cuckoo布谷鸟沙箱安装与布置使用
环境以及安装前的注意事项
不提供本次实现所涉及分析的木马
-
本次安装所需要构造的所有的环境的大体图
- 物理机（windows）
如果你的物理机装的是Ubuntu或者其他debian系统那就更好了，安装步骤会更快- 虚拟机管理软件（安装在你的物理机上的）
推荐：VMware、virtualbox（不推荐）- 虚拟机里的虚拟机
Ubuntu 16.04.4,16.04.6 (这两个版本用的源不一样) windows7(x86)32位机器，也就是说我们需要在虚拟机下装一个虚拟机所以大体的环境就是你的win10本机下装一个VMware，VMware里面装了一个Ubuntu16.04，Ubuntu16.04里面装了个windows7，其中Ubuntu称为我们的host主机，Windows称为我们guest，这里是官方这么称呼的
-
环境及版本的问题
1. Ubuntu的版本(笔者用的是ubuntu 16.04.6，所以以下的所有测试操作以16.04.6为准) Ubuntu 16.04.6 2. windows的版本 cn_windows_7_professional_x86_dvd_x15-65790.iso 3. VMware的版本 VMware 15.1.0 4. Virtualbox的版本 virtualbox 6.0.8(cuckoo不支持低版本的virtualbox了)
Host主机和Guest安装配置
- 以下操作基于一台刚装好的Ubuntu机器，安装过程可百度
基本设置和更新
-
更新源
gedit /etc/apt/sources.list ## 16.04.4的推荐源 deb http://mirrors.aliyun.com/ubuntu/ trusty main multiverse restricted universe deb http://mirrors.aliyun.com/ubuntu/ trusty-backports main multiverse restricted universe deb http://mirrors.aliyun.com/ubuntu/ trusty-proposed main multiverse restricted universe deb http://mirrors.aliyun.com/ubuntu/ trusty-security main multiverse restricted universe deb http://mirrors.aliyun.com/ubuntu/ trusty-updates main multiverse restricted universe deb-src http://mirrors.aliyun.com/ubuntu/ trusty main multiverse restricted universe deb-src http://mirrors.aliyun.com/ubuntu/ trusty-backports main multiverse restricted universe deb-src http://mirrors.aliyun.com/ubuntu/ trusty-proposed main multiverse restricted universe deb-src http://mirrors.aliyun.com/ubuntu/ trusty-security main multiverse restricted universe deb-src http://mirrors.aliyun.com/ubuntu/ trusty-updates main multiverse restricted universe ## 16.04.6的推荐源 deb-src http://archive.ubuntu.com/ubuntu xenial main restricted deb http://mirrors.aliyun.com/ubuntu/ xenial main restricted deb-src http://mirrors.aliyun.com/ubuntu/ xenial main restricted multiverse universe deb http://mirrors.aliyun.com/ubuntu/ xenial-updates main restricted deb-src http://mirrors.aliyun.com/ubuntu/ xenial-updates main restricted multiverse universe deb http://mirrors.aliyun.com/ubuntu/ xenial universe deb http://mirrors.aliyun.com/ubuntu/ xenial-updates universe deb http://mirrors.aliyun.com/ubuntu/ xenial multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-updates multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-backports main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial-backports main restricted universe multiverse deb http://archive.canonical.com/ubuntu xenial partner deb-src http://archive.canonical.com/ubuntu xenial partner deb http://mirrors.aliyun.com/ubuntu/ xenial-security main restricted deb-src http://mirrors.aliyun.com/ubuntu/ xenial-security main restricted multiverse universe deb http://mirrors.aliyun.com/ubuntu/ xenial-security universe deb http://mirrors.aliyun.com/ubuntu/ xenial-security multiverseapt-get update && apt-get upgrade -
ubuntu 14.04.0
deb http://mirrors.163.com/ubuntu/ trusty main restricted universe multiverse deb http://mirrors.163.com/ubuntu/ trusty-security main restricted universe multiverse deb http://mirrors.163.com/ubuntu/ trusty-updates main restricted universe multiverse deb http://mirrors.163.com/ubuntu/ trusty-proposed main restricted universe multiverse deb http://mirrors.163.com/ubuntu/ trusty-backports main restricted universe multiverse deb-src http://mirrors.163.com/ubuntu/ trusty main restricted universe multiverse deb-src http://mirrors.163.com/ubuntu/ trusty-security main restricted universe multiverse deb-src http://mirrors.163.com/ubuntu/ trusty-updates main restricted universe multiverse deb-src http://mirrors.163.com/ubuntu/ trusty-proposed main restricted universe multiverse deb-src http://mirrors.163.com/ubuntu/ trusty-backports main restricted universe multiverse -
