system

sudo sh -c "echo 'fs.file-max=3253172' > /etc/sysctl.d/90-cuckoo.conf"

file=/etc/security/limits.conf
sudo cp -a ${file} ${file}.$(date +%s)
sudo sh -c "echo '
# cuckoo
*    soft     nofile         4096
*    hard     nofile         16384' >> ${file}"

logout / login

mongodb

service

service=mongodb.service
systemctl is-enabled ${service} || sudo systemctl enable ${service}
systemctl is-active ${service} || sudo systemctl start ${service}
systemctl status ${service}
ss -ltn|grep 27017 

users

mongo

db.createUser({ user: "admin", pwd: "7Yt_Gi-sYgCsr", roles:[{ role: "userAdminAnyDatabase", db: "admin" }] })
db.getUsers()

use cuckoo
db.createUser({ user: "cuckoo", pwd: "8hm6_FevpUA5od", roles:[{ role: "dbOwner", db: "cuckoo" }] })
db.getUsers()

show dbs
exit

conf

file=/etc/mongodb.conf
while read str val; do
sudo sed -i "s|#\?\(${str}\) *=.*$|\1 = ${val}|" ${file}
done <<< "port  27017
journal  true
auth  true
verbose  true"

sudo systemctl restart ${service}

postgresql

service=postgresql.service
systemctl is-enabled ${service} || sudo systemctl enable ${service}
systemctl is-active ${service} || sudo systemctl start ${service}
systemctl status ${service}
ss -ltn|grep 5432

sudo -u postgres psql

psql

\du
CREATE DATABASE cuckoo;
CREATE USER cuckoo WITH ENCRYPTED PASSWORD '8hm6_FevpUA5od';
GRANT ALL PRIVILEGES ON DATABASE cuckoo TO cuckoo;
\du
\q

guacd

service=guacd.service
systemctl is-enabled ${service} || sudo systemctl enable ${service}
systemctl is-active ${service} || sudo systemctl start ${service}
systemctl status ${service}
ss -ltn|grep 4822

cuckoo

create

[ -d ~/.cuckoo ] || cuckoo -d

cp -a ~/.cuckoo ~/.cuckoo.$(date +%s)

cuckoo

file=~/.cuckoo/conf/cuckoo.conf
while read str val; do
sed -i "/${str} =/ s|=.*$|= ${val}|" ${file}
done <<< "machinery  kvm
memory_dump yes
ip  192.168.122.1
connection  postgresql://cuckoo:8hm6_FevpUA5od@localhost:5432/cuckoo
guacd_host localhost
guacd_port 4822"

auxiliary

file=~/.cuckoo/conf/auxiliary.conf
while read str val; do
sed -i "/${str} =/ s|=.*$|= ${val}|" ${file}
done <<< "tcpdump  /usr/sbin/tcpdump
mitmdump  /usr/local/bin/mitmdump"

kvm

update VMs in ~/.cuckoo/conf/kvm.conf

memory

file=~/.cuckoo/conf/memory.conf
while read str val; do
sed -i "/${str} =/ s|=.*$|= ${val}|" ${file}
done <<< "guest_profile  Win7SP1x64
delete_memdump  no"

processing

file=~/.cuckoo/conf/processing.conf
sed -i "/^.memory.$/,/^$/ s|^enabled = .*$|enabled = yes|" ${file}

reporting

file=~/.cuckoo/conf/reporting.conf

# singlefile
sed -i "/^.singlefile.$/,/^$/ s|^enabled = .*$|enabled = yes|" ${file}
sed -i "/^.singlefile.$/,/^$/ s|^html = .*$|html = yes|" ${file}
sed -i "/^.singlefile.$/,/^$/ s|^pdf = .*$|pdf = yes|" ${file}

# mongodb
db_name=cuckoo
db_user=cuckoo
db_pwd=8hm6_FevpUA5od
sed -i "/^.mongodb.$/,/^$/ s|^enabled = .*$|enabled = yes|" ${file}
sed -i "/^.mongodb.$/,/^$/ s|^db = .*$|db = ${db_name}|" ${file}
sed -i "/^.mongodb.$/,/^$/ s|^username = .*$|username = ${db_user}|" ${file}
sed -i "/^.mongodb.$/,/^$/ s|^password = .*$|password = ${db_pwd}|" ${file}

interface

user=nikita
hostbr=virbr0
vms="win7 "
for vm in win7; do
  sudo tunctl -b -u ${user} -t tap_${vm}
  sudo ip link set tap_${vm} master ${hostbr}
  sudo ip link set dev tap_${vm} up
  sudo ip link set dev ${hostbr} up
done

https://cuckoo.sh/docs/installation/host/requirements.html
xubuntu 18.04 "bionic"

global

sudo apt update
sudo apt-get install -y git swig libjpeg-dev zlib1g-dev libffi-dev libssl-dev
sudo apt-get install -y  virt-win-reg libhivex-bin # registry

python

Requirement

local vs global

# pip for user installation
pip=pip

# pip for root installation
pip="sudo -H pip"

sudo apt install -y python python-pip python-dev
# sudo apt-get install -y python-virtualenv

