引言: 在安装完cuckoo的依赖包之后,我们来看看如何配置cuckoo,以及在cuckoo启动过程中碰到的各类问题分析。
1. 配置文件
在cuckoo目录下,配置文件置于conf目录下,重要的配置文件有cuckoo.conf, virutalbox.conf,由于这里使用了virutalbox。 修改virtualbox.conf,下图为配置片断:
xp: 为 virtualbox中的虚拟机名称,在下列配置中的xp。
[virtualbox]
# Specify which VirtualBox mode you want to run your machines on.
# Can be "gui", "sdl" or "headless". Refer to VirtualBox's official
# documentation to understand the differences.
mode = gui
# Path to the local installation of the VBoxManage utility.
path = /usr/bin/VBoxManage
# Default network interface.
interface = vboxnet0
# Specify a comma-separated list of available machines to be used. For each
# specified ID you have to define a dedicated section containing the details
# on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)
machines = xp
[xp]
# Specify the label name of the current machine as specified in your
# VirtualBox configuration.
label = xp
# Specify the operating system platform used by current machine
# [windows/darwin/linux].
platform = windows
# Specify the IP address of the current virtual machine. Make sure that the
# IP address is valid and that the host machine is able to reach it. If not,
# the analysis will fail.
ip = 192.168.56.101
# (Optional) Specify the snapshot name to use. If you do not specify a snapshot
# name, the VirtualBox MachineManager will use the current snapshot.
# Example (Snapshot1 is the snapshot name):
# snapshot = Snapshot1
配置中,加粗和斜体的为我们需要修改的。
2. 启动cuckoo
>> sudo python cuckoo.py (-d: 打印详细启动信息)
在某些情况下,可以发现无法找到相应的vm实例,这个情况下,需要修改cuckoo目录的所有者,基于当下命令来直接启动,正常情况下是不需要这样做的。
>> sudo chown currentuser: cuckoo
3. 提交分析任务
进入cuckoo的目录,在util/submit.py,执行如下命令:
cd ~/cuckoo/util
python submit.py ../filesrc
note: filesrc is the directory where the scannedfile exists. 被扫描的文件目录。
Start up the cuckoo
>> cd ~/cuckoo
>> ./cuckoo.py # 开始分析提交的文件
正确的输出结果(其中若干重复内容有删减):
016-09-16 21:21:49,942 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:50,281 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: dead_host
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: suspicious_process
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: antivirus_virustotal
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_entropy
2016-09-16 21:21:50,283 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: stealth_hiddenfile
2016-09-16 21:21:50,283 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_upx
2016-09-16 21:21:51,001 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:51,901 [lib.cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"
2016-09-16 21:21:51,901 [lib.cuckoo.core.scheduler] INFO: Task #9: reports generation completed (path=/home/polo/cuckoo/storage/analyses/9)
2016-09-16 21:21:51,919 [lib.cuckoo.core.scheduler] INFO: Task #9: analysis procedure completed
2016-09-16 21:21:52,036 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:53,043 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:53,130 [lib.cuckoo.core.guest] DEBUG: xp: waiting for status 0x0001
2016-09-16 21:21:53,147 [lib.cuckoo.core.guest] DEBUG: xp: status ready
2016-09-16 21:21:53,249 [lib.cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=xp, ip=192.168.56.101)
2016-09-16 21:21:54,676 [lib.cuckoo.core.guest] DEBUG: xp: analyzer started with PID 1028
2016-09-16 21:21:54,716 [lib.cuckoo.core.guest] DEBUG: xp: waiting for completion
2016-09-16 21:21:55,530 [lib.cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.
