cuckoo的配置以及启动场景问题分析

引言: 在安装完cuckoo的依赖包之后,我们来看看如何配置cuckoo,以及在cuckoo启动过程中碰到的各类问题分析。

1.  配置文件

   在cuckoo目录下,配置文件置于conf目录下,重要的配置文件有cuckoo.conf, virutalbox.conf,由于这里使用了virutalbox。 修改virtualbox.conf,下图为配置片断:

  xp: virtualbox中的虚拟机名称,在下列配置中的xp。   

[virtualbox]
# Specify which VirtualBox mode you want to run your machines on.
# Can be "gui", "sdl" or "headless". Refer to VirtualBox's official
# documentation to understand the differences.
mode = gui

# Path to the local installation of the VBoxManage utility.
path = /usr/bin/VBoxManage

# Default network interface.
interface = vboxnet0

# Specify a comma-separated list of available machines to be used. For each
# specified ID you have to define a dedicated section containing the details
# on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)
machines = xp

[xp]
# Specify the label name of the current machine as specified in your
# VirtualBox configuration.
label = xp

# Specify the operating system platform used by current machine
# [windows/darwin/linux].
platform = windows

# Specify the IP address of the current virtual machine. Make sure that the
# IP address is valid and that the host machine is able to reach it. If not,
# the analysis will fail.
ip = 192.168.56.101

# (Optional) Specify the snapshot name to use. If you do not specify a snapshot
# name, the VirtualBox MachineManager will use the current snapshot.
# Example (Snapshot1 is the snapshot name):
# snapshot = Snapshot1
配置中,加粗和斜体的为我们需要修改的。

2. 启动cuckoo

  >> sudo python cuckoo.py   (-d:  打印详细启动信息)

  在某些情况下,可以发现无法找到相应的vm实例,这个情况下,需要修改cuckoo目录的所有者,基于当下命令来直接启动,正常情况下是不需要这样做的。

  >>  sudo chown  currentuser: cuckoo

3. 提交分析任务

  进入cuckoo的目录,在util/submit.py,执行如下命令:

  cd ~/cuckoo/util
  python submit.py ../filesrc
  note:  filesrc is the directory where the scannedfile exists.  被扫描的文件目录。

    

  Start up the cuckoo

    >>  cd ~/cuckoo

    >>  ./cuckoo.py      # 开始分析提交的文件

  正确的输出结果(其中若干重复内容有删减):

