root@cuckoo:~# adduser cuckoo root@cuckoo:~# usermod -a -G vboxusers cuckoo root@cuckoo:~# usermod -a -G sudo cuckoo root@cuckoo:~# su cuckoo

cuckoo@cuckoo:~$ sudo apt-get remove apt-listchanges cuckoo@cuckoo:~$ sudo apt-get update && sudo apt-get upgrade -y && sudo apt-get dist-upgrade -y && sudo apt-get autoremove -y

cuckoo@cuckoo:~$ sudo apt-get install apache2-utils apt-listchanges automake bison clamav clamav-daemon clamav-freshclam curl exiftool fail2ban flex gcc geoip-database git libboost-all-dev libffi-dev libfuzzy-dev libgeoip-dev libjpeg-dev libmagic1 libpq-dev libssl-dev libtool libvirt-dev libxml2-dev libxslt-dev libxslt1-dev make mongodb mono-utils nginx openjdk-8-jre-headless p7zip-full postgresql postgresql-contrib privoxy python python-bottle python-bson python-chardet python-dev python-dpkt python-jinja2 python-libvirt python-m2crypto python-magic python-pefile python-pil python-pip python-pymongo python-sqlalchemy python-yara ssdeep suricata swig tcpdump tesseract-ocr tor unattended-upgrades unzip upx-ucl virtualbox wget wkhtmltopdf xfonts-100dpi xvfb yara -y cuckoo@cuckoo:~$ sudo pip install MAEC cybox distorm3 django gunicorn openpyxl psycopg2 pycrypto cuckoo@cuckoo:~$ sudo pip install git+https://github.com/kbandla/pydeep.git cuckoo@cuckoo:~$ sudo pip install git+https://github.com/volatilityfoundation/volatility.git cuckoo@cuckoo:~$ sudo chmod +s /usr/sbin/tcpdump cuckoo@cuckoo:~$ wget https://github.com/VirusTotal/yara/archive/v3.5.0.tar.gz cuckoo@cuckoo:~$ tar -zxvf v3.5.0.tar.gz cuckoo@cuckoo:~$ cd yara-3.5.0/ cuckoo@cuckoo:~/yara-3.5.0$ ./bootstrap.sh cuckoo@cuckoo:~/yara-3.5.0$ ./configure --enable-cuckoo --enable-magic cuckoo@cuckoo:~/yara-3.5.0$ make cuckoo@cuckoo:~/yara-3.5.0$ sudo make install cuckoo@cuckoo:~$ cd ~ cuckoo@cuckoo:~$ git clone https://github.com/seanthegeek/routetor.git cuckoo@cuckoo:~$ cd routetor cuckoo@cuckoo:~/routetor$ $ sudo cp *tor* /usr/sbin cuckoo@cuckoo:~$ cd ~

cuckoo@cuckoo:~$ sudo su postgres postgres@cuckoo:/home/cuckoo$ psql CREATE USER cuckoo WITH PASSWORD 'cuckoo'; CREATE DATABASE cuckoo; GRANT ALL PRIVILEGES ON DATABASE cuckoo to cukoo; \q postgres@cuckoo:/home/cuckoo$ exit

cuckoo@cuckoo:~$ git clone https://github.com/spender-sandbox/cuckoo-modified.git cuckoo@cuckoo:~$ sudo pip install -r ./cuckoo-modified/requirements.txt cuckoo@cuckoo:~$ ./cuckoo-modified/utils/community.py -wafb monitor cuckoo@cuckoo:~$ ./cuckoo-modified/utils/community.py -waf cuckoo@cuckoo:~$ mv cuckoo-modified/ cuckoo/

cuckoo@cuckoo:~$ mkdir ~/ssl cuckoo@cuckoo:~/ssl$ cd ~/ssl cuckoo@cuckoo:~/ssl$ openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout cuckoo.key -out cuckoo.crt cuckoo@cuckoo:~/ssl$ openssl req -newkey rsa:4096-nodes -keyout cuckoo.key -out cuckoo.csr cuckoo@cuckoo:~/ssl$ rm cuckoo.csr cuckoo@cuckoo:~/ssl$ openssl dhparam -out dhparam.pem 4096 cuckoo@cuckoo:~$ cd ~ cuckoo@cuckoo:~$ sudo mv ssl/ /etc/nginx cuckoo@cuckoo:~$ sudo chown -R root:www-data /etc/nginx/ssl cuckoo@cuckoo:~$ sudo chmod -R 550 /etc/nginx/ssl cuckoo@cuckoo:~$ sudo rm /etc/nginx/sites-enabled/default cuckoo@cuckoo:~$ sudo vim /etc/nginx/sites-available/cuckoo server { listen 192.168.60.200:443 ssl http2; ssl_certificate /etc/nginx/ssl/cuckoo.crt; ssl_certificate_key /etc/nginx/ssl/cuckoo.key; ssl_dhparam /etc/nginx/ssl/dhparam.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_cache shared:SSL:10m; ssl_session_tickets off; # Requires nginx >= 1.5.9 # Uncomment this next line if you are using a signed, trusted cert #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; root /usr/share/nginx/html; index index.html index.htm; client_max_body_size 101M; auth_basic "Login required"; auth_basic_user_file /etc/nginx/htpasswd; location / { proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /storage/analysis { alias /home/cuckoo/cuckoo/storage/analyses/; autoindex on; autoindex_exact_size off; autoindex_localtime on; } location /static { alias /home/cuckoo/cuckoo/web/static/; } } server { listen 192.168.60.200:80 http2; return 301 https://$server_name$request_uri; } cuckoo@cuckoo:~$ sudo ln -s /etc/nginx/sites-enabled/cuckoo /etc/nginx/sites-available/cuckoo cuckoo@cuckoo:~$ sudo htpasswd -c /etc/nginx/htpasswd cuckoo cuckoo@cuckoo:~$ sudo chown root:www-data /etc/nginx/htpasswd cuckoo@cuckoo:~$ sudo chmod 540 /etc/nginx/htpasswd