2016-09-16 21:21:55,739 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:21:56,757 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
。。。。。。。。
2016-09-16 21:23:23,480 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:24,571 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:25,683 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:25,879 [lib.cuckoo.core.resultserver] DEBUG: New process (pid=368, ppid=1740, name=cmd.exe)
2016-09-16 21:23:26,747 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:27,827 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
。。。。。。。。
2016-09-16 21:24:36,113 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:24:37,215 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:24:37,247 [lib.cuckoo.core.resultserver] DEBUG: Connection closed: 192.168.56.101:1059
2016-09-16 21:24:37,249 [lib.cuckoo.core.resultserver] DEBUG: Connection closed: 192.168.56.101:1054
2016-09-16 21:24:38,338 [lib.cuckoo.core.guest] INFO: xp: analysis completed successfully
33 packets captured
33 packets received by filter
0 packets dropped by kernel
2016-09-16 21:24:38,352 [lib.cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2016-09-16 21:24:38,353 [modules.machinery.virtualbox] DEBUG: Stopping vm xp
2016-09-16 21:24:38,354 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 21:24:38,720 [modules.machinery.virtualbox] DEBUG: Machine xp status running
2016-09-16 21:24:39,758 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 21:24:40,114 [modules.machinery.virtualbox] DEBUG: Machine xp status poweroff
2016-09-16 21:24:40,225 [lib.cuckoo.core.scheduler] DEBUG: Released database task #10
2016-09-16 21:24:40,273 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,315 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,316 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,327 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Debug" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,328 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,329 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,340 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Static" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,341 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Strings" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,356 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,370 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,737 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "VirusTotal" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,738 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,785 [lib.cuckoo.core.plugins] DEBUG: Running 400 signatures
2016-09-16 21:24:41,893 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,921 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,991 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,992 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,002 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,003 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
if handler(*args, **kwargs):
File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,519 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: dead_host
2016-09-16 21:24:42,739 [lib.cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"
2016-09-16 21:24:42,739 [lib.cuckoo.core.scheduler] INFO: Task #10: reports generation completed (path=/home/polo/cuckoo/storage/analyses/10)
2016-09-16 21:24:42,758 [lib.cuckoo.core.scheduler] INFO: Task #10: analysis procedure completed
关注task #10 ,
reports generation completed,
analysis procedure completed 表示任务完成。
5. 常见启动错误分析以及应对
错误1: CuckooCriticalError: Unable to import plugin "modules.processing.behavior": No module named dateutil.parser
具体的错误信息:
polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d
.:
::
.-. , : .-. ;;.-. .-. .-.
; ; ; ; ;; .' ; ;'; ;'
`;;;;'.'`..:;._`;;;;'_.'` `.`;;' `;;'
Cuckoo Sandbox 2.0-rc1
www.cuckoosandbox.org
Copyright (c) 2010-2015
Checking for updates...
Good! You have the latest version available.
2016-09-16 09:37:03,034 [root] DEBUG: Importing modules...
2016-09-16 09:37:03,076 [root] CRITICAL: CuckooCriticalError: Unable to import plugin "modules.processing.behavior": No module named dateutil.parser
How to fix it?
sudo pip install python-dateutil
错误2: CRITICAL: CuckooCriticalError: Unable to bind ResultServer on192.168.56.1:2042: [Errno 99] Cannot assign requested address
详细的错误信息:
polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d
_ _ _ _ _ _
/\ \ /\_\ /\ \ /\_\ /\ \ /\ \
/ \ \ / / / _ / \ \ / / / _ / \ \ / \ \
/ /\ \ \ \ \ \__ /\_\ / /\ \ \ / / / /\_\ / /\ \ \ / /\ \ \
/ / /\ \ \ \ \___\ / / // / /\ \ \ / / /__/ / / / / /\ \ \ / / /\ \ \
/ / / \ \_\ \__ / / / // / / \ \_\ / /\_____/ / / / / \ \_\ / / / \ \_\
/ / / \/_/ / / / / / // / / \/_/ / /\_______/ / / / / / // / / / / /
/ / / / / / / / // / / / / /\ \ \ / / / / / // / / / / /
/ / /________ / / /___/ / // / /________ / / / \ \ \ / / /___/ / // / /___/ / /
/ / /_________\/ / /____\/ // / /_________\/ / / \ \ \ / / /____\/ // / /____\/ /
\/____________/\/_________/ \/____________/\/_/ \_\_\\/_________/ \/_________/
Cuckoo Sandbox 2.0-rc1
www.cuckoosandbox.org
Copyright (c) 2010-2015
Checking for updates...
Good! You have the latest version available.
2016-09-16 09:41:26,389 [root] DEBUG: Importing modules...