 016-09-16 21:21:49,942 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:50,281 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: dead_host
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: suspicious_process
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: antivirus_virustotal
2016-09-16 21:21:50,282 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_entropy
2016-09-16 21:21:50,283 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: stealth_hiddenfile
2016-09-16 21:21:50,283 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_upx
2016-09-16 21:21:51,001 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:51,901 [lib.cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"
2016-09-16 21:21:51,901 [lib.cuckoo.core.scheduler] INFO: Task #9: reports generation completed (path=/home/polo/cuckoo/storage/analyses/9)
2016-09-16 21:21:51,919 [lib.cuckoo.core.scheduler] INFO: Task #9: analysis procedure completed
2016-09-16 21:21:52,036 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:53,043 [lib.cuckoo.core.guest] DEBUG: xp: not ready yet
2016-09-16 21:21:53,130 [lib.cuckoo.core.guest] DEBUG: xp: waiting for status 0x0001
2016-09-16 21:21:53,147 [lib.cuckoo.core.guest] DEBUG: xp: status ready
2016-09-16 21:21:53,249 [lib.cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=xp, ip=192.168.56.101)
2016-09-16 21:21:54,676 [lib.cuckoo.core.guest] DEBUG: xp: analyzer started with PID 1028
2016-09-16 21:21:54,716 [lib.cuckoo.core.guest] DEBUG: xp: waiting for completion
2016-09-16 21:21:55,530 [lib.cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.
2016-09-16 21:21:55,739 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:21:56,757 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
。。。。。。。。
2016-09-16 21:23:23,480 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:24,571 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:25,683 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:25,879 [lib.cuckoo.core.resultserver] DEBUG: New process (pid=368, ppid=1740, name=cmd.exe)
2016-09-16 21:23:26,747 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:23:27,827 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
。。。。。。。。
2016-09-16 21:24:36,113 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:24:37,215 [lib.cuckoo.core.guest] DEBUG: xp: analysis not completed yet (status=2)
2016-09-16 21:24:37,247 [lib.cuckoo.core.resultserver] DEBUG: Connection closed: 192.168.56.101:1059
2016-09-16 21:24:37,249 [lib.cuckoo.core.resultserver] DEBUG: Connection closed: 192.168.56.101:1054
2016-09-16 21:24:38,338 [lib.cuckoo.core.guest] INFO: xp: analysis completed successfully
33 packets captured
33 packets received by filter
0 packets dropped by kernel
2016-09-16 21:24:38,352 [lib.cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2016-09-16 21:24:38,353 [modules.machinery.virtualbox] DEBUG: Stopping vm xp
2016-09-16 21:24:38,354 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 21:24:38,720 [modules.machinery.virtualbox] DEBUG: Machine xp status running
2016-09-16 21:24:39,758 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 21:24:40,114 [modules.machinery.virtualbox] DEBUG: Machine xp status poweroff
2016-09-16 21:24:40,225 [lib.cuckoo.core.scheduler] DEBUG: Released database task #10
2016-09-16 21:24:40,273 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,315 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,316 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,327 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Debug" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,328 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,329 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,340 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Static" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,341 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "Strings" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,356 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:40,370 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,737 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "VirusTotal" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,738 [lib.cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" on analysis at "/home/polo/cuckoo/storage/analyses/10"
2016-09-16 21:24:41,785 [lib.cuckoo.core.plugins] DEBUG: Running 400 signatures
2016-09-16 21:24:41,893 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,921 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,991 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:41,992 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,002 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,003 [lib.cuckoo.core.plugins] ERROR: Failed to run 'on_call' of the exploit_heapspray signature
Traceback (most recent call last):
  File "/home/polo/cuckoo/lib/cuckoo/core/plugins.py", line 378, in call_signature
    if handler(*args, **kwargs):
  File "/home/polo/cuckoo/modules/signatures/windows/exploitation.py", line 22, in on_call
    pid = call["arguments"]["process_identifier"]
KeyError: 'process_identifier'
2016-09-16 21:24:42,519 [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature: dead_host
2016-09-16 21:24:42,739 [lib.cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"
2016-09-16 21:24:42,739 [lib.cuckoo.core.scheduler] INFO: Task #10: reports generation completed (path=/home/polo/cuckoo/storage/analyses/10)
2016-09-16 21:24:42,758 [lib.cuckoo.core.scheduler] INFO: Task #10: analysis procedure completed
关注task #10 ,  reports generation completed,  analysis procedure completed  表示任务完成。

5. 常见启动错误分析以及应对

  错误1: CuckooCriticalError: Unable to import plugin "modules.processing.behavior": No module named dateutil.parser

  具体的错误信息:  

polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d

                          .:                 
                          ::                 
    .-.     ,  :   .-.    ;;.-.  .-.   .-.   
   ;       ;   ;  ;       ;; .' ;   ;';   ;' 
   `;;;;'.'`..:;._`;;;;'_.'`  `.`;;'  `;;'

 Cuckoo Sandbox 2.0-rc1
 www.cuckoosandbox.org
 Copyright (c) 2010-2015

 Checking for updates...
 Good! You have the latest version available.

