Cuckoo SandBox安装笔记及简单操作
安装可参考可参考https://www.jianshu.com/p/f623fa0bebf9和官方文档https://cuckoo.sh/docs/installation/host/requirements.html
vbox要下载后安装，选择最新的 https://www.virtualbox.org/wiki/Linux_Downloads
所有的文件都在 '.cuckoo' 中，要用'Ctrl+h'将此文件夹显示出来,
- conf 配置文件,很重要
.cuckoo - storage 传输回来的报告
- web 界面
在安装cuckoo的时候可能会出现如下问题
icedxu@icedxu:~/cuckoo$ sudo pip install -U cuckoo
The directory '/home/icedxu/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
The directory '/home/icedxu/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
Collecting cuckoo
Requirement already satisfied, skipping upgrade: pymisp==2.4.54 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (2.4.54)
Requirement already satisfied, skipping upgrade: unicorn==1.0.1 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.0.1)
Requirement already satisfied, skipping upgrade: chardet==2.3.0 in /usr/lib/python2.7/dist-packages (from cuckoo) (2.3.0)
Requirement already satisfied, skipping upgrade: python-magic==0.4.12 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.4.12)
Requirement already satisfied, skipping upgrade: roach<0.2,>=0.1.2 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.1.2)
Requirement already satisfied, skipping upgrade: pymongo==3.0.3 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (3.0.3)
Requirement already satisfied, skipping upgrade: beautifulsoup4==4.5.3 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (4.5.3)
Collecting peepdf<0.5,>=0.4.2 (from cuckoo)
Collecting scapy==2.3.2; sys_platform == "linux2" (from cuckoo)
Requirement already satisfied, skipping upgrade: flask==0.12.2 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.12.2)
Requirement already satisfied, skipping upgrade: django-extensions==1.6.7 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.6.7)
Requirement already satisfied, skipping upgrade: dpkt==1.8.7 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.8.7)
Collecting pyelftools==0.24 (from cuckoo)
Requirement already satisfied, skipping upgrade: jinja2==2.9.6 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (2.9.6)
Requirement already satisfied, skipping upgrade: oletools==0.51 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.51)
Collecting yara-python==3.6.3 (from cuckoo)
Collecting pyguacamole==0.6 (from cuckoo)
Requirement already satisfied, skipping upgrade: click==6.6 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (6.6)
Requirement already satisfied, skipping upgrade: alembic==0.8.8 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.8.8)
Requirement already satisfied, skipping upgrade: httpreplay<0.3,>=0.2.2 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.2.4)
Requirement already satisfied, skipping upgrade: egghatch<0.3,>=0.2.3 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (0.2.3)
Requirement already satisfied, skipping upgrade: requests[security]==2.13.0; sys_platform == "linux2" in /usr/local/lib/python2.7/dist-packages (from cuckoo) (2.13.0)
Requirement already satisfied, skipping upgrade: jsbeautifier==1.6.2 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.6.2)
Requirement already satisfied, skipping upgrade: androguard==3.0.1 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (3.0.1)
Collecting pillow==3.2 (from cuckoo)
Downloading https://files.pythonhosted.org/packages/e2/af/0a3981fffc5cd43078eb8b1057702e0dd2d5771e5aaa36cbd140e32f8473/Pillow-3.2.0.tar.gz (10.3MB)
100% |████████████████████████████████| 10.3MB 34kB/s
Requirement already satisfied, skipping upgrade: sqlalchemy==1.0.8 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.0.8)
Requirement already satisfied, skipping upgrade: elasticsearch==5.3.0 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (5.3.0)
Collecting sflock<0.4,>=0.3.5 (from cuckoo)
Requirement already satisfied, skipping upgrade: python-dateutil==2.4.2 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (2.4.2)
Requirement already satisfied, skipping upgrade: pefile2==1.2.11 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.2.11)
Requirement already satisfied, skipping upgrade: flask-sqlalchemy==2.1 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (2.1)
Collecting wakeonlan==0.2.2 (from cuckoo)
Requirement already satisfied, skipping upgrade: django==1.8.4 in /usr/local/lib/python2.7/dist-packages (from cuckoo) (1.8.4)
Requirement already satisfied, skipping upgrade: jsonschema in /usr/local/lib/python2.7/dist-packages (from pymisp==2.4.54->cuckoo) (2.6.0)
Requirement already satisfied, skipping upgrade: capstone==3.0.5rc2; sys_platform == "linux2" in /usr/local/lib/python2.7/dist-packages (from roach<0.2,>=0.1.2->cuckoo) (3.0.5rc2)
Requirement already satisfied, skipping upgrade: pycrypto in /usr/local/lib/python2.7/dist-packages (from roach<0.2,>=0.1.2->cuckoo) (2.6.1)
Requirement already satisfied, skipping upgrade: cryptography>=2.1 in /usr/local/lib/python2.7/dist-packages (from roach<0.2,>=0.1.2->cuckoo) (2.4.2)
Requirement already satisfied, skipping upgrade: future>=0.16.0 in /usr/local/lib/python2.7/dist-packages (from peepdf<0.5,>=0.4.2->cuckoo) (0.17.1)
Requirement already satisfied, skipping upgrade: pythonaes==1.0 in /usr/local/lib/python2.7/dist-packages (from peepdf<0.5,>=0.4.2->cuckoo) (1.0)
Requirement already satisfied, skipping upgrade: colorama==0.3.7 in /usr/local/lib/python2.7/dist-packages (from peepdf<0.5,>=0.4.2->cuckoo) (0.3.7)
Requirement already satisfied, skipping upgrade: Werkzeug>=0.7 in /usr/local/lib/python2.7/dist-packages (from flask==0.12.2->cuckoo) (0.14.1)
Requirement already satisfied, skipping upgrade: itsdangerous>=0.21 in /usr/local/lib/python2.7/dist-packages (from flask==0.12.2->cuckoo) (1.1.0)
Requirement already satisfied, skipping upgrade: six>=1.2 in /usr/local/lib/python2.7/dist-packages (from django-extensions==1.6.7->cuckoo) (1.11.0)
Requirement already satisfied, skipping upgrade: MarkupSafe>=0.23 in /usr/lib/python2.7/dist-packages (from jinja2==2.9.6->cuckoo) (0.23)
Requirement already satisfied, skipping upgrade: Mako in /usr/local/lib/python2.7/dist-packages (from alembic==0.8.8->cuckoo) (1.0.7)
