[{"_1":2,"_167":-5,"_168":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_142":143},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_135":-5,"_136":11,"_137":17,"_138":11,"_139":-5,"_140":141},"canonicalUrl","https://hub.docker.com/r/diegobt/cuckoosandbox/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","diegobt","reponame","cuckoosandbox","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2016-11-18T15:44:11.239787Z","description","Works with ESXi","is_private","last_updated","2017-04-06T20:06:05.408594Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",828,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","-- cuckoodocker --\r\n\r\n* Description *\r\nThis Docker recipe will create Cuckoo Sandbox containers configured to connect to remote ESXi or VirtualBox images. For a description of the Cuckoo Sandbox go to https://cuckoosandbox.org.\r\n\r\nMachines or VMs mentioned:\r\n- The Linux host VM. This vm runs the docker cuckoo container. This VM could be in the ESXi itself or elsewhere. As long as it can connect to it ant its windows VM. For this guide the host ip will be 10.10.10.2.\r\n- The ESXi or Virtualbox host. This machine has the Windows guest VM. For this guide the ESXi (or VBox) ip will be 10.10.10.1.\r\n- The Windows guest VM. This vm runs in the ESXi (or VirtualBox) server and will be controlled by cuckoo. For this guide the guest ip will be 10.10.10.3. \r\n- The cuckoo container. This container runs in the Linux host vm. We dont care about this ip, as the ports will be forwarded from the Linux host VM.\r\n\r\n* Prerequisites *\r\n- An ESXi or VirtualBox Server\r\n- A windows VM for the guest. \r\n- A Linux VM for the docker/cuckoo host. \r\n- Install docker: https://docs.docker.com/engine/installation/linux/ubuntu/ on the Linux VM.\r\n- IMPORTANT: Routing between the host and the guest needs to work. i.e: \r\n\t- The linux VM needs to ping the guest machine and the guest machine needs to ping the linux VM.\r\n\t- The linux VM needs to be able to access the ESXi API, OR in the case of VirtualBox, The linux VM needs to be able to ssh the VirtualBox server.\r\n\r\n\r\n* Prepare the windows VM *\r\n- Follow the instructions from here: https://downloads.cuckoosandbox.org/docs/installation/guest/index.html\r\n- Namely you need to:\r\n\t- Create a Windows VM. (I tried it with Win 7 64, 1Gb RAM, 10Gb HDD). \r\n\t- Install Python 2.7\r\n\t- Configure the VM networking to bridged and promiscuous.\r\n\t- In windows set the ip to static (10.10.10.3 in our example)\r\n\t- Disable the firewall.\r\n\t- Copy scripts/agent.pyw to the Startup directory in the Start Menu (All users).\r\n\t- Reboot the VM.\r\n\t- Check the taskmanager to confirm that python is running agent.pyw. \r\n\t- Also confirm that you can ping the docker host and that the docker host can ping this VM.\r\n\t- Save the snapshot, in our case to Snapshot1\r\n\r\n\r\n* Installation *\r\n0 Assuming you have the linux VM. (I tried it with ubuntu 16, 4Gb RAM, 20Gb HDD). \r\n1 Copy or clone this directory to the Linux VM\r\n\r\n(Option 1) * ESXi Configuration *\r\n2 Edit conf/cuckoo.conf\r\n\t- Make sure machinery is set to esx like so: \"machinery = esx\"\r\n\t- Make sure resultserver_ip = 0.0.0.0, we will set this in conf/esx.conf\r\n\r\n3 Edit conf/esx.conf: \r\n- This config file is where all analysis Virtual Machines that cuckoo uses are specified. The main section is where we setup our connection these are the details for the ESXi host NOT the cuckoo controller.