2016-09-16 09:37:03,034 [root] DEBUG: Importing modules...
2016-09-16 09:37:03,076 [root] CRITICAL: CuckooCriticalError: Unable to import plugin "modules.processing.behavior": No module named dateutil.parser
 How to fix it?

    sudo pip install python-dateutil

  错误2: CRITICAL: CuckooCriticalError: Unable to bind ResultServer on192.168.56.1:2042: [Errno 99] Cannot assign requested address

 详细的错误信息:   

polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d

            _       _                   _             _              _            _       
          /\ \     /\_\               /\ \           /\_\           /\ \         /\ \     
         /  \ \   / / /         _    /  \ \         / / /  _       /  \ \       /  \ \    
        / /\ \ \  \ \ \__      /\_\ / /\ \ \       / / /  /\_\    / /\ \ \     / /\ \ \   
       / / /\ \ \  \ \___\    / / // / /\ \ \     / / /__/ / /   / / /\ \ \   / / /\ \ \  
      / / /  \ \_\  \__  /   / / // / /  \ \_\   / /\_____/ /   / / /  \ \_\ / / /  \ \_\ 
     / / /    \/_/  / / /   / / // / /    \/_/  / /\_______/   / / /   / / // / /   / / / 
    / / /          / / /   / / // / /          / / /\ \ \     / / /   / / // / /   / / /  
   / / /________  / / /___/ / // / /________  / / /  \ \ \   / / /___/ / // / /___/ / /   
  / / /_________\/ / /____\/ // / /_________\/ / /    \ \ \ / / /____\/ // / /____\/ /    
  \/____________/\/_________/ \/____________/\/_/      \_\_\\/_________/ \/_________/

 Cuckoo Sandbox 2.0-rc1
 www.cuckoosandbox.org
 Copyright (c) 2010-2015

 Checking for updates...
 Good! You have the latest version available.

2016-09-16 09:41:26,389 [root] DEBUG: Importing modules...
2016-09-16 09:41:26,729 [root] DEBUG: Imported "signatures" modules:
2016-09-16 09:41:26,730 [root] DEBUG: 	 |-- CreatesExe
2016-09-16 09:41:26,730 [root] DEBUG: 	 `-- SystemMetrics
2016-09-16 09:41:26,730 [root] DEBUG: Imported "processing" modules:
2016-09-16 09:41:26,730 [root] DEBUG: 	 |-- AnalysisInfo
2016-09-16 09:41:26,731 [root] DEBUG: 	 |-- ApkInfo
2016-09-16 09:41:26,731 [root] DEBUG: 	 |-- Baseline
2016-09-16 09:41:26,731 [root] DEBUG: 	 |-- BehaviorAnalysis
2016-09-16 09:41:26,731 [root] DEBUG: 	 |-- DroppedBuffer
2016-09-16 09:41:26,732 [root] DEBUG: 	 |-- Debug
2016-09-16 09:41:26,732 [root] DEBUG: 	 |-- Droidmon
2016-09-16 09:41:26,732 [root] DEBUG: 	 |-- Dropped
2016-09-16 09:41:26,733 [root] DEBUG: 	 |-- TLSMasterSecrets
2016-09-16 09:41:26,733 [root] DEBUG: 	 |-- GooglePlay
2016-09-16 09:41:26,733 [root] DEBUG: 	 |-- Memory
2016-09-16 09:41:26,733 [root] DEBUG: 	 |-- NetworkAnalysis
2016-09-16 09:41:26,734 [root] DEBUG: 	 |-- ProcessMemory
2016-09-16 09:41:26,734 [root] DEBUG: 	 |-- Screenshots
2016-09-16 09:41:26,734 [root] DEBUG: 	 |-- Snort
2016-09-16 09:41:26,734 [root] DEBUG: 	 |-- Static
2016-09-16 09:41:26,735 [root] DEBUG: 	 |-- Strings
2016-09-16 09:41:26,735 [root] DEBUG: 	 |-- Suricata
2016-09-16 09:41:26,735 [root] DEBUG: 	 |-- TargetInfo
2016-09-16 09:41:26,736 [root] DEBUG: 	 `-- VirusTotal
2016-09-16 09:41:26,736 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 09:41:26,736 [root] DEBUG: 	 |-- MITM
2016-09-16 09:41:26,736 [root] DEBUG: 	 |-- Services
2016-09-16 09:41:26,737 [root] DEBUG: 	 `-- Sniffer
2016-09-16 09:41:26,737 [root] DEBUG: Imported "reporting" modules:
2016-09-16 09:41:26,737 [root] DEBUG: 	 |-- JsonDump
2016-09-16 09:41:26,737 [root] DEBUG: 	 |-- Moloch
2016-09-16 09:41:26,738 [root] DEBUG: 	 |-- MongoDB
2016-09-16 09:41:26,738 [root] DEBUG: 	 `-- ReportHTML
2016-09-16 09:41:26,738 [root] DEBUG: Imported "machinery" modules:
2016-09-16 09:41:26,738 [root] DEBUG: 	 `-- VirtualBox
2016-09-16 09:41:26,741 [root] DEBUG: Checking for locked tasks..
2016-09-16 09:41:26,756 [root] DEBUG: Checking for pending service tasks..
2016-09-16 09:41:26,769 [root] DEBUG: Initializing Yara...
2016-09-16 09:41:26,775 [root] DEBUG: 	 |-- index_binaries.yar
2016-09-16 09:41:26,775 [root] DEBUG: 	 `-- index_memory.yar
2016-09-16 09:41:26,790 [root] CRITICAL: CuckooCriticalError: Unable to bind ResultServer on 192.168.56.1:2042: [Errno 99] Cannot assign requested address
How to fix it?

