基于Centos环境Detux多平台沙箱

1.基础环境
1.1 真机环境
网卡: 两张桥接网卡(ens33、ens37)
系统: 安装桌面版Centos Desktop (GNOME桌面)
1.1.1 装包、配置、启服务:

[root@centos ~]# systemctl stop firewalld
[root@centos ~]# systemctl stop NetworkManager
[root@centos ~]# systemctl disable firewalld
[root@centos ~]# systemctl disable NetworkManager
[root@centos ~]# setenforce 0
[root@centos ~]# sed -i 's/=enforcing/=disabled/' /etc/selinux/config 
[root@centos ~]# yum install epel-release python-pip
[root@centos ~]# yum install python-pip
[root@centos ~]# pip install dpkt pexpect netaddr
[root@centos ~]# pip install paramiko python-magic
[root@centos ~]# pip install --upgrade cffi
[root@centos ~]# yum install tigervnc git uml-utilies bridge-utils tunctl
[root@centos ~]# yum install wireshark wireshark-gnome gcc wget
[root@centos ~]# yum install libvirt-daemon libvirt-client libvirt-daemon-driver-qemu
[root@centos ~]# systemctl enable libvirtd
[root@centos ~]# systemctl start libvirtd
[root@centos ~]# ln -s /usr/sbin/dumpcap /usr/bin/dumpcap

1.1.2 手动编译安装qemu包：

[root@centos ~]#yum -y remove qemu-kvm
[root@centos ~]#wget https://download.qemu.org/qemu-4.2.0.tar.xz
[root@centos ~]#yum -y install gcc gcc-c++ automake libtool zlib-devel glib2-devel bzip2-devel libuuid-devel spice-protocol spice-server-devel usbredir-devel libaio-devel
[root@centos ~]#tar xvJf qemu-4.2.0.tar.xz
[root@centos ~]#cd qemu-4.2.0
[root@centos qemu-4.2.0]#./configure
[root@centos qemu-4.2.0]#make && make install
[root@centos ~]#ln -s /usr/local/bin/qemu-system-x86_64 /usr/bin/qemu-kvm
[root@centos ~]#ln -s /usr/local/bin/qemu-system-x86_64 /usr/libexec/qemu-kvm
[root@centos ~]#ln -s /usr/local/bin/qemu-img /usr/bin/qemu-img

1.1.3 网卡配置:
[root@centos ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33

TYPE=Ethernet			
BOOTPROTO=static		
IPV6INIT=no		 	
NAME=ens33		
DEVICE=ens33			
ONBOOT=yes			
IPADDR=192.168.50.236
GATEWAY=192.168.50.1	
NETMASK=255.255.255.0	

[root@centos ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens37

OXY_METHOD=none				
BROWSER_ONLY=no					
BOOTPROTO=dhcp					
DEFROUTE=yes						
IPV4_FAILURE_FATAL=no				
IPV6INIT=yes						
IPV6_AUTOCONF=yes				
IPV6_DEFROUTE=yes				
IPV6_FAILURE_FATAL=no				
IPV6_ADDR_GEN_MODE=stable-privacy	
NAME=ens37
DEVICE=ens37						
ONBOOT=yes						
BRIDGE=br0						

[root@centos ~]# cat /etc/sysconfig/network-scripts/ifcfg-br0

TYPE="Bridge"				
DEVICE=br0				
ONBOOT=yes				
BOOTPROTO="static"		
IPADDR="192.168.50.220"		
NETMASK="255.255.255.0"	
GATEWAY="192.168.50.1"		