2016-09-16 09:41:26,729 [root] DEBUG: Imported "signatures" modules:
2016-09-16 09:41:26,730 [root] DEBUG: |-- CreatesExe
2016-09-16 09:41:26,730 [root] DEBUG: `-- SystemMetrics
2016-09-16 09:41:26,730 [root] DEBUG: Imported "processing" modules:
2016-09-16 09:41:26,730 [root] DEBUG: |-- AnalysisInfo
2016-09-16 09:41:26,731 [root] DEBUG: |-- ApkInfo
2016-09-16 09:41:26,731 [root] DEBUG: |-- Baseline
2016-09-16 09:41:26,731 [root] DEBUG: |-- BehaviorAnalysis
2016-09-16 09:41:26,731 [root] DEBUG: |-- DroppedBuffer
2016-09-16 09:41:26,732 [root] DEBUG: |-- Debug
2016-09-16 09:41:26,732 [root] DEBUG: |-- Droidmon
2016-09-16 09:41:26,732 [root] DEBUG: |-- Dropped
2016-09-16 09:41:26,733 [root] DEBUG: |-- TLSMasterSecrets
2016-09-16 09:41:26,733 [root] DEBUG: |-- GooglePlay
2016-09-16 09:41:26,733 [root] DEBUG: |-- Memory
2016-09-16 09:41:26,733 [root] DEBUG: |-- NetworkAnalysis
2016-09-16 09:41:26,734 [root] DEBUG: |-- ProcessMemory
2016-09-16 09:41:26,734 [root] DEBUG: |-- Screenshots
2016-09-16 09:41:26,734 [root] DEBUG: |-- Snort
2016-09-16 09:41:26,734 [root] DEBUG: |-- Static
2016-09-16 09:41:26,735 [root] DEBUG: |-- Strings
2016-09-16 09:41:26,735 [root] DEBUG: |-- Suricata
2016-09-16 09:41:26,735 [root] DEBUG: |-- TargetInfo
2016-09-16 09:41:26,736 [root] DEBUG: `-- VirusTotal
2016-09-16 09:41:26,736 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 09:41:26,736 [root] DEBUG: |-- MITM
2016-09-16 09:41:26,736 [root] DEBUG: |-- Services
2016-09-16 09:41:26,737 [root] DEBUG: `-- Sniffer
2016-09-16 09:41:26,737 [root] DEBUG: Imported "reporting" modules:
2016-09-16 09:41:26,737 [root] DEBUG: |-- JsonDump
2016-09-16 09:41:26,737 [root] DEBUG: |-- Moloch
2016-09-16 09:41:26,738 [root] DEBUG: |-- MongoDB
2016-09-16 09:41:26,738 [root] DEBUG: `-- ReportHTML
2016-09-16 09:41:26,738 [root] DEBUG: Imported "machinery" modules:
2016-09-16 09:41:26,738 [root] DEBUG: `-- VirtualBox
2016-09-16 09:41:26,741 [root] DEBUG: Checking for locked tasks..
2016-09-16 09:41:26,756 [root] DEBUG: Checking for pending service tasks..
2016-09-16 09:41:26,769 [root] DEBUG: Initializing Yara...
2016-09-16 09:41:26,775 [root] DEBUG: |-- index_binaries.yar
2016-09-16 09:41:26,775 [root] DEBUG: `-- index_memory.yar
2016-09-16 09:41:26,790 [root] CRITICAL: CuckooCriticalError: Unable to bind ResultServer on 192.168.56.1:2042: [Errno 99] Cannot assign requested address
How to fix it?
这个错误信息是由于无法连接到vm的原因导致的,故需要设置其网络设置。具体的设置步骤如下:
就这样,vboxnet0在host-only模式下,就是我们需要使用的网络模式。
错误3:Could not find a registered machine named 'xp'
详细错误信息:
polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d
_
____ _ _ ____| | _ ___ ___
/ ___) | | |/ ___) |_/ ) _ \ / _ \
( (___| |_| ( (___| _ ( |_| | |_| |
\____)____/ \____)_| \_)___/ \___/
Cuckoo Sandbox 2.0-rc1
www.cuckoosandbox.org
Copyright (c) 2010-2015
Checking for updates...
Good! You have the latest version available.
