cuckoo Configuration File
# cd /opt/cuckoo/conf
# vi cuckoo.conf
Enable Sniffer Option
[Sniffer]
# Enable or disable the following option by assigning a True or False value.
# In case you decide to disable it, you’re supposed to either not have any
# network dump or to used VirtualBox’s (or any other virtualization engine
# you are using) to handle the network monitoring instead of using an external
# sniffer such as tcpdump. [on/off]
sniffer = on
…
:: This pertains to the number of VMs you will configure later in the .conf file
[VirtualMachines]
# List virtual machines IDs separated by commas.
enabled = cuckoo1
…
:: Make sure the ‘username’ and ‘password’ matches the default logged in user in the Guest OS
:: Leave the ‘share’ section alone, as this is where the Host OS scripts will be stored to share with the Guest OS
[cuckoo1]
name = cuckoo1
username = myWindowsUsername
password = myWindowsPassword
# Please notice that the shared folder name must coincide with the current
# virtual machine id, which is the name you assigned between the square
# brackets (e.g. [cuckoo1]).
share = shares/cuckoo1
Creating Virtual Machine
:: This is were the majority of your problems may occur. Try to follow the instructions in detail.
# mkdir /opt/vms
# virtualbox
:: Under ‘File/Preferences’ change the Default Virtual Machine Folder to -> ‘/opt/vms’
Install the Guest OS
:: Make sure you create a VM name ‘cuckoo1′ running Windows XP (SP3) or Windows 7; For Windows XP use 256 MB or Windows 7 use 1024 MB of memory. For the Hard Drive (HD) parameters, select ‘fixed storage’ for better performance. The HD storage space will depend on what you want to install, meaning the ‘vulnerable’ application to use (ie. MS Office, Adobe Reader, etc.)
Please Note: Make sure you create or change your default user account in Windows to match what we configured in the cuckoo.conf file. Make sure you also change the user account password to reflect what is in the .conf file.
Download Python 2.7 for Guest OS
:: Install Python into the default location C:\Python2.7\
http://www.python.org/getit/releases/2.7/
Disable Guest OS Firewall
:: Go to the Network Adapter Advanced Settings and disable the running Guest OS Windows Firewall
Install VirtualBox Oracle VM VirtualBox Guest Additions
:: Select Devices/Install Guest Additions… (Reboot of OS is required)
Configuring Virtual Machine for Cuckoo Sandbox
Enable Network .PCAP Dump
# mkdir /opt/cuckoo/shares/cuckoo1
# VBoxManage controlvm “cuckoo1″ poweroff
# VBoxManage modifyvm “cuckoo1″ –nictrace1 on –nictracefile1 /opt/cuckoo/shares/cuckoo1/dump.pcap
Creating Guest OS Shared Folders (to obtain Host OS Python scripts access used by Cuckoo)
# VBoxManage sharedfolder add “cuckoo1″ –name “setup” –hostpath “/opt/cuckoo/shares/setup”
# VBoxManage sharedfolder add “cuckoo1″ –name “cuckoo1″ –hostpath “/opt/cuckoo/shares/cuckoo1″
Installing Guest OS Vulnerable Applications
# VBoxManage startvm “cuckoo1″
Download old versions of applications from http://www.oldapps.com/
:: You may want to consider installing:
Microsoft Office 2003/2007; Adobe Reader 9; Adobe Flash 10; Oracle Java 6; Mozilla Firefox 11;
:: Make sure you disable all auto update features in the OS and Applications
Please Note: Remove anything unnecessary registry keys in the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, however leave the ‘VirtualBox Guest Additions’ key
Verify Guest OS shares are accessible to Host OS
:: Start/Run, then type in ‘\\vboxsvr’. You should see two shares ‘\\vboxsvr\setup’ & ‘\\vboxsvr\cuckoo1′
Please Note: I found connecting to the shares important. If I didn’t, Cuckoo would quickly close the VM afterwards, without analyzing code.
Verify Guest OS is ready for malware analysis
:: Reboot the Guest OS, log in and leave it running for 5 – 10 minutes.
Make sure:
1) All OS or Application Updates are disabled.
2) All Applications are launched at least once, to accept default Licensing Agreements.
3) Make sure you disabled the Guest OS Firewall.
Once you are satisfied that nothing unwanted will pop-up or prompt you during the malware analysis stage continue to the next step.