\r\n\r\n\tdsn = esx://10.10.10.1/?no_verify=1 <- The ESXi host ip\r\n\tusername = username_goes_here <- The ESXi user \r\n\tpassword = password_goes_here <- The ESXi pass\r\n\r\n\tmachines = vm_name\r\n\r\n\t[vm_name]\r\n\tlabel = Win7 <- The windows VM name\r\n\tplatform = windows\r\n\tsnapshot = SnapShotName\r\n\tip = 10.10.10.3 <- The windows VM name\r\n\r\n\tresultserver_ip = 10.10.10.2 <- The linux host ip\r\n\tresultserver_port = 2042 <- this port will be forwarded to cuckoo by docker\r\n\r\n\r\n(Option 2) * VirtualBox Configuration *\r\n2 Edit conf/cuckoo.conf\r\nMake sure machinery is set to virtualbox like so: \"machinery = virtualbox\"\r\n\r\n3a Edit conf/virtualbox.conf: \r\n- This config file is where all analysis Virtual Machines that cuckoo uses are specified. \r\n\r\n\tmachines = vm_name\r\n\r\n\t[vm_name]\r\n\tlabel = Win7\r\n\tplatform = windows\r\n\tsnapshot = SnapShotName\r\n\tip = 10.10.10.3 \r\n\r\n\tresultserver_ip = 10.10.10.2 <- The linux host ip\r\n\tresultserver_port = 2042 <- this port will be forwarded to cuckoo by docker\r\n\r\n3b Edit scripts/VBoxManage with the VirtualBox server SSH details. What this script does is it executes VBoxManage remotely in the VirtualBox host, (from the cuckoo container).\r\n\tuser = \"vbox_host_user\"\r\n\tpasswd = \"vbox_host_pass\"\r\n\thost = \"vbox_host_ip\"\r\n\r\nTo test this step do \"VBoxManage list vms\" from bash. \r\nIf it lists the VMs its working if not check that you can ssh to the VBox server and that VBoxManagePath is correct in scripts/VBoxManage. \r\n\r\n\r\n* Creating the Cuckoo Docker Image *\r\n4 On the linux host VM start the Docker service (/etc/init.d/docker start)\r\n5 Run \"make build\", this will download and build the images. It will take several minutes.\r\n\r\n\r\n* Using Cuckoo - with the web console *\r\n\r\n6a Type \"make run\", this will start the containers. NOTE: This command will first run make clean to stop all previously running containers. \r\nOnce make run finishes it should print something like this:\r\n\r\n\t+++ Running containers +++\r\n\tCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\r\n\t27176d290ada cuckoo:latest \"/home/cuckoo/cuck...\" 1 second ago Up Less than a second 0.0.0.0:8080->8080/tcp web\r\n\t6caacff5cc1f cuckoo:latest \"/home/cuckoo/cuck...\" 2 seconds ago Up Less than a second 0.0.0.0:1337->1337/tcp, 0.0.0.0:2042->2042/tcp daemon\r\n\t05e91f0f4f61 mongo \"docker-entrypoint...\" 2 seconds ago Up 1 second 0.0.0.0:27017->27017/tcp mongo\r\n\r\nIf one is missing something went wrong :)\r\n6b To check if something went wrong do: \r\n\"make logs daemon\" or \"make logs web\" or \"make logs mono\". It works like tailf. For the daemon you should see something like this:\r\n\t .----..--.--..----.| |--..-----..-----.\r\n\t | __|| | || __|| < | _ || _ |\r\n\t |____||_____||____||__|__||_____||_____|\r\n\r\n\t Cuckoo Sandbox 2.0-rc2\r\n\t www.cuckoosandbox.org\r\n\t Copyright (c) 2010-2015\r\n\r\n\t2017-04-06 11:06:30,264 [lib.cuckoo.core.scheduler] INFO: Using \"esx\" as machine manager\r\n\t2017-04-06 11:06:31,014 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s\r\n\t2017-04-06 11:06:31,025 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks. \r\n\r\nIF you dont see the \"Loaded 1 machines\" it did not find the VM and you have to check the esx.conf (or virtualbox.conf and the ssh details) in the configuration section above.\r\n\r\n7 Assuming all went well in the previous steps you should have the web interface running in http://10.10.10.2:8080\r\n8 To submit a file go to the Submit tab and select a file to upload. You can use example/pafish.exe to test.