终端美化（非必需）
1、安装zsh
apt-get install zsh -y2、修改默认shell
chsh -s /bin/zsh3、 安装Git
apt-get install git -y4、安装oh-my-zsh
sh -c "$(curl -fsSL https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"5、安装zsh-syntax-highlighting语法高亮插件
git clone https://github.com/zsh-users/zsh-syntax-highlighting.git echo "source ${(q-)PWD}/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh" >> ${ZDOTDIR:-$HOME}/.zshrc source ~/.zshrc6、安装zsh-autosuggestions语法历史记录插件
git clone git://github.com/zsh-users/zsh-autosuggestions $ZSH_CUSTOM/plugins/zsh-autosuggestions vim ~/.zshrc ## 在zshrc的这一行加入zsh-autosuggestions plugins=( zsh-autosuggestions ) source ~/.zshrc
依赖环境和cuckoo的安装
Git安装
apt-get install git -y
Requirements
apt-get install python python-pip python-dev libffi-dev libssl-dev -y
apt-get install python-virtualenv python-setuptools -y
apt-get install libjpeg-dev zlib1g-dev swig -y
- 配置pip源，加速pip下载
# 创建pip的配置文件
mkdir ~/.pip
touch ~/.pip/pip.conf
sudo gedit ~/.pip/pip.conf
# 粘贴一下内容
[global]
index-url = http://pypi.douban.com/simple
[install]
trusted-host=pypi.douban.com
# 推荐的镜像源
# 豆瓣(douban) http://pypi.douban.com/simple/ (推荐)
# 清华大学 https://pypi.tuna.tsinghua.edu.cn/simple/
# 阿里云 http://mirrors.aliyun.com/pypi/simple/
# 中国科技大学 https://pypi.mirrors.ustc.edu.cn/simple/
# 中国科学技术大学 http://pypi.mirrors.ustc.edu.cn/simple/
# pip升级后会有文件的错误，编辑以下文件内容(如果你pip能够正常不需要改)
gedit /usr/bin/pip
from pip import main 改为 from pip._internal import main
Mongodb
apt-get install mongodb -y
Postgresql
apt-get install postgresql libpq-dev -y
VirtualBox
echo deb http://download.virtualbox.org/virtualbox/debian xenial contrib | sudo tee -a /etc/apt/sources.list.d/virtualbox.list
wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
apt-get update
## 切换到你的virtualbox deb包目录下后执行以下命令
dpkg -i virtualbox-6.0_6.0.8-130520~Ubuntu~xenial_amd64.deb
## 如果你的机器原来安装过virtualbox，也就是你的Ubuntu，执行以下命令后再进行安装
apt remove virtualbox*
Tcpdump
apt-get install tcpdump apparmor-utils -y
aa-disable /usr/sbin/tcpdump
M2Crypto
## 如果下载速度很慢，请翻到上面pip的源配置，进行源更新
pip install m2crypto==0.24.0
Cuckoo
## 如果下载速度很慢，请翻到上面pip的源配置，进行源更新
pip install -U pip setuptools
pip install -U cuckoo
Cuckoo Working Directory
adduser cuckoo
mkdir /opt/cuckoo
chown cuckoo:cuckoo /opt/cuckoo
# cuckoo -cwd 可以将工作路径切换到/opt/cuckoo这个目录下，这样在这个目录下就可以看到所有的配置文件
cuckoo --cwd /opt/cuckoo
usermod -a -G sudo cuckoo
Network Config
# 创建一张网卡
vboxmanage hostonlyif create
vboxmanage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1
# 设置host与guest的转发规则
# 注意网卡与你的电脑的网卡是否对应 ifconfig可查看对应网卡
iptables -A FORWARD -o ens32 -i vboxnet0 -s 192.168.56.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE
# 开启转发
echo 1 > /proc/sys/net/ipv4/ip_forward
Guest Config
基本安装步骤，注意将网络改为仅主机模式并选择vboxnet0这张网卡
关闭防火墙
关闭自动通知
关闭自动更新
安装Python
安装pillow
agent.py
# 1. 将agent.py改名为agent.pyw
# 2. 将agent.pyw放到C:\Users\[USER]\AppData\Roaming\MicroSoft\Windows\Start Menu\Programs\Startup\
# 将user改为你们的计算机登录名
配置网络
# 在cmd下能ping www.baidu.com即可
Static IP - 192.168.56.101
Default Gateway - 192.168.56.1
DNS - any DNS server (8.8.8.8)
启动cuckoo
## 启动
cuckoo -d