Create a Guest OS Clean Snapshot
# VBoxManage snapshot “cuckoo1″ take “baseImage” –pause
# VBoxManage controlvm “cuckoo1″ poweroff
# VBoxManage snapshot “cuckoo1″ restorecurrent
Testing Cuckoo Sandbox (for the First Time)
# cd /opt/cuckoo
# ./cuckoo.py
_
____ _ _ ____| | _ ___ ___
/ ___) | | |/ ___) |_/ ) _ \ / _ \
( (___| |_| ( (___| _ ( |_| | |_| |
\____)____/ \____)_| \_)___/ \___/ v0.3.2
www.cuckoobox.org
Copyright (C) 2010-2012
[2012-02-20 18:58:19,311] [Core.Init] INFO: Started.
[2012-02-20 18:58:19,386] [VirtualMachine.Check] INFO: Your VirtualBox version is: “4.1.16″, good!
[2012-02-20 18:58:19,387] [Core.Init] INFO: Populating virtual machines pool…
[2012-02-20 18:58:19,390] [VirtualMachine] ERROR: Virtual machine “Cuckoo1″ not found: 0x80bb0001 (Could not find a registered machine named ‘Cuckoo1′)
[2012-02-20 18:58:19,390] [VirtualMachine.Restore] ERROR: No virtual machine handle.
[2012-02-20 18:58:19,390] [VirtualMachine.Infos] ERROR: No virtual machine handle.
[2012-02-20 18:58:19,390] [Core.Init] CRITICAL: None of the virtual machines are available. Please review the errors.
Opps! Seems like my cuckoo.conf has a typo. Make sure your VM name (inc. Case) matches ‘exactly’ is in the .conf file. Let’s try again:
# ./cuckoo.py
_
____ _ _ ____| | _ ___ ___
/ ___) | | |/ ___) |_/ ) _ \ / _ \
( (___| |_| ( (___| _ ( |_| | |_| |
\____)____/ \____)_| \_)___/ \___/ v0.3.2
www.cuckoobox.org
Copyright (C) 2010-2012
[2012-02-20 19:02:22,059] [Core.Init] INFO: Started.
————————————[ERROR]————————————-
Cuckoo stumbled in an unhandled error!
Before reporting the problem, please run with latest release from the development
Git repository at:
http://github.com/cuckoobox/cuckoo
If the exception persists, please send the following traceback to:
cuckoo@public.honeynet.org
The developers will try to reproduce the bug, fix it and get in touch with you.
———————————-[TRACEBACK]———————————–
Cuckoo version: v0.3.2
Python version: 2.7.3 (default, Jan 20 2012, 22:39:59)
[GCC 4.6.3]
OS: linux2
Command line: ./cuckoo.py
Traceback (most recent call last):
File “./cuckoo.py”, line 665, in <module>
if not VirtualMachine().check():
File “/opt/cuckoo/cuckoo/core/virtualbox.py”, line 54, in __init__
vbm = vboxapi.VirtualBoxManager(None, None)
File “/usr/local/lib/python2.7/dist-packages/vboxapi/__init__.py”, line 513, in __init__
exec “self.platform = Platform”+style+”(platparams)”
File “<string>”, line 1, in <module>
File “/usr/local/lib/python2.7/dist-packages/vboxapi/__init__.py”, line 349, in __init__
import xpcom.vboxxpcom
ImportError: No module named xpcom.vboxxpcom
——————————————————————————–
Opps! Seems like it is not finding the VirtualBox SDK APIs. Let’s put the proper environment variables in.
# vi /etc/environment
Add the following line:
PYTHONPATH=”/opt/VirtualBox/:/opt/VirtualBox/sdk/bindings/xpcom/python/”
Close the terminal and re-open it. Let’s try again:
Open a new Terminal (Ctrl-Alt-T)
# su – <Enter root password>
# cd /opt/cuckoo
# ./cuckoo.py
_
____ _ _ ____| | _ ___ ___
/ ___) | | |/ ___) |_/ ) _ \ / _ \
( (___| |_| ( (___| _ ( |_| | |_| |
\____)____/ \____)_| \_)___/ \___/ v0.3.2
www.cuckoobox.org
Copyright (C) 2010-2012
[2012-02-20 19:01:24,894] [Core.Init] INFO: Started.