$pip install -U pip setuptools

balbuzard

$pip install -U balbuzard

pydeep

# ssdeep
sudo apt install -y ssdeep libfuzzy-dev
sudo ldconfig

# pydeep
$pip install pydeep
# sudo apt install -y git
# cd /tmp && git clone https://github.com/kbandla/pydeep && cd pydeep
# python setup.py build && python setup.py test
# sudo python setup.py install

m2crypto

$pip install m2crypto # $pip install m2crypto==0.24.0

volatility

https://github.com/volatilityfoundation/volatility/wiki/Installation

libforensic1394.so.2

sudo apt install -y cmake

cd /tmp
git clone https://github.com/FreddieWitherden/libforensic1394
cd libforensic1394
mkdir build && cd build
cmake -G"Unix Makefiles" ../
sudo make install
cd ../python
sudo python setup.py install
cd
sudo rm -fR /tmp/libforensic1394

sudo ln -sv /usr/local/lib/libforensic1394.so.2 /usr/lib/libforensic1394.so.2

pip packages

sudo apt -y install pcregrep libpcre++-dev python-dev

$pip install pycrypto distorm3 yara-python ujson openpyxl pytz ipython

volatility

cd /opt
git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
rm -fR .git
sudo python setup.py install

cd /usr/local/bin
sudo ln -sv vol.py vol2
vol2 -h

bash completion

sudo cp -a /home/shared/dev/install-desktop/conf/cuckoo/vol2 /usr/share/bash-completion/completions/
opts=$(vol2 --info|sed -n '/^Plugins/,/^$/ p'|tail -n+3|cut -f1 -d' '|xargs)
sudo sed -i "s|^\( *opts=\).*$|\1'${opts}'|" /usr/share/bash-completion/completions/vol2

exec bash # reload completions

DB

django

sudo apt-get install -y mongodb

postgresql

sudo apt-get install -y postgresql libpq-dev

$pip install psycopg2

packages

guacd

sudo apt install -y libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd

tcpdump

sudo apt-get install -y tcpdump
# sudo apt-get install -y tcpdump apparmor-utils
# sudo aa-disable /usr/sbin/tcpdump

sudo groupadd pcap
sudo chgrp pcap /usr/sbin/tcpdump
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

# verification
getcap /usr/sbin/tcpdump # /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip

mitmproxy

https://mitmproxy.org/downloads/

version=3.0.4
path=/opt/mitmproxy
[ -d ${path} ] || mkdir ${path}
cd ${path}
wget https://snapshots.mitmproxy.org/${version}/mitmproxy-v${version}-linux.tar.gz
wget https://snapshots.mitmproxy.org/${version}/pathod-v${version}-linux.tar.gz
tar xzf mitmproxy-v${version}-linux.tar.gz
tar xzf pathod-v${version}-linux.tar.gz
files="mitmdump mitmproxy mitmweb pathoc pathod"
for file in $files; do sudo ln -sv ${path}/${file} /usr/local/bin/${file}; done
for file in $files; do sudo ls -al /usr/bin/${file}; done

qemu/kvm

sudo apt-get install -y qemu-kvm libvirt-bin ubuntu-vm-builder bridge-utils python-libvirt virt-manager libguestfs-tools uml-utilities

sudo adduser ${USER} libvirt-qemu

for path in /vms/data /vms/iso; do sudo [ -d ${path} ] || sudo mkdir ${path}; done
sudo setfacl -R -m u:$USER:rw /vms/data /vms/iso
sudo setfacl -R -m d:$USER:rw /vms/data /vms/iso

thunar

$HOME/.config/Thunar/uca.xml

<action>
        <icon>edit-copy</icon>
        <name>Duplicate root</name>
        <unique-id>1635257948652123-2</unique-id>
        <command>pkexec cp -a %f %f.copy</command>
        <description>Duplicate root</description>
        <patterns>*</patterns>
        <directories/>
        <audio-files/>
        <image-files/>
        <other-files/>
        <text-files/>
        <video-files/>
</action>
<action>
        <icon>media-import-audio-cd</icon>
        <name>iso</name>
        <unique-id>1653055089123473-10</unique-id>
        <command>mkisofs -Jro /vms/iso/tmp.iso %F</command>
        <description>make iso in vms/iso/tmp.iso</description>
        <patterns>*</patterns>
        <startup-notify/>
        <directories/>
        <audio-files/>
        <image-files/>
        <other-files/>
        <text-files/>
        <video-files/>
</action>
<action>
        <icon>go-bottom</icon>
        <name>mount data</name>
        <unique-id>1653055065395840-9</unique-id>
        <command>guestmount --add %f --mount /dev/sda1 /vms/data</command>
        <description>guest mount in /vms/data</description>
        <patterns>*.qcow2;*.img;*.raw</patterns>
        <other-files/>
</action>
<action>
        <icon>go-top</icon>
        <name>unmount data</name>
        <unique-id>1653055105839871-11</unique-id>
        <command>guestunmount /vms/data</command>
        <description>guest unmount /vms/data</description>
        <patterns>*</patterns>
        <startup-notify/>
        <directories/>
        <audio-files/>
        <image-files/>
        <other-files/>
        <text-files/>
        <video-files/>
</action>

cuckoo

direct

$pip install -U cuckoo

virtualenv

cd /opt
virtualenv venv
. venv/bin/activate
$pip install -U cuckoo