Requirement already satisfied, skipping upgrade: python-editor>=0.3 in /usr/local/lib/python2.7/dist-packages (from alembic==0.8.8->cuckoo) (1.0.3)
Requirement already satisfied, skipping upgrade: tlslite-ng==0.6.0 in /usr/local/lib/python2.7/dist-packages (from httpreplay<0.3,>=0.2.2->cuckoo) (0.6.0)
Requirement already satisfied, skipping upgrade: idna>=2.0.0; extra == "security" in /usr/local/lib/python2.7/dist-packages (from requests[security]==2.13.0; sys_platform == "linux2"->cuckoo) (2.7)
Requirement already satisfied, skipping upgrade: pyOpenSSL>=0.14; extra == "security" in /usr/local/lib/python2.7/dist-packages (from requests[security]==2.13.0; sys_platform == "linux2"->cuckoo) (18.0.0)
Requirement already satisfied, skipping upgrade: urllib3<2.0,>=1.8 in /usr/local/lib/python2.7/dist-packages (from elasticsearch==5.3.0->cuckoo) (1.24.1)
Collecting olefile==0.43 (from sflock<0.4,>=0.3.5->cuckoo)
Requirement already satisfied, skipping upgrade: functools32; python_version == "2.7" in /usr/local/lib/python2.7/dist-packages (from jsonschema->pymisp==2.4.54->cuckoo) (3.2.3.post2)
Requirement already satisfied, skipping upgrade: enum34; python_version < "3" in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1->roach<0.2,>=0.1.2->cuckoo) (1.1.6)
Requirement already satisfied, skipping upgrade: asn1crypto>=0.21.0 in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1->roach<0.2,>=0.1.2->cuckoo) (0.24.0)
Requirement already satisfied, skipping upgrade: cffi!=1.11.3,>=1.7 in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1->roach<0.2,>=0.1.2->cuckoo) (1.11.5)
Requirement already satisfied, skipping upgrade: ipaddress; python_version < "3" in /usr/local/lib/python2.7/dist-packages (from cryptography>=2.1->roach<0.2,>=0.1.2->cuckoo) (1.0.22)
Requirement already satisfied, skipping upgrade: ecdsa in /usr/local/lib/python2.7/dist-packages (from tlslite-ng==0.6.0->httpreplay<0.3,>=0.2.2->cuckoo) (0.13)
Requirement already satisfied, skipping upgrade: pycparser in /usr/local/lib/python2.7/dist-packages (from cffi!=1.11.3,>=1.7->cryptography>=2.1->roach<0.2,>=0.1.2->cuckoo) (2.19)
Installing collected packages: pillow, peepdf, scapy, pyelftools, yara-python, pyguacamole, olefile, sflock, wakeonlan, cuckoo
Running setup.py install for pillow ... error
Complete output from command /usr/bin/python -u -c "import setuptools, tokenize;__file__='/tmp/pip-install-Mq8yLS/pillow/setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record /tmp/pip-record-GSOPeD/install-record.txt --single-version-externally-managed --compile:
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/PIL
copying PIL/TiffImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageMorph.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/WebPImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageMath.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageEnhance.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageGrab.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImagePalette.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/IptcImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GimpGradientFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageMode.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageFilter.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PyAccess.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/FpxImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/TarIO.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/features.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImagePath.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/MpegImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PdfImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/BdfFontFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GimpPaletteFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageWin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PixarImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ExifTags.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/FliImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PcxImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/OleFileIO.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/JpegImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GbrImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/_util.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageDraw2.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/IcnsImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageQt.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageShow.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/MspImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageStat.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/BufrStubImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/MicImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/CurImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/FtexImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/XpmImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/Image.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/WmfImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PSDraw.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/_binary.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/TgaImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GribStubImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PaletteFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PngImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageFont.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/SunImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/DcxImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageTk.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/DdsImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GifImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/FontFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageTransform.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PsdImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageOps.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/McIdasImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/__init__.