[2012-02-20 19:01:24,925] [VirtualMachine.Check] INFO: Your VirtualBox version is: “4.1.16″, good!
[2012-02-20 19:01:24,926] [Core.Init] INFO: Populating virtual machines pool…
[2012-02-20 19:01:24,996] [VirtualMachine.Restore] INFO: Virtual machine “cuckoo1″ successfully restored to current snapshot.
[2012-02-20 19:01:25,441] [VirtualMachine.Infos] INFO: Virtual machine “cuckoo1″ information:
[2012-02-20 19:01:25,442] [VirtualMachine.Infos] INFO: \_| Name: cuckoo1
[2012-02-20 19:01:25,442] [VirtualMachine.Infos] INFO: | ID: d959f177-8a5f-4bf5-8e5c-2197fa63aa30
[2012-02-20 19:01:25,443] [VirtualMachine.Infos] INFO: | CPU Count: 1 Core/s
[2012-02-20 19:01:25,443] [VirtualMachine.Infos] INFO: | Memory Size: 256 MB
[2012-02-20 19:01:25,443] [VirtualMachine.Infos] INFO: | VRAM Size: 16 MB
[2012-02-20 19:01:25,443] [VirtualMachine.Infos] INFO: | State: Saved
[2012-02-20 19:01:25,444] [VirtualMachine.Infos] INFO: | Current Snapshot: “baseImage”
[2012-02-20 19:01:25,444] [VirtualMachine.Infos] INFO: | MAC Address: 08:00:01:02:03:04
[2012-02-20 19:01:25,444] [Core.Init] INFO: 1 virtual machine/s added to pool.
[2012-02-20 19:01:25,488] [Database.Init] INFO: Generated database “db/cuckoo.db” which didn’t exist before.
Success! No Errors… Let’s continue.
Testing Cuckoo Sandbox w/ Malware
Open a new Terminal (Ctrl-Alt-T)
# su – <Enter root password>
# cd /opt/cuckoo
*** WARNING ***
The next step is considered dangerous. If you do not know what you are doing, it is recommended you DO NOT continue. There are various websites which contain a list of recently discovered websites containing malicious URLs, which can be submitted to Cuckoo Sandbox for analysis. If you do not feel comfortable looking for these sites, then search through your mail inbox, as you are bound to have a malicious attachments, which can be used to test out Cuckoo Sandbox.
*** WARNING ***
Cuckoo Sandbox Submission Utility
:: The easiest way to submit an analysis is to use the provided submit.py command-line utility. The following are some submission examples:
Submit a local binary
# ./submit.py /path/to/binary
Submit a local binary and specify an higher priority
# ./submit.py /path/to/binary –priority 5
Submit a local binary and specify a custom analysis timeout of 60 seconds
# ./submit.py /path/to/binary –timeout 60
Submit a local binary and specify a custom analysis package
# ./submit.py /path/to/binary –package <name of package>
Submit an URL to be downloaded locally and analyzed
# ./submit.py –download http://www.website.tld/file.exe
Submit an URL to be analyzed within Internet Explorer
# ./submit.py –url http://maliciousurl.tld/exploit.php
Submit a local binary to be run on virtual machine cuckoo1
# ./submit.py /path/to/binary –machine cuckoo1
:: If the VM closes very quickly, after spawning, it is a result of either:
A) Guest OS username or password does not match what is in the cuckoo.conf file.
B) You did not manually connect to the \\vboxsvr\setup and \\vboxsvr\cuckoo1 shares, to cache the session.
C) Your \\vboxsvr shares are not mapped to the proper Host OS (ie. /opt/cuckoo/shares) paths.
D) Something is not correct when you enabled your .pcap dump file.
:: You can also enable debug logging to help you out
# vi /opt/cuckoo/conf/cuckoo.conf
[Logging]
# Enable/Disable additional debugging messages. This messages won’t wrote to
# log file but just printed on screen. [on/off]
debug = on
Cuckoo Sandbox Malware Results
All the results are kept in the /opt/cuckoo/analysis directory. You can also spawn the Cuckoo Sandbox Web Analyzer, which is very pretty:
# cd /opt/cuckoo
# ./web.pl
:: Now launch Firefox in Ubuntu and go to http://127.0.0.1:8080
That’s it folks! For any other issues, please leave a comment below. If anyone managed to get Cuckoo running in non-root mode, tell me how.
