Sunday, January 27, 2013

Installing Cuckoo Sandbox on VirtualBox Ubuntu Server LTS

Quoting their website Cuckoo sandbox is an Open Source automated malware analysis system. To do so it uses custom components that monitor the behavior of the malicious processes while running in an isolated environment (typically a Windows operating system).

It can retrieve the following type of results:
  • Traces of win32 API calls performed by all processes spawned by the malware.
  • Files being created, deleted and downloaded by the malware during its execution.
  • Memory dumps of the malware processes.
  • Network traffic trace in PCAP format.
  • Screenshots of Windows desktop taking during the execution of the malware.
  • Full memory dumps of the machines.
In our case I decided to use a combination of Ubuntu LTS server and VirtualBox to setup the platform where we are going to run Cuckoo. For further details on how to install these systems you can see my previous posts:
Cuckoo (version 0.5) has been developed in Python and integrated with MongoDB, Yara, SSDEEP, Tcpdump for different purposes. That is why my recommendation is to install all these packages including Cuckoo Python dependencies. Here are the necessary steps to do it:

1.- Installing Python and dependencies

 $ apt-get install python # installed by default  
 $ apt-get install python-magic # for identifying file formats  
 $ apt-get install python-dpkt # for extracting info from pcaps  
 $ apt-get install python-mako # for rendering html reports and web gui  
 $ apt-get install python-sqlalchemy  
 $ apt-get install python-jinja2 # necessary for utility  
 $ apt-get install python-bottle # necessary for utility  

2.- Installing SSDEEP for calculating fuzzy hashes

 $ apt-get install ssdeep  
 $ apt-get install python-pyrex # required for pyssdeep installation  
 $ apt-get install subversion  
 $ apt-get install libfuzzy-dev   
 $ svn checkout pyssdeep  
 $ cd pyssdeep  
 $ python build  
 $ python install # run as root user  

3.- Installing MongoDB and Python support

 $ apt-get install python-pymongo # for mongodb support  
 $ apt-get install mongodb # includes server and clients  

4.- Installing Yara and Python support

 $ apt-get install g++  
 $ apt-get install libpcre3 libpcre3-dev  
 $ wget  
 $ tar -xvzf yara-1.6.tar.gz  
 $ cd yara-1.6  
 $ ./configure  
 $ make  
 $ make check  
 $ make install # finished yara installation  
 $ wget  
 $ tar -xvzf yara-python-1.6.tar.gz  
 $ cd yara-python-1.6  
 $ python build  
 $ python install # finished python support installation  

5.- Modifying Tcpdump running privileges

This is necessary so Cuckoo can run Tcpdump as non-root user.
 $ apt-get install libcap2-bin  
 $ setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump  
 $ getcap /usr/sbin/tcpdump # to check changes have been applied  

6.- Installing Cuckoo Sandbox

 $ sudo useradd cuckoo  
 $ usermod -a -G vboxusers cuckoo # add cuckoo to vboxusers group  
 $ id cuckoo # checks cuckoo user details  
 $ apt-get install git   
 $ git clone git://   

7.- Configuring Windows Guest virtual machine

At this point we need to install Cuckoo python agent in the virtual machine that we want to use to run the malware. I am going to continue the work described in my previous post and use WindowsXPVM1 for this purpose.

First steps to prepare the Windows Guest system:
Next we copy the Python agent to our Windows shared folder:
 $ cp /home/santiago/cuckoo/cuckoo/agent/ /home/santiago/cuckoo/shares/WindowsXPVM1/  
I also renamed it to agent.pyw to prevent the command prompt from showing. We can run it manually or configure it to run at Windows startup following these steps:
  • Copy to C:\Python27\agent.pyw
  • Add it to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: Name:'Agent' Type:'REG_SZ' Data:"C:\Python27\agent.pyw"
After executing the Python script on the virtual machine a new socket should be listening on