2016-09-16 09:53:07,298 [root] DEBUG: Importing modules...
2016-09-16 09:53:07,575 [root] DEBUG: Imported "signatures" modules:
2016-09-16 09:53:07,576 [root] DEBUG: |-- CreatesExe
2016-09-16 09:53:07,577 [root] DEBUG: `-- SystemMetrics
2016-09-16 09:53:07,577 [root] DEBUG: Imported "processing" modules:
2016-09-16 09:53:07,577 [root] DEBUG: |-- AnalysisInfo
2016-09-16 09:53:07,577 [root] DEBUG: |-- ApkInfo
2016-09-16 09:53:07,578 [root] DEBUG: |-- Baseline
2016-09-16 09:53:07,578 [root] DEBUG: |-- BehaviorAnalysis
2016-09-16 09:53:07,578 [root] DEBUG: |-- DroppedBuffer
2016-09-16 09:53:07,579 [root] DEBUG: |-- Debug
2016-09-16 09:53:07,579 [root] DEBUG: |-- Droidmon
2016-09-16 09:53:07,580 [root] DEBUG: |-- Dropped
2016-09-16 09:53:07,580 [root] DEBUG: |-- TLSMasterSecrets
2016-09-16 09:53:07,580 [root] DEBUG: |-- GooglePlay
2016-09-16 09:53:07,581 [root] DEBUG: |-- Memory
2016-09-16 09:53:07,581 [root] DEBUG: |-- NetworkAnalysis
2016-09-16 09:53:07,581 [root] DEBUG: |-- ProcessMemory
2016-09-16 09:53:07,581 [root] DEBUG: |-- Screenshots
2016-09-16 09:53:07,582 [root] DEBUG: |-- Snort
2016-09-16 09:53:07,582 [root] DEBUG: |-- Static
2016-09-16 09:53:07,582 [root] DEBUG: |-- Strings
2016-09-16 09:53:07,583 [root] DEBUG: |-- Suricata
2016-09-16 09:53:07,583 [root] DEBUG: |-- TargetInfo
2016-09-16 09:53:07,584 [root] DEBUG: `-- VirusTotal
2016-09-16 09:53:07,584 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 09:53:07,584 [root] DEBUG: |-- MITM
2016-09-16 09:53:07,584 [root] DEBUG: |-- Services
2016-09-16 09:53:07,585 [root] DEBUG: `-- Sniffer
2016-09-16 09:53:07,585 [root] DEBUG: Imported "reporting" modules:
2016-09-16 09:53:07,585 [root] DEBUG: |-- JsonDump
2016-09-16 09:53:07,586 [root] DEBUG: |-- Moloch
2016-09-16 09:53:07,587 [root] DEBUG: |-- MongoDB
2016-09-16 09:53:07,589 [root] DEBUG: `-- ReportHTML
2016-09-16 09:53:07,590 [root] DEBUG: Imported "machinery" modules:
2016-09-16 09:53:07,590 [root] DEBUG: `-- VirtualBox
2016-09-16 09:53:07,593 [root] DEBUG: Checking for locked tasks..
2016-09-16 09:53:07,620 [root] DEBUG: Checking for pending service tasks..
2016-09-16 09:53:07,630 [root] DEBUG: Initializing Yara...
2016-09-16 09:53:07,638 [root] DEBUG: |-- index_binaries.yar
2016-09-16 09:53:07,645 [root] DEBUG: `-- index_memory.yar
2016-09-16 09:53:07,665 [lib.cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.56.1:2042.
2016-09-16 09:53:07,669 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
2016-09-16 09:53:08,367 [modules.machinery.virtualbox] DEBUG: Stopping vm xp
2016-09-16 09:53:08,368 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:08,521 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
2016-09-16 09:53:09,555 [modules.machinery.virtualbox] DEBUG: VBoxManage exited with error powering off the machine
2016-09-16 09:53:09,557 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:09,711 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
2016-09-16 09:53:09,733 [lib.cuckoo.common.abstracts] DEBUG: Waiting 0 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:10,734 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:10,887 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
2016-09-16 09:53:10,908 [lib.cuckoo.common.abstracts] DEBUG: Waiting 1 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:11,910 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:12,063 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
2016-09-16 09:53:12,083 [lib.cuckoo.common.abstracts] DEBUG: Waiting 2 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:13,085 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:13,246 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
How to fix it?