\r\n9 Once uploaded you should see this on \"make logs daemon\":\r\n\t2017-04-06 11:06:45,237 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE \"pafish.exe\" (task #5, options \"route=none,procmemdump=yes\")\r\n\t2017-04-06 11:06:45,287 [lib.cuckoo.core.scheduler] INFO: Task #5: acquired machine windows7 (label=windows7)\r\n\t2017-04-06 11:06:49,773 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=windows7, ip=10.10.10.3)\r\n10 You should see a VM start in your ESXi (VBox) host. You should see the Windows VM executing the file you uploaded. In the pafish.exe case you should see a CMD consolde. If you dont, them cuckoo cannot connect to the VM, try to ping it and check the .conf settings and routing/firewalls.\r\n11 After 1-2 minutes the test should finish. And you should see this:\r\n\t2017-04-06 11:08:58,880 [lib.cuckoo.core.guest] INFO: windows7: analysis completed successfully\r\n\t2017-04-06 11:09:01,269 [lib.cuckoo.common.objects] WARNING: Unable to import yara (please compile from sources)\r\n\t2017-04-06 11:09:03,530 [lib.cuckoo.core.scheduler] INFO: Task #5: reports generation completed (path=/home/cuckoo/cuckoo/storage/analyses/5)\r\n\t2017-04-06 11:09:03,563 [lib.cuckoo.core.scheduler] INFO: Task #5: analysis procedure completed\r\n12 This means that all went well and that the windows guest could connect back to cuckoo (via 10.10.10.2:2042, then forwarded to the cuckoo container) if this is not the case try to ping/telnet and check the .conf settings and routing/firewalls.\r\n13 If all went well you can see the analysis results in the web interface.\r\n\r\nFor more information on how to use the web interface see here: https://blog.malwarebytes.com/threat-analysis/2014/04/automating-malware-analysis-with-cuckoo-sandbox/\r\n\r\n\r\n* Using Cuckoo from command line *\r\n\r\n6 Instead of doing \"make run\" here we do \"make dev\". To stop previous containers you can do make clean -or just do make dev, which will first cleanup for you. make dev should open a root console in the cuckoo container. Here you will not have a web interface (no web container), just the console.\r\n7 To start cuckoo do \"./cuckoo.py &\", you should see something like this:\r\n\t .----..--.--..----.| |--..-----..-----.\r\n\t | __|| | || __|| < | _ || _ |\r\n\t |____||_____||____||__|__||_____||_____|\r\n\r\n\t Cuckoo Sandbox 2.0-rc2\r\n\t www.cuckoosandbox.org\r\n\t Copyright (c) 2010-2015\r\n\r\n\t2017-04-06 11:06:30,264 [lib.cuckoo.core.scheduler] INFO: Using \"esx\" as machine manager\r\n\t2017-04-06 11:06:31,014 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s\r\n\t2017-04-06 11:06:31,025 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks. \r\n\r\nIF you dont see the \"Loaded 1 machines\" it did not find the VM and you have to check the esx.conf (or virtualbox.conf and the ssh details) in the configuration section above.\r\n\r\n8 To submit a file do \"utils/submit.py --package exe pafish.exe\", you should see this on \"make logs daemon\":\r\n\t2017-04-06 11:06:45,237 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE \"pafish.exe\" (task #5, options \"route=none,procmemdump=yes\")\r\n\t2017-04-06 11:06:45,287 [lib.cuckoo.core.scheduler] INFO: Task #5: acquired machine windows7 (label=windows7)\r\n\t2017-04-06 11:06:49,773 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=windows7, ip=10.10.10.3)\r\n9 You should see a VM start in your ESXi (VBox) host. You should see the Windows VM executing the file you uploaded. In the pafish.exe case you should see a CMD consolde. If you dont, them cuckoo cannot connect to the VM, try to ping it and check the .conf settings and routing/firewalls.