Our virtual machine is now ready to run malware so it's time to save the system state creating a VirtualBox snapshot.
 $ vboxmanage snapshot "WindowsXPVM1" take "WindowsXPVM1Snap01" --pause  
And these are the commands we can use to restore the snapshot.
 $ vboxmanage controlvm "WindowsXPVM1" poweroff  
 $ vboxmanage snapshot "WindowsXPVM1" restorecurrent  
 $ vboxheadless --startvm "WindowsXPVM1"  

8.- Starting Cuckoo sandbox

Before starting Cuckoo for the first time, we need to configure Cuckoo VirtualBox settings to specify the virtual machine the system will use to analyze a malware sample. To do it we edit cuckoo/conf/virtualbox.conf file and set the following variables.
  # Specify which VirtualBox mode you want to run your machines on.  
  # Can be "gui", "sdl" or "headless". Refer to VirtualBox's official  
  # documentation to understand the differences.  
  mode = headless  
  # Path to the local installation of the VBoxManage utility.  
  path = /usr/bin/VBoxManage  
  # Specify a comma-separated list of available machines to be used. For each  
  # specified ID you have to define a dedicated section containing the details  
  # on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)  
  machines = WindowsXPVM1  
  # Specify the label name of the current machine as specified in your  
  # VirtualBox configuration.  
  label = WindowsXPVM1  
  # Specify the operating system platform used by current machine  
  # [windows/darwin/linux].  
  platform = windows  
  # Specify the IP address of the current machine. Make sure that the IP address  
  # is valid and that the host machine is able to reach it. If not, the analysis  
  # will fail.  
  ip =  
Finally we can start our freshly installed Cuckoo sandbox.
  root@donkey:/home/santiago/cuckoo/cuckoo# python
     _|_|_|  _|    _|    _|_|_|  _|  _|      _|_|      _|_|    
   _|        _|    _|  _|        _|_|      _|    _|  _|    _|  
   _|        _|    _|  _|        _|  _|    _|    _|  _|    _|  
     _|_|_|    _|_|_|    _|_|_|  _|    _|    _|_|      _|_|

  Cuckoo Sandbox 0.5  
  Copyright (c) 2010-2012  
  Checking for updates...  
  Good! You have the latest version available.  
 2013-01-26 23:25:33,216 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" machine manager  
 2013-01-26 23:25:33,290 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s  
 2013-01-26 23:25:33,290 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks...  

9.- Analyzing a malware sample

I decided to analyze the following malware sample: efeb717fdbb98d8043eb4c51254d9b74 You can find virustotal description here. We can use util for it.
 root@donkey:/home/santiago/cuckoo/cuckoo/utils# python /home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74  
 Success: File "/home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74" added as task with ID 4  
And these are Cuckoo logs while performing the malware analysis.
 2013-01-26 23:34:00,275 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE "/home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74" (task=4)  
 2013-01-26 23:34:00,286 [lib.cuckoo.core.scheduler] INFO: File already exists at "/home/santiago/cuckoo/cuckoo/storage/binaries/8dafb21e7d106a6c98f745f30c2577ee7b0984ec7ba2c4107f7ddcd0d127baf6"  
 2013-01-26 23:34:00,304 [lib.cuckoo.core.scheduler] INFO: Task #4: acquired machine WindowsXPVM1 (label=WindowsXPVM1)  
 2013-01-26 23:34:00,312 [lib.cuckoo.core.sniffer] INFO: Started sniffer (interface=vboxnet0, host=, dump path=/home/santiago/cuckoo/cuckoo/storage/analyses/4/dump.pcap)  
 2013-01-26 23:34:02,063 [lib.cuckoo.core.scheduler] INFO: Task #4: analysis procedure completed  
Then we can Cuckoo tool to view the output of the analysis.
 root@donkey:/home/santiago/cuckoo/cuckoo/utils# python   
 Bottle server starting up (using WSGIRefServer())...  
 Listening on  
 Hit Ctrl-C to quit.  
And at this point we can connect to our host through the web and see our analysis report.


