13 Security Lab

[Error] Install Cuckoo Sandbox & troubleshoot 본문

Computer Security/Security Articles

[Error] Install Cuckoo Sandbox & troubleshoot

Maj0r Tom 2018. 10. 9. 22:45



pip install cuckoo


then, I got this.


Error Message:

(ValueError: jpeg is required unless explicitly disabled using --disable-jpeg, aborting)



[Capture of Error message]




I happened from missed installation things also relatated "pillow".


I googled it and some StackOverflow pages commented about it as solution of "pillow" problem.

Link:

https://stackoverflow.com/questions/34631806/fail-during-installation-of-pillow-python-module-in-linux


It was right but, another also exist. then, directly I suggest what you missed for the full installation of cuckoo sandbox


1
2
3
$ sudo apt-get install python python-pip python-dev libffi-dev libssl-dev
$ sudo apt-get install python-virtualenv python-setuptools
$ sudo apt-get install libjpeg-dev zlib1g-dev swig
cs


Even if you solve the "pillow" problem you may meet another one after.


like the following "Error Message"


Error Message:

(ValueError: zlib is required unless explicitly disabled using --disable-zlib, aborting)



[Capture of Error message]


you figure out then type command next.


1
pip install cuckoo
cs


done.


Plus.


mysql-python install problem


Problem:

1
2
3
4
5
root@root-PC:~$ pip install mysql-python
Collecting mysql-python
 
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-FskTss/mysql-python/
cs


Solution:


Before do command,

1
pip install MySql-python
cs


Try this,

1
sudo apt install libmysqlclient-dev
cs


After installing it, I tried again


https://stackoverflow.com/questions/43543483/pip-install-mysql-python-fails-with-indexerror/44309407#44309407



Cuckoo can not get vm status from virtualbox


problem


after launch cuckoo by command "cockoo"


It stopped after message "[cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager"

expected message the following doesn't show up

[cuckoo.core.scheduler] INFO: Loaded 1 machine/s

[cuckoo.core.scheduler] INFO: Waiting for analysis tasks.

Solution


check virtualbox.conf configuration. 

"path= "

It must be

"/usr/bin/VBoxManage"

or

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"


not ~\VirtualBox or something



Tcpdump

WinDump is basically tcpdump for the Windows platform and you can download it from here: https://www.winpcap.org/windump/install/default.htm.


The default file name of WinDump is windump.exe. I just renamed it to tcpdump.exe on my installation.

https://www.trustwave.com/Resources/SpiderLabs-Blog/Cuckoo--Linux-Subsystem--Some-Love-for-Windows-10/


windump rename to "tcpdump.exe" 

and check for vbox network interface the following (host)





Host: All the related firewall setting off.

Guest: All the firewall setting off.



Cuckoo sandbox debug Under Pycharm edit environment


1. make temporary python script like "main.py"

2. copy the following script

3. set breakpoint what u want to see.

4. debug it


1
2
3
4
5
6
7
8
9
10
11
12
# -*- coding: utf-8 -*-
import os
# "cuckoo executable" installed path under python installed 
os.chdir('C:\Users\[UserName]\AppData\Local\conda\conda\envs\py27\Scripts')
import re
import sys
from cuckoo.main import main
if __name__ == '__main__':
    print "sargv0",sys.argv[0]
    sys.argv[0] = re.sub(r'(-script\.pyw?|\.exe)?$', '', sys.argv[0])
    sys.exit(main(args=[]))
# the upper code is copied from "cuckoo executable"
cs


저작자표시 비영리 동일조건
공유하기 링크
'Computer Security/Security Articles' Related Articles more
Comments