\r\n10 After 1-2 minutes the test should finish. And you should see this:\r\n\t2017-04-06 11:08:58,880 [lib.cuckoo.core.guest] INFO: windows7: analysis completed successfully\r\n\t2017-04-06 11:09:01,269 [lib.cuckoo.common.objects] WARNING: Unable to import yara (please compile from sources)\r\n\t2017-04-06 11:09:03,530 [lib.cuckoo.core.scheduler] INFO: Task #5: reports generation completed (path=/home/cuckoo/cuckoo/storage/analyses/5)\r\n\t2017-04-06 11:09:03,563 [lib.cuckoo.core.scheduler] INFO: Task #5: analysis procedure completed\r\n11 This means that all went well and that the windows guest could connect back to cuckoo (via 10.10.10.2:2042, then forwarded to the cuckoo container) if this is not the case try to ping/telnet and check the .conf settings and routing/firewalls.\r\n12 If all went well you can see the analysis results storage/analyses/latest/ (check cuckoo.log and analysis.log)\r\n13 To stop the container just type exit.\r\n\r\nFor more information on how to use the command line interface see here: https://downloads.cuckoosandbox.org/docs/usage/start.html\r\n\r\n\r\n* Other options/commands *\r\n- make build-clean: deletes ALL docker images and rebuilds the cuckoo image\r\n- make clean-volumes: deletes ALL docker volumes\r\n- make clean-images: deletes ALL docker images\r\n\r\n\r\n* References *\r\n(1) https://downloads.cuckoosandbox.org/docs/index.html\r\n(2) https://techanarchy.net/lab/cuckoo-esxi/\r\n(3) https://blog.malwarebytes.com/threat-analysis/2014/04/automating-malware-analysis-with-cuckoo-sandbox/\r\n(4) https://docs.docker.com/engine/getstarted/\r\n(5) https://www.proteansec.com/linux/installing-using-cuckoo-malware-analysis-sandbox/\r\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",8483935038,"orgData","recentTags",[87,125],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},"content_type","creator",1239554,"full_size",554751198,"id",6283171,"images",[97],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":61,"_113":-5},"architecture","amd64","digest","sha256:fa4327db4b89ce49a8b97846636f181d14e13036045a4762af65aca45d6810ec","features","","last_pulled","2026-09-12T04:28:18.993701394Z","last_pushed","2017-04-06T20:06:05Z","os","linux","os_features","os_version","size","variant","2017-04-06T20:06:04.808815Z","last_updater","last_updater_username","media_type","latest","repository",1056818,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_88":40,"_89":90,"_91":126,"_93":127,"_95":128,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":61,"_124":17},606977331,6344681,[129],{"_98":99,"_100":130,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":126,"_59":61,"_113":-5},"sha256:9ea59c21e18cb0c3088e595778c16534d414f1cd3886211531a402455a0007fb","2026-09-17T22:31:43.685363534Z","2016-11-24T16:00:09Z","2016-11-24T16:00:08.836737Z","virtualbox","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":144,"_151":152,"_140":165,"_166":11},{"_36":145,"_38":146,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":147,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":148,"_75":17,"_76":150,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":149},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_153":154,"_155":-5,"_156":-5,"_157":158},"count",2,"next","previous","results",[159,162],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":160,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},[161],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":61,"_113":-5},{"_88":40,"_89":90,"_91":126,"_93":127,"_95":163,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":61,"_124":17},[164],{"_98":99,"_100":130,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":126,"_59":61,"_113":-5},[],"canDeleteTags","actionData","errors"]

diegobt/cuckoosandbox

Tags for diegobt/cuckoosandbox