Sudo chown -R currentuser: cuckoo
错误5: CRITICAL: CuckooCriticalError: Unable to bind ResultServer on192.168.56.1:2042: [Errno 99] Cannot assign requested address
详细错误信息:
2016-09-16 18:05:50,974 [root] DEBUG: Importing modules...
2016-09-16 18:05:51,159 [root] DEBUG: Imported "signatures" modules:
2016-09-16 18:05:51,160 [root] DEBUG: |-- CreatesExe
2016-09-16 18:05:51,160 [root] DEBUG: `-- SystemMetrics
2016-09-16 18:05:51,160 [root] DEBUG: Imported "processing" modules:
2016-09-16 18:05:51,160 [root] DEBUG: |-- AnalysisInfo
2016-09-16 18:05:51,161 [root] DEBUG: |-- ApkInfo
2016-09-16 18:05:51,161 [root] DEBUG: |-- Baseline
2016-09-16 18:05:51,161 [root] DEBUG: |-- BehaviorAnalysis
2016-09-16 18:05:51,161 [root] DEBUG: |-- DroppedBuffer
2016-09-16 18:05:51,162 [root] DEBUG: |-- Debug
2016-09-16 18:05:51,162 [root] DEBUG: |-- Droidmon
2016-09-16 18:05:51,162 [root] DEBUG: |-- Dropped
2016-09-16 18:05:51,163 [root] DEBUG: |-- TLSMasterSecrets
2016-09-16 18:05:51,163 [root] DEBUG: |-- GooglePlay
2016-09-16 18:05:51,163 [root] DEBUG: |-- Memory
2016-09-16 18:05:51,163 [root] DEBUG: |-- NetworkAnalysis
2016-09-16 18:05:51,164 [root] DEBUG: |-- ProcessMemory
2016-09-16 18:05:51,164 [root] DEBUG: |-- Screenshots
2016-09-16 18:05:51,164 [root] DEBUG: |-- Snort
2016-09-16 18:05:51,164 [root] DEBUG: |-- Static
2016-09-16 18:05:51,165 [root] DEBUG: |-- Strings
2016-09-16 18:05:51,165 [root] DEBUG: |-- Suricata
2016-09-16 18:05:51,165 [root] DEBUG: |-- TargetInfo
2016-09-16 18:05:51,166 [root] DEBUG: `-- VirusTotal
2016-09-16 18:05:51,166 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 18:05:51,166 [root] DEBUG: |-- MITM
2016-09-16 18:05:51,166 [root] DEBUG: |-- Services
2016-09-16 18:05:51,167 [root] DEBUG: `-- Sniffer
2016-09-16 18:05:51,167 [root] DEBUG: Imported "reporting" modules:
2016-09-16 18:05:51,167 [root] DEBUG: |-- JsonDump
2016-09-16 18:05:51,167 [root] DEBUG: |-- Moloch
2016-09-16 18:05:51,168 [root] DEBUG: |-- MongoDB
2016-09-16 18:05:51,168 [root] DEBUG: `-- ReportHTML
2016-09-16 18:05:51,168 [root] DEBUG: Imported "machinery" modules:
2016-09-16 18:05:51,168 [root] DEBUG: `-- VirtualBox
2016-09-16 18:05:51,172 [root] DEBUG: Checking for locked tasks..
2016-09-16 18:05:51,187 [root] DEBUG: Checking for pending service tasks..
2016-09-16 18:05:51,197 [root] DEBUG: Initializing Yara...
2016-09-16 18:05:51,199 [root] DEBUG: |-- index_binaries.yar
2016-09-16 18:05:51,200 [root] DEBUG: `-- index_memory.yar
2016-09-16 18:05:51,213 [root] CRITICAL: CuckooCriticalError: Unable to bind ResultServer on 192.168.56.1:2042: [Errno 99] Cannot assign requested address
How to fix it?
# If the hostonly interface vboxnet0 does not exist already.
$ VBoxManage hostonlyif create
# Configure vboxnet0.
$ VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 --netmask 255.255.255.0