## 要启动web界面，要进入/opt/cuckoo/conf目录下，修改reporting.conf文件，将Mongodb的配置选项改为yes
cuckoo web
安装和配置细节问题
1、virtualbox的deb包，如果你的系统版本不是16.04，请自行下载14.04或者其他版本对应的deb再进行安装
2、如果失败，请尝试多次重新安装，有可能因为网络问题而导致下载失败或者安装失败
3、如果遇到的问题在上文中没有涉及，有可能你的环境原来装了某些东西，导致冲突
4、安装虚拟机时，分配的CPU核数和内存分配（Ubuntu：4G 2CPU 2核 Win7：2G 1CPU）
5、pip可能出现的问题(bash: /usr/bin/pip：没有那个文件或者目录) -> type pip、hash -r即可
cuckoo使用及原理
Summary
Static Analysis（静态分析PE）
节表
Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000da4 0x00000e00 6.00946031443
.rdata 0x00002000 0x000006c4 0x00000800 4.55625445079
.data 0x00003000 0x000003d4 0x00000400 6.576853413
.rsrc 0x00004000 0x00006840 0x00006a00 7.6294976516
资源表项
导入表
Library ADVAPI32.dll:
• 0x402000 RegSetValueA
• 0x402004 RegSetValueExA
• 0x402008 RegCloseKey
• 0x40200c RegOpenKeyA
• 0x402010 RegCreateKeyExA
Library KERNEL32.dll:
• 0x402018 WriteProcessMemory
• 0x40201c GetThreadContext
• 0x402020 SetThreadContext
• 0x402024 ResumeThread
• 0x402028 TerminateProcess
• 0x40202c IsBadReadPtr
• 0x402030 VirtualAllocEx
• 0x402034 SetErrorMode
• 0x402038 OpenMutexA
• 0x40203c FreeLibrary
• 0x402040 OpenFileMappingA
• 0x402044 MapViewOfFile
• 0x402048 UnmapViewOfFile
• 0x40204c CreateProcessA
• 0x402050 GetStartupInfoA
• 0x402054 Sleep
• 0x402058 ExitProcess
• 0x40205c LocalAlloc
• 0x402060 FindResourceA
• 0x402064 FreeResource
• 0x402068 DeleteFileA
• 0x40206c SetFilePointer
• 0x402070 CloseHandle
• 0x402074 WriteFile
• 0x402078 CreateFileA
• 0x40207c LockResource
• 0x402080 SizeofResource
• 0x402084 LoadResource
• 0x402088 GetTempFileNameA
• 0x40208c GetTempPathA
• 0x402090 GetProcAddress
• 0x402094 LoadLibraryA
• 0x402098 lstrlenA
• 0x40209c CopyFileA
• 0x4020a0 GetModuleHandleA
• 0x4020a4 lstrcatA
• 0x4020a8 CreateDirectoryA
• 0x4020ac GetFileAttributesA
• 0x4020b0 GetModuleFileNameA
• 0x4020b4 ExpandEnvironmentStringsA
• 0x4020b8 MoveFileExA
• 0x4020bc GetFileAttributesExA
• 0x4020c0 lstrcpyA
字符串
字符串处理过了，没什么有用的
Behavioral Analysis（行为分析）
NtCreateThreadEx + LdrLoadDll ：远程注入
Reg ：操作注册表隐藏进程
NtCreateSection + NtMapViewOfSection ：创建节表
NtAllocateVirtualMemory ：注入代码
NtWriteFile ：创建了tmp文件 621F.tmp
7214d083b2126a84_621F.tmp
c04d4649d4a185ce_622A.tmp
Network Analysis（网络行为分析）
发送了很多UDP包，测试了一下网络，初步估计没有网络就停止下一步的行为
192.168.56.101:137 -> 192.168.56.255:137
192.168.56.101:138 -> 192.168.56.255:138
isatap：ipv6转Ipv4的包
192.168.56.101:138 -> 224.0.0.252:5355
192.168.56.101:1900 -> 239.255.255.250:190
192.168.56.101:49540 -> 8.8.8.8:53
Dropped Files（删除的文件）
7214d083b2126a84_621F.tmp
vmdetect - Possibly employs anti-virtualization techniques
e2e2ac0f197a1225a94b46c556f3e5ab67006804_rmoc3260.dl
rmoc3260.dl
2628B4C8FAFCE372B8F74479BE7E3CBA
aa
cY8UWCt7.scr
GZ2Ed0.bmp
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
c04d4649d4a185ce_622A.tmp
shellcode - Matched shellcode byte patterns
2017-09-11
03BBA3169A01B264D3675578795889B95BF28DBAE4B860B924F83E8EA96DACF5.exe
Dropped Buffers（删除的内存）
Process Memory（进程内存）
http://www.iec.ch
http://purl.org/rss/1.0/modules/content/
http://wellformedweb.org/CommentAPI/
http://purl.org/rss/1.0/modules/syndication/
http://www.microsoft.com/schemas/rss/core/2005
http://purl.org/dc/elements/1.1/
http://www.microsoft.com/schemas/rss/core/2005/internal
http://localizability/practices/XMLConfiguration.asp
http://purl.org/atom/ns
http://purl.org/rss/1.0/
http://purl.org/dc/terms/
http://localizability/practices/XML.asp
http://www.microsoft.com/schemas/rss/monitoring/2007
http://purl.org/rss/1.0/modules/slash/