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageDraw.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageSequence.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PalmImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageCms.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/XVThumbImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/GdImageFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PcfFontFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/SpiderImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/WalImageFile.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/Jpeg2KImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageChops.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImageColor.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ImtImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/XbmImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/TiffTags.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/JpegPresets.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/SgiImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/Hdf5StubImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/BmpImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PcdImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/ContainerIO.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/PpmImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/FitsStubImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/IcoImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/EpsImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
copying PIL/MpoImagePlugin.py -> build/lib.linux-x86_64-2.7/PIL
running egg_info
writing Pillow.egg-info/PKG-INFO
writing top-level names to Pillow.egg-info/top_level.txt
writing dependency_links to Pillow.egg-info/dependency_links.txt
reading manifest file 'Pillow.egg-info/SOURCES.txt'
reading manifest template 'MANIFEST.in'
warning: no files found matching '*.sh'
no previously-included directories found matching 'docs/_static'
warning: no previously-included files found matching '.coveragerc'
warning: no previously-included files found matching '.editorconfig'
warning: no previously-included files found matching '.landscape.yaml'
warning: no previously-included files found matching 'appveyor.yml'
warning: no previously-included files found matching 'build_children.sh'
warning: no previously-included files found matching 'tox.ini'
warning: no previously-included files matching '.git*' found anywhere in distribution
warning: no previously-included files matching '*.pyc' found anywhere in distribution
warning: no previously-included files matching '*.so' found anywhere in distribution
writing manifest file 'Pillow.egg-info/SOURCES.txt'
copying PIL/OleFileIO-README.md -> build/lib.linux-x86_64-2.7/PIL
running build_ext
Traceback (most recent call last):
File "", line 1, in
File "/tmp/pip-install-Mq8yLS/pillow/setup.py", line 767, in
zip_safe=not debug_build(), )
File "/usr/local/lib/python2.7/dist-packages/setuptools/__init__.py", line 143, in setup
return distutils.core.setup(**attrs)
File "/usr/lib/python2.7/distutils/core.py", line 151, in setup
dist.run_commands()
File "/usr/lib/python2.7/distutils/dist.py", line 953, in run_commands
self.run_command(cmd)
File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command
cmd_obj.run()
File "/usr/local/lib/python2.7/dist-packages/setuptools/command/install.py", line 61, in run
return orig.install.run(self)
File "/usr/lib/python2.7/distutils/command/install.py", line 601, in run
self.run_command('build')
File "/usr/lib/python2.7/distutils/cmd.py", line 326, in run_command
self.distribution.run_command(command)
File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command
cmd_obj.run()
File "/usr/lib/python2.7/distutils/command/build.py", line 128, in run
self.run_command(cmd_name)
File "/usr/lib/python2.7/distutils/cmd.py", line 326, in run_command
self.distribution.run_command(command)
File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command
cmd_obj.run()
File "/usr/lib/python2.7/distutils/command/build_ext.py", line 339, in run
self.build_extensions()
File "/tmp/pip-install-Mq8yLS/pillow/setup.py", line 512, in build_extensions
' using --disable-%s, aborting' % (f, f))
ValueError: jpeg is required unless explicitly disabled using --disable-jpeg, aborting
----------------------------------------
Command "/usr/bin/python -u -c "import setuptools, tokenize;__file__='/tmp/pip-install-Mq8yLS/pillow/setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record /tmp/pip-record-GSOPeD/install-record.txt --single-version-externally-managed --compile" failed with error code 1 in /tmp/pip-install-Mq8yLS/pillow/
解决方法：https://blog.csdn.net/cryhelyxx/article/details/22589707
安装 JPEG、ZLIB
icedxu@icedxu:~$ cuckoo
_|
_|_|_| _| _| _|_|_| _| _| _|_| _|_|
_| _| _| _| _|_| _| _| _| _|
_| _| _| _| _| _| _| _| _| _|
_|_|_| _|_|_| _|_|_| _| _| _|_| _|_|
Cuckoo Sandbox 2.0.6
www.cuckoosandbox.org
Copyright (c) 2010-2018
Traceback (most recent call last):
File "/usr/local/bin/cuckoo", line 11, in
sys.exit(main())
File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 716, in __call__
return self.main(*args, **kwargs)
File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 696, in main
rv = self.invoke(ctx)
File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 1037, in invoke
return Command.invoke(self, ctx)
File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 889, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 534, in invoke
return callback(*args, **kwargs)
File "/usr/local/lib/python2.7/dist-packages/click/decorators.py", line 17, in new_func
return f(get_current_context(), *args, **kwargs)
File "/usr/local/lib/python2.7/dist-packages/cuckoo/main.py", line 242, in main
sys.stderr.write(exception_message())
File "/usr/local/lib/python2.7/dist-packages/cuckoo/common/utils.py", line 262, in exception_message
for package in pip.get_installed_distributions()
AttributeError: 'module' object has no attribute 'get_installed_distributions' 以上问题的解决方法 https://blog.csdn.net/tmsshikun/article/details/80998293