 这个错误信息是由于无法连接到vm的原因导致的,故需要设置其网络设置。具体的设置步骤如下:

  cuckoo的配置以及启动场景问题分析_第1张图片cuckoo的配置以及启动场景问题分析_第2张图片

 就这样,vboxnet0在host-only模式下,就是我们需要使用的网络模式。

错误3:Could not find a registered machine named 'xp'

 详细错误信息:   

polo@polo-notebook:/opt/cuckoo$ sudo python cuckoo.py -d

                     _ 
    ____ _   _  ____| |  _ ___   ___
   / ___) | | |/ ___) |_/ ) _ \ / _ \
  ( (___| |_| ( (___|  _ ( |_| | |_| |
   \____)____/ \____)_| \_)___/ \___/

 Cuckoo Sandbox 2.0-rc1
 www.cuckoosandbox.org
 Copyright (c) 2010-2015

 Checking for updates...
 Good! You have the latest version available.

2016-09-16 09:53:07,298 [root] DEBUG: Importing modules...
2016-09-16 09:53:07,575 [root] DEBUG: Imported "signatures" modules:
2016-09-16 09:53:07,576 [root] DEBUG: 	 |-- CreatesExe
2016-09-16 09:53:07,577 [root] DEBUG: 	 `-- SystemMetrics
2016-09-16 09:53:07,577 [root] DEBUG: Imported "processing" modules:
2016-09-16 09:53:07,577 [root] DEBUG: 	 |-- AnalysisInfo
2016-09-16 09:53:07,577 [root] DEBUG: 	 |-- ApkInfo
2016-09-16 09:53:07,578 [root] DEBUG: 	 |-- Baseline
2016-09-16 09:53:07,578 [root] DEBUG: 	 |-- BehaviorAnalysis
2016-09-16 09:53:07,578 [root] DEBUG: 	 |-- DroppedBuffer
2016-09-16 09:53:07,579 [root] DEBUG: 	 |-- Debug
2016-09-16 09:53:07,579 [root] DEBUG: 	 |-- Droidmon
2016-09-16 09:53:07,580 [root] DEBUG: 	 |-- Dropped
2016-09-16 09:53:07,580 [root] DEBUG: 	 |-- TLSMasterSecrets
2016-09-16 09:53:07,580 [root] DEBUG: 	 |-- GooglePlay
2016-09-16 09:53:07,581 [root] DEBUG: 	 |-- Memory
2016-09-16 09:53:07,581 [root] DEBUG: 	 |-- NetworkAnalysis
2016-09-16 09:53:07,581 [root] DEBUG: 	 |-- ProcessMemory
2016-09-16 09:53:07,581 [root] DEBUG: 	 |-- Screenshots
2016-09-16 09:53:07,582 [root] DEBUG: 	 |-- Snort
2016-09-16 09:53:07,582 [root] DEBUG: 	 |-- Static
2016-09-16 09:53:07,582 [root] DEBUG: 	 |-- Strings
2016-09-16 09:53:07,583 [root] DEBUG: 	 |-- Suricata
2016-09-16 09:53:07,583 [root] DEBUG: 	 |-- TargetInfo
2016-09-16 09:53:07,584 [root] DEBUG: 	 `-- VirusTotal
2016-09-16 09:53:07,584 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 09:53:07,584 [root] DEBUG: 	 |-- MITM
2016-09-16 09:53:07,584 [root] DEBUG: 	 |-- Services
2016-09-16 09:53:07,585 [root] DEBUG: 	 `-- Sniffer
2016-09-16 09:53:07,585 [root] DEBUG: Imported "reporting" modules:
2016-09-16 09:53:07,585 [root] DEBUG: 	 |-- JsonDump
2016-09-16 09:53:07,586 [root] DEBUG: 	 |-- Moloch