[root@centos ~]# systemctl restart network

1.2 VM 配置部署
1.2.1下载VM脚本:

#!/bin/bash
mkdir /vm
cd /vm
#x86
wget https://people.debian.org/~aurel32/qemu/i386/debian_wheezy_i386_standard.qcow2 -P qemu/x86/1/
#x86-64
wget https://people.debian.org/~aurel32/qemu/amd64/debian_wheezy_amd64_standard.qcow2 -P qemu/x86-64/1/
#arm
wget https://people.debian.org/~aurel32/qemu/armel/debian_wheezy_armel_standard.qcow2 -P qemu/arm/1/
wget https://people.debian.org/~aurel32/qemu/armel/initrd.img-3.2.0-4-versatile -P qemu/arm/1/
wget https://people.debian.org/~aurel32/qemu/armel/vmlinuz-3.2.0-4-versatile -P qemu/arm/1/
#mips
wget https://people.debian.org/~aurel32/qemu/mips/vmlinux-3.2.0-4-4kc-malta -P qemu/mips/1/
wget https://people.debian.org/~aurel32/qemu/mips/debian_wheezy_mips_standard.qcow2 -P qemu/mips/1/
#mipsel
wget https://people.debian.org/~aurel32/qemu/mipsel/vmlinux-3.2.0-4-4kc-malta -P qemu/mipsel/1/
wget https://people.debian.org/~aurel32/qemu/mipsel/debian_wheezy_mipsel_standard.qcow2 -P qemu/mipsel/1/

2.2.2 VM网络启动脚本:
[root@centos ~]#vim /etc/qemu-ifup

#! /bin/sh
# Script to bring a network (tap) device for qemu up.
# The idea is to add the tap device to the same bridge
# as we have default routing to.
# in order to be able to find brctl
PATH=$PATH:/sbin:/usr/sbin
ip=$(which ip)
ifconfig=$(which ifconfig)
echo "Starting"  $1
if [ -n "$ip" ]; then
   ip link set "$1" up
else
   brctl=$(which brctl)
   if [ ! "$ip" -o ! "$brctl" ]; then
     echo "W: $0: not doing any bridge processing: neither ip nor brctl utility not found" >&2
     exit 0
   fi
   ifconfig "$1" 0.0.0.0 up
fi
switch=$(ip route ls | \
    awk '/^default / {
          for(i=0;i<NF;i++) { if ($i == "dev") { print $(i+1); next; } }
         }'
        )
    if [ -d /sys/class/net/br0/bridge/. ]; then
        if [ -n "$ip" ]; then
          ip link set "$1" master br0
        else
          brctl addif br0 "$1"
        fi
        exit    # exit with status of the previous command
    fi
echo "W: $0: no bridge for guest interface found" >&2

[root@centos ~]#chmod +x /etc/qemu-ifup

1.2.3 Vm启动配置:
只列其一，其他类比
打开两个终端AB：
终端A:

x86:       
[root@terminal_A ~]# ：qemu-system-i386 -hda /vm/qemu/x86/1/debian_wheezy_i386_standard.qcow2 -net nic,macaddr=a0:36:9f:a2:32:c2 -net tap -monitor stdio
QEMU 4.2.0 monitor - type 'help' for more information
(qemu) VNC server running on ::1:5900

终端B:

[root@terminal_B ~]#vncviewer :5901
#输入后弹出窗口，进入VM配置网络
[root@x86 ~]# vim /etc/network/interfaces
auto lo					
iface lo inet loopback		
auto eth0					
iface eth0 inet static		
address 192.168.50.161   	#设置该ip与网桥同一网段，下边的内容相同。
netmask 255.255.255.0		
gateway 192.168.50.1		
[root@x86 ~]# echo '8.8.8.8' > /etc/resolv.conf 
[root@x86 ~]# /etc/init.d/networking restart

回到终端A:

(qemu) savevm init   #保存快照
(qemu) q

附：根据下表进行网卡、ip设定：

CPU架构	VM IP	MAC地址	账户密码
x86	192.168.50.161	a0:36:9f:a2:32:c2	root/root
x86-64	192.168.50.162	a0:36:9f:a2:32:c3	root/root
arm	192.168.50.163	a0:36:9f:a2:32:c4	root/root
mips	192.168.50.164	a0:36:9f:a2:32:c5	root/root
mipsel	192.168.50.165	a0:36:9f:a2:32:c6	root/root