Saturday, January 26, 2013

Setting up a Windows Guest on VirtualBox

I recently installed VirtualBox on Ubuntu LTS as described in my previous post. Now I am going to install a Windows XP Guest on it, so it can later be used as a platform to run malware for automatic analysis with Cuckoo sandbox.

In this case, instead of using Phpvirtualbox web interface, I will choose to use the command line so it will be easier in the future to automate the virtual machine creation process by using a bash script.

These are the specs I am going to use for the Windows XP:
  • 1GB RAM memory
  • 20GB of Hard Disk space
  • VDI format for the virtual disk
  • Dynamically allocated storage

1.- Creating the virtual machine

The command vboxmanage can be used to create the virtual machine, using settings above, and to attach a DVD drive with the ISO image of the Windows XP. In my case I decided to name it WindowsXPVM1.
 $ vboxmanage createvm --name "WindowsXPVM1" --ostype WindowsXP --register  
 $ vboxmanage modifyvm "WindowsXPVM1" --memory 1000 --acpi on --boot1 dvd --nic1 nat  
 $ vboxmanage createhd --filename "WinXP.vdi" --size 20000  
 $ vboxmanage storagectl "WindowsXPVM1" --name "IDE Controller" --add ide --controller PIIX4  
 $ vboxmanage storageattach "WindowsXPVM1" --storagectl "IDE Controller" --port 0 --device 0 --type hdd --medium "WinXP.vdi"  
 $ vboxmanage storageattach "WindowsXPVM1" --storagectl "IDE Controller" --port 0 --device 1 --type dvddrive --medium /pathtoyouriso/windowsxp.iso  
At this point we can start the virtual machine to start the Windows installation procedure.
 $ VBoxHeadless --startvm "WindowsXPVM1"  
In order to connect to the system we can both use Phpvirtualbox console or directly connect through Remote Desktop Protocol (RDP) to the host.

2.- Installing guest additions in our virtual machine

 $ wget  
Once downloaded we need to mount the ISO file at the Windows XP and follow the installation wizard.

3.- Adding a shared folder and recording the network traffic

 $ vboxmanage controlvm "WindowsXPVM1" poweroff  
 $ mkdir -p /home/santiago/cuckoo/shares/WindowsXPVM1  
 $ vboxmanage sharedfolder add "WindowsXPVM1" --name "WindowsXPVM1" --hostpath /home/santiago/cuckoo/shares/WindowsXPVM1 --automount  
 $ vboxmanage sharedfolder add "WindowsXPVM1" --name setup --hostpath /home/santiago/cuckoo/shares/setup --automount --readonly  
 $ vboxmanage modifyvm "WindowsXPVM1" --nictrace1 on --nictracefile1 /home/santiago/cuckoo/shares/WindowsXPVM1/dump.pcap  
 $ vboxheadless --startvm "WindowsXPVM1"  

4.- Configuring virtual machine to use a host-only adapter

 $ lsmod | grep vboxnetadp # module needed to add a new host-only interface at the host  
 $ vboxmanage list hostonlyifs # checks host-only interfaces at the host  
 $ vboxmanage hostonlyif create # leaving default IP  
 $ vboxmanage list dhcpservers # checks dhcp servers  
 $ vboxmanage list vms # checks virtual machines  
 $ vboxmanage showvminfo "WindowsXPVM1" # checks NICs information  
 $ vboxmanage controlvm "WindowsXPVM1" poweroff   
 $ vboxmanage modifyvm "WindowsXPVM1" --nic1 hostonly  
 $ vboxmanage modifyvm "WindowsXPVM1" --hostonlyadapter1 vboxnet0  
 $ vboxheadless --startvm WindowsXPVM1  
The gateway ( and DNS Server (in this case I will use Google's need to be configured manually at the Guest using Windows settings.