cuckoo@cuckoo:~$ VM='Win7ProSP1-86' cuckoo@cuckoo:~$ VBoxManage createhd --filename $VM.vdi --size 16384 cuckoo@cuckoo:~$ VBoxManage createvm --name $VM --ostype 'Windows7' --register cuckoo@cuckoo:~$ VBoxManage storagectl $VM --name "SATA Controller" --add sata --controller IntelAHCI cuckoo@cuckoo:~$ VBoxManage storageattach $VM --storagectl "SATA Controller" --port 0 --device 0 --type hdd --medium $VM.vdi cuckoo@cuckoo:~$ VBoxManage storagectl $VM --name "IDE Controller" --add ide cuckoo@cuckoo:~$ VBoxManage storageattach $VM --storagectl "IDE Controller" --port 0 --device 0 --type dvddrive --medium en_windows_7_professional_with_sp1_x86_dvd_u_677056.iso cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --ioapic on cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --boot1 dvd --boot2 disk --boot3 none --boot4 none cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --memory 1024 --vram 128 cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --nic1 hostonly cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --vrde on cuckoo@cuckoo:~$ VBoxManage modifyvm $VM --vrdeport 5555 cuckoo@cuckoo:~$ VBoxHeadless -s $VM cuckoo@cuckoo:~$ VBoxManage storageattach $VM --storagectl "IDE Controller" --port 0 --device 0 --type dvddrive --medium none cuckoo@cuckoo:~$ VBoxManage controlvm $VM poweroff

cuckoo@cuckoo:~$ VBoxManage storageattach $VM --storagectl "IDE Controller" --port 0 --device 0 --type dvddrive --medium en_office_ultimate_2007_united_states_x86_dvd_480625.iso cuckoo@cuckoo:~$ VBoxHeadless -s $VM cuckoo@cuckoo:~$ VBoxManage storageattach $VM --storagectl "IDE Controller" --port 0 --device 0 --type dvddrive --medium none cuckoo@cuckoo:~$ VBoxManage snapshot $VM take GOLD --pause cuckoo@cuckoo:~$ VBoxManage controlvm $VM poweroff cuckoo@cuckoo:~$ VBoxManage snapshot $VM restorecurrent

[sniffer] enabled = yes interface = vboxnet0 [tor] enables = yes [msoffice]

[cuckoo] machinery = virtualbox [resultserver] ip = 192.168.56.1 port = 2042 [database] connection = postgresql://cuckoo:cuckoo@localhost:5432/cuckoo

#!/bin/bash /sbin/iptables -F /sbin/iptables -t nat -F /usr/bin/vboxmanage hostonlyif create /usr/bin/vboxmanage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1 CUCKOO_USER="cuckoo" CUCKOO_PATH="/home/cuckoo/cuckoo" VIRBR_IP="192.168.56.1" INETSIM_DNS_PORT="5342" VIRBR_DEV="vboxnet0" su $CUCKOO_USER -c "pkill gunicorn" >/dev/null 2>&1 su $CUCKOO_USER -c "pkill python" > /dev/null 2>&1 /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null while [ $? -ne 0 ] do sleep 5 /usr/sbin/service nginx restart /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null done /usr/sbin/service tor restart cd $CUCKOO_PATH su $CUCKOO_USER -c "./cuckoo.py &" cd web su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8000 web.wsgi" cd ../utils su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8001 api"

forward-socks5t / 127.0.0.1:9050 .

TransListenAddress 192.168.56.1 TransPort 9040 DNSListenAddress 192.168.56.1 DnsPort 5353

42 * * * * /usr/sbin/etupdate @reboot /usr/sbin/cuckooboot > /dev/null 2>&1 @reboot /usr/sbin/routetor

/sbin/iptables -t nat -I PREROUTING -i vboxnet0 -p tcp --dport 80 -j REDIRECT --to-port 8080 /sbin/iptables -t nat -I PREROUTING -i vboxnet0 -p tcp --dport 443 -j REDIRECT --to-port 8080

cuckoo@cuckoo:~$ VBoxManage clonevm 07dcf444-c692-463b-b2c5-072abdc6351d --mode all --name Win7ProSP1-86_SIM --register

cuckoo@cuckoo:~$ VBoxManage snapshot Win7ProSP1-86_SIM delete GOLD cuckoo@cuckoo:~$ VBoxManage snapshot Win7ProSP1-86_SIM take GOLD --pause

machines = Win7ProSP1-86,Win7ProSP1-86_SIM [Win7ProSP1-86_SIM] label = Win7ProSP1-86_SIM platform = windows ip = 192.168.56.245 snapshot = GOLD interface = vboxnet1 resultserver_ip = 192.168.56.1 resultserver_port = 2042 tags = windows_7_sp1,32_bit,INETSIM mem_profile = Win7SP1x86

/usr/bin/vboxmanage hostonlyif ipconfig vboxnet1 --ip 192.168.56.5