附：VM启动命令

x86:       
qemu-system-i386 -hda /vm/qemu/x86/1/debian_wheezy_i386_standard.qcow2 -net nic,macaddr=a0:36:9f:a2:32:c2 -net tap -monitor stdio

x86-64:
qemu-system-x86_64 -hda /vm/qemu/x86-64/1/debian_wheezy_amd64_standard.qcow2 -net nic,macaddr=a0:36:9f:a2:32:c3 -net tap -monitor stdio

arm:
qemu-system-arm -M versatilepb -kernel /vm/qemu/arm/1/vmlinuz-3.2.0-4-versatile -initrd /vm/qemu/arm/1/initrd.img-3.2.0-4-versatile -hda /vm/qemu/arm/1/debian_wheezy_armel_standard.qcow2 -append "root=/dev/sda1" -net nic,macaddr=a0:36:9f:a2:32:c4 -net tap -monitor stdio

mips:
qemu-system-mips -M malta -kernel /vm/qemu/mips/1/vmlinux-3.2.0-4-4kc-malta -hda /vm/qemu/mips/1/debian_wheezy_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic,macaddr=a0:36:9f:a2:32:c5 -net tap -monitor stdio

mipsel:
qemu-system-mipsel -M malta -kernel /vm/qemu/mipsel/1/vmlinux-3.2.0-4-4kc-malta -hda /vm/qemu/mipsel/1/debian_wheezy_mipsel_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic,macaddr=a0:36:9f:a2:32:c6 -net tap -monitor stdio

2 源码修改
Packetparser.py:
1.get_network_connections函数中对srcip获取加入判断:

if isinstance(ip, dpkt.ip.IP):
    dstip = IPAddress(socket.inet_ntoa(ip.dst))
    srcip = IPAddress(socket.inet_ntoa(ip.src))
else:
continue

否则引发乱码异常
2.get_dns_requests函数中取消使用unicode编码，无需编码直接传参

if answer.type == 1: #DNS_A
    req = {'type': 'A', 'name': answer.name,'result': socket.inet_ntoa(answer.rdata)}
elif answer.type == 5:  # "CNAME request"
    req = {'type': 'CN', 'name': answer.name,'result': answer.cname}
elif answer.type == 12:
    req = {'type': 'PTR', 'name': answer.name,'result': answer.ptrname}
if req <> {} : dns_list.append(req)

否则引发乱码异常
sandbox.py:
qemu_commands函数调用命令更改

if platform == "x86":
    return "qemu-system-i386 -hda /vm/qemu/x86/%s/debian_wheezy_i386_standard.qcow2" % sandbox_id
if platform == "x86-64":
    return "qemu-system-x86_64 -hda /vm/qemu/x86-64/%s/debian_wheezy_amd64_standard.qcow2" % sandbox_id
if platform == "mips":
    return 'qemu-system-mips -M malta -kernel /vm/qemu/mips/%s/vmlinux-3.2.0-4-4kc-malta -hda /vm/qemu/mips/%s/debian_wheezy_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0"' % (sandbox_id, sandbox_id)
if platform == "mipsel":
    return 'qemu-system-mipsel -M malta -kernel /vm/qemu/mipsel/%s/vmlinux-3.2.0-4-4kc-malta -hda /vm/qemu/mipsel/%s/debian_wheezy_mipsel_standard.qcow2 -append "root=/dev/sda1 console=tty0"' % (sandbox_id, sandbox_id)
if platform == "arm":
    return 'qemu-system-arm -M versatilepb -kernel /vm/qemu/arm/%s/vmlinuz-3.2.0-4-versatile -initrd /vm/qemu/arm/%s/initrd.img-3.2.0-4-versatile -hda /vm/qemu/arm/%s/debian_wheezy_armel_standard.qcow2 -append "root=/dev/sda1"'  % (sandbox_id, sandbox_id, sandbox_id)

否则直接报错终止
test_script/example_binary1:
该脚本改用C语言编写,编译后文件重命名为example_binary1

[root@centos ~]# vim test.c
#include 
#include 
void main(){
system("wget http://baidu.com");
system("ping 8.8.8.8");
}

否则将报readelf无法读入头文件错误

---

3. 直接下载修改好的代码

git clone https://github.com/jstang007/centos_detuxsandbox.git