2016-09-16 09:53:07,587 [root] DEBUG: 	 |-- MongoDB
2016-09-16 09:53:07,589 [root] DEBUG: 	 `-- ReportHTML
2016-09-16 09:53:07,590 [root] DEBUG: Imported "machinery" modules:
2016-09-16 09:53:07,590 [root] DEBUG: 	 `-- VirtualBox
2016-09-16 09:53:07,593 [root] DEBUG: Checking for locked tasks..
2016-09-16 09:53:07,620 [root] DEBUG: Checking for pending service tasks..
2016-09-16 09:53:07,630 [root] DEBUG: Initializing Yara...
2016-09-16 09:53:07,638 [root] DEBUG: 	 |-- index_binaries.yar
2016-09-16 09:53:07,645 [root] DEBUG: 	 `-- index_memory.yar
2016-09-16 09:53:07,665 [lib.cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.56.1:2042.
2016-09-16 09:53:07,669 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
2016-09-16 09:53:08,367 [modules.machinery.virtualbox] DEBUG: Stopping vm xp
2016-09-16 09:53:08,368 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:08,521 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp

2016-09-16 09:53:09,555 [modules.machinery.virtualbox] DEBUG: VBoxManage exited with error powering off the machine
2016-09-16 09:53:09,557 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:09,711 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp

2016-09-16 09:53:09,733 [lib.cuckoo.common.abstracts] DEBUG: Waiting 0 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:10,734 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:10,887 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp

2016-09-16 09:53:10,908 [lib.cuckoo.common.abstracts] DEBUG: Waiting 1 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:11,910 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:12,063 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp

2016-09-16 09:53:12,083 [lib.cuckoo.common.abstracts] DEBUG: Waiting 2 cuckooseconds for machine xp to switch to status ['poweroff', 'aborted', 'saved']
2016-09-16 09:53:13,085 [modules.machinery.virtualbox] DEBUG: Getting status for xp
2016-09-16 09:53:13,246 [modules.machinery.virtualbox] DEBUG: VBoxManage returns error checking status for machine xp: VBoxManage: error: Could not find a registered machine named 'xp'
VBoxManage: error: Details: code VBOX_E_OBJECT_NOT_FOUND (0x80bb0001), component VirtualBoxWrap, interface IVirtualBox, callee nsISupports
VBoxManage: error: Context: "FindMachine(Bstr(VMNameOrUuid).raw(), machine.asOutParam())" at line 2780 of file VBoxManageInfo.cpp
How to fix it?