python -m pip install pip==9.0.3
安装sudo pip install -U pip cuckoo
后出现无法卸载dpkt
可用 sudo apt-get remove python-dpkt去卸载再安装cuckoo
之后可正常启动cuckoo
# If the hostonly interface vboxnet0 does not exist already.
$ VBoxManage hostonlyif create
# Configure vboxnet0.
$ VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 --netmask 255.255.255.0
VBoxManage hostonlyif remove vboxnet0 移除网卡IP配置可以看 http://www.freebuf.com/sectool/108533.html
win7_1设置--> 网络--> 连接方式（仅主机（Host-Only网络）），界面名称（vboxnet0）
ipv4:
ip: 192.168.56.101
mask: 255.255.255.0
getway: 192.168.56.1
dns:192.168.56.1
# If the hostonly interface vboxnet0 does not exist already.
$ VBoxManage hostonlyif create
# Configure vboxnet0.
$ VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 --netmask 255.255.255.0
VBoxManage hostonlyif remove vboxnet0 移除网卡最重要的就是vbox*.conf的配置 https://blog.csdn.net/ab455373162/article/details/52208954
icedxu@icedxu:~/cuckoo$ cuckoo
_ _ _ _ _ _
/\ \ /\_\ /\ \ /\_\ /\ \ /\ \
/ \ \ / / / _ / \ \ / / / _ / \ \ / \ \
/ /\ \ \ \ \ \__ /\_\ / /\ \ \ / / / /\_\ / /\ \ \ / /\ \ \
/ / /\ \ \ \ \___\ / / // / /\ \ \ / / /__/ / / / / /\ \ \ / / /\ \ \
/ / / \ \_\ \__ / / / // / / \ \_\ / /\_____/ / / / / \ \_\ / / / \ \_\
/ / / \/_/ / / / / / // / / \/_/ / /\_______/ / / / / / // / / / / /
/ / / / / / / / // / / / / /\ \ \ / / / / / // / / / / /
/ / /________ / / /___/ / // / /________ / / / \ \ \ / / /___/ / // / /___/ / /
/ / /_________\/ / /____\/ // / /_________\/ / / \ \ \ / / /____\/ // / /____\/ /
\/____________/\/_________/ \/____________/\/_/ \_\_\\/_________/ \/_________/
Cuckoo Sandbox 2.0.6
www.cuckoosandbox.org
Copyright (c) 2010-2018
=======================================================================
Welcome to Cuckoo Sandbox, this appears to be your first run!
We will now set you up with our default configuration.
You will be able to see and modify the Cuckoo configuration,
Yara rules, Cuckoo Signatures, and much more to your likings
by exploring the /home/icedxu/.cuckoo directory.
Among other configurable items of most interest is the
new location for your Cuckoo configuration:
/home/icedxu/.cuckoo/conf
=======================================================================
Cuckoo has finished setting up the default configuration.
Please modify the default settings where required and
start Cuckoo again (by running `cuckoo` or `cuckoo -d`).
可能用到的
/etc/init.d
service apache2 start
service mongodb start
find / | grep agent.py
/home/icedxu/cuckoo/.cuckoo/agent/
查看使用端口的进程
lsof -i:8888
kill -9 PID
简单操作：
cuckoo submit -- /path #将文件加入沙箱
cuckoo submit --enforce-timeout 420 /path #强制执行多长时间
cuckoo submit --timeout 120 #将刚刚加入的文件按顺序执行，一个文件执行120秒
cuckoo #开始执行 ,最好不要用sudo cuckoo去启动，有可能找不到虚拟机
cuckoo -d #debug模式运行
cuckoo web # web
cuckoo --helpps:先手动开一下虚拟机，待cuckoo sandbox识别虚拟机IP后，再运行服务器端的python脚本（socket），之后运行cuckoo