从零搭建配置Cuckoo Sandbox

1.安装依赖

$ sudo apt-get install git mongodb libffi-dev build-essential python-django python python-dev python-pip python-pil python-sqlalchemy python-bson python-dpkt python-jinja2 python-magic python-pymongo python-gridfs python-libvirt python-bottle python-pefile python-chardet tcpdump -y

 

中间可能出现的问题解决：

1. libffi-dev : 依赖: libffi6 (= 3.2.1-4) 但是 3.2.1-6 正要被安装

$ sudo apt-get install libffi6=3.2.1-4

2. python-magic : 依赖: libmagic1 (< 1:5.25-2ubuntu1.1.1~) 但是 1:5.28-2ubuntu1 正要被安装

$ sudo apt-get purge libmagic1
$ sudo apt-get install python-magic --fix-broken

3.pip问题（解决办法）

 

2.安装Tcpdump

$ sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

 

3.安装Pydeep

$ wget http://sourceforge.net/projects/ssdeep/files/ssdeep-2.13/ssdeep-2.13.tar.gz/download -O ssdeep-2.13.tar.gz
$ tar -zxf ssdeep-2.13.tar.gz
$ cd ssdeep-2.13
$ ./configure
$ make
$ sudo make install
$ sudo pip install pydeep

 

4.安装Volatility

$ sudo pip install openpyxl
$ sudo pip install ujson
$ sudo pip install pycrypto
$ sudo pip install distorm3
$ sudo pip install pytz
$ git clone https://github.com/volatilityfoundation/volatility.git
$ cd volatility
$ python setup.py build
$ python setup.py install

 

5.安装Cuckoo

$ sudo pip install cuckoo
或者
$ git clone git://github.com/cuckoosandbox/cuckoo.git

 无法删除关联(删除xxx.egg-info文件)

 

6.Vitrualbox配置

安装win7系统做靶机，网络配置选择 host only 模式

若HOST-ONLY显示未指定界面，快捷键 ctrl+g 加入网卡 vboxnet0

在虚拟机里面安装python，把Cuckoo的Agent拷贝进虚拟机，这个python脚本在[Cuckoo工作目录]\agent\agent.py

命令行运行agent脚本，这个时候你就可以创建快照了。将这个快照的名称填入virtualbox.conf对应的位置

 

7.配置Cuckoo

在 .cuckoo/conf/中修改配置文件：

cuckoo.conf

machinery = virtualbox
[resultserver]
ip = 192.168.x.xThis is the IP address of the host
port = 2042 #leave default unless you have services running
[cuckoo]
process_results = no

auxiliary.conf

[sniffer]
enabled = yes

tcpdump = /usr/sbin/tcpdump

interface = vboxnet0

virtualbox.conf

machines = 你的虚拟机名字
label = 你的虚拟机名字
platform = windows
ip =  192.168.x.x IP address of the guest
snapshot = 你创建的快照名字

 

reporting.conf

[mongodb]
enabled = yes

 

8.运行Cuckoo

cuckoo web runserver
cuckoo -d

打开http://127.0.0.1:8000，就可以看到cuckoo SandBox的Web页面。