Sudo chown -R currentuser: cuckoo

错误5: CRITICAL: CuckooCriticalError: Unable to bind ResultServer on192.168.56.1:2042: [Errno 99] Cannot assign requested address

详细错误信息:

2016-09-16 18:05:50,974 [root] DEBUG: Importing modules...
2016-09-16 18:05:51,159 [root] DEBUG: Imported "signatures" modules:
2016-09-16 18:05:51,160 [root] DEBUG: 	 |-- CreatesExe
2016-09-16 18:05:51,160 [root] DEBUG: 	 `-- SystemMetrics
2016-09-16 18:05:51,160 [root] DEBUG: Imported "processing" modules:
2016-09-16 18:05:51,160 [root] DEBUG: 	 |-- AnalysisInfo
2016-09-16 18:05:51,161 [root] DEBUG: 	 |-- ApkInfo
2016-09-16 18:05:51,161 [root] DEBUG: 	 |-- Baseline
2016-09-16 18:05:51,161 [root] DEBUG: 	 |-- BehaviorAnalysis
2016-09-16 18:05:51,161 [root] DEBUG: 	 |-- DroppedBuffer
2016-09-16 18:05:51,162 [root] DEBUG: 	 |-- Debug
2016-09-16 18:05:51,162 [root] DEBUG: 	 |-- Droidmon
2016-09-16 18:05:51,162 [root] DEBUG: 	 |-- Dropped
2016-09-16 18:05:51,163 [root] DEBUG: 	 |-- TLSMasterSecrets
2016-09-16 18:05:51,163 [root] DEBUG: 	 |-- GooglePlay
2016-09-16 18:05:51,163 [root] DEBUG: 	 |-- Memory
2016-09-16 18:05:51,163 [root] DEBUG: 	 |-- NetworkAnalysis
2016-09-16 18:05:51,164 [root] DEBUG: 	 |-- ProcessMemory
2016-09-16 18:05:51,164 [root] DEBUG: 	 |-- Screenshots
2016-09-16 18:05:51,164 [root] DEBUG: 	 |-- Snort
2016-09-16 18:05:51,164 [root] DEBUG: 	 |-- Static
2016-09-16 18:05:51,165 [root] DEBUG: 	 |-- Strings
2016-09-16 18:05:51,165 [root] DEBUG: 	 |-- Suricata
2016-09-16 18:05:51,165 [root] DEBUG: 	 |-- TargetInfo
2016-09-16 18:05:51,166 [root] DEBUG: 	 `-- VirusTotal
2016-09-16 18:05:51,166 [root] DEBUG: Imported "auxiliary" modules:
2016-09-16 18:05:51,166 [root] DEBUG: 	 |-- MITM
2016-09-16 18:05:51,166 [root] DEBUG: 	 |-- Services
2016-09-16 18:05:51,167 [root] DEBUG: 	 `-- Sniffer
2016-09-16 18:05:51,167 [root] DEBUG: Imported "reporting" modules:
2016-09-16 18:05:51,167 [root] DEBUG: 	 |-- JsonDump
2016-09-16 18:05:51,167 [root] DEBUG: 	 |-- Moloch
2016-09-16 18:05:51,168 [root] DEBUG: 	 |-- MongoDB
2016-09-16 18:05:51,168 [root] DEBUG: 	 `-- ReportHTML
2016-09-16 18:05:51,168 [root] DEBUG: Imported "machinery" modules:
2016-09-16 18:05:51,168 [root] DEBUG: 	 `-- VirtualBox
2016-09-16 18:05:51,172 [root] DEBUG: Checking for locked tasks..
2016-09-16 18:05:51,187 [root] DEBUG: Checking for pending service tasks..
2016-09-16 18:05:51,197 [root] DEBUG: Initializing Yara...
2016-09-16 18:05:51,199 [root] DEBUG: 	 |-- index_binaries.yar
2016-09-16 18:05:51,200 [root] DEBUG: 	 `-- index_memory.yar
2016-09-16 18:05:51,213 [root] CRITICAL: CuckooCriticalError: Unable to bind ResultServer on 192.168.56.1:2042: [Errno 99] Cannot assign requested address
How to fix it?

 # If the hostonly interface vboxnet0 does not exist already.

$ VBoxManage hostonlyif create

# Configure vboxnet0.
$ VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 --netmask 255.255.255.0

你可能感兴趣的:(cuckoo的配置以及启动场景问题分析)