5.- Configuring the Host IP forwarding and firewall filters

 $ iptables -A FORWARD -o eth0 -i vboxnet0 -s -m conntrack --ctstate NEW -j ACCEPT  
 $ iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  
 $ iptables -A POSTROUTING -t nat -j MASQUERADE  
 $ sysctl -w net.ipv4.ip_forward=1  
We can add these commands to our /etc/rc.local file if we want those to be executed every time the server wakes up or restarts.

6.- Starting and stopping the virtual machine

To start VirtualBox web service and the virtual machine we need to run the following commands:
 $ vboxwebsrv -b  
 $ vboxmanage list vms # Optional to list virtual machines  
 $ vboxheadless --startvm "WindowsXPVM1"  
And this is how we can stop it:
 $ vboxmanage controlvm "WindowsXPVM1" poweroff  
And we are done. We should now be able to use our fresh installation of our virtual Windows XP.


Installing VirtualBox on Ubuntu Server LTS

I decided to install VirtualBox on Ubuntu server so I can use it later with Cuckoo Sandbox for malware analysis.

The steps followed for this installation are:
  • Download and installation of Ubuntu Server LTS (current version 12.04.1)
  • VirtualBox and dependencies installation (current stable version 4.1.12)
  • Phpvirtualbox installation for headless servers (version 4.1-11)
  • VirtualBox extension pack installation for VRDP support
  • Starting VirtualBox and connecting to Phpvirtualbox web user interface

1.- Download and installation of Ubuntu Server LTS

I decided to use Ubuntu Server LTS as it is stable and does not require the installation of a Desktop environment, which I won't use for my purposes. The server used has a 64 bits CPU, 12GB RAM, and 514GB of hard disk space, what is more than enough to run several virtual machines in parallel.

A fresh Ubuntu Server image can be downloaded from:

Then you can choose to run the ISO from a USB stick or CD-ROM drive. My recommendation is to install only the base system, so we keep the server clean from packages that we won't use. The only extra package I installed was the SSH server so I can access it remotely.

Once finished the installation processes lets also upgrade the Debian packages to the latest version by
running these commands:
 $ apt-get update  
 $ apt-get dist-upgrade  
As well I setup the hostname and network settings at /etc/hostname and /etc/network/interfaces.

2.- VirtualBox and dependencies installation

Installing Virtualbox with apt-get:
 $ apt-get install virtualbox  
Checking installed packages:
 $ dpkg -l | grep -i virtualbox  
 ii virtualbox             4.1.12-dfsg-2ubuntu0.2    x86 virtualization solution - base binaries  
 ii virtualbox-dkms          4.1.12-dfsg-2ubuntu0.2    x86 virtualization solution - kernel module sources for dkms  
 ii virtualbox-qt           4.1.12-dfsg-2ubuntu0.2    x86 virtualization solution - Qt based user interface  

3.- Installing Phpvirtualbox

First we need to install apache2 and php:
 $ apt-get install apache2  
 $ apt-get install php5  
Then we can install Phpvirtualbox, setting the permissions of the directory to your own username (mine is santiago):
 $ cd /var/www/  
 $ wget  
 $ unzip  
 $ chown -R santiago:santiago /var/www/phpvirtualbox/  
 $ cp /var/www/phpvirtualbox/config.php-example /var/www/phpvirtualbox/config.php  
Then edit /var/www/phpvirtualbox/config.php and set the username and password for the system user that runs VirtualBox:
 var $username = 'santiago';  
 var $password = 'yourpassword';  

4.- VirtualBox extension pack installation for VRDP support

Installing the extension pack will allow us to control the virtual machines desktop remotely.
 vboxmanage extpack install Oracle_VM_VirtualBox_Extension_Pack-4.1.12.vbox-extpack  

5.- Starting VirtualBox and connecting to Phpvirtualbox user interface

The following command is used to start VirtualBox web services
 $ vboxwebsrv -b  
Then we can connect to the user interface from our browser at http://yourserverip/phpvirtualbox
user: admin
password: admin

We should be know able to use our fresh installation of VirtualBox.