Submitted files aren't opened in the guest #820
Comments
|
As this looks like a problem on the Windows side, the most relevant log is the 'analysis' log which appears top right on the analysis page. If you can copy that log here we might get an idea what's going wrong. |
Many thanks for your quick response. I've checked the log folder and no analysis.log file was noticed.
Is there anything should I do to have this file in place? Once again, thank you. |
|
Are you able to see a web page for the job? If so the link is top right in the job's main page - click 'show log'. Failing that if you can check on the server, these are located in storage/analyses/X/analysis.log where X is the job number |
|
Nothing showed in the "Show Log".
|
|
I made a video on how submitting works in the back-end. Please, speed up the video, it's just for clarification. |
|
I removed Python 3.7 on the Win10 guest and installed Python 3.6 as recommended in the documentation. Windows firewall and other features about security were disabled. However, the result is still the same. Also, I can't have screenshots in the web-gui. I can see the port 8000 opened on the guest and receive the result when performing the curl request. |
Should I disable anything on Windows 10 (guest) to communicate correctly with Cuckoo, like firewall, windows defender, etc? |
|
What I would do is load the agent with visible console in the vm (rename to agent.py) then you will see on the screen some output that will help in identifying the problem. |
Perfect. Many thanks for your time trying to help me. |
|
Hi @kevoreilly , finally I got the VM communicating with Cuckoo. The issue was the
However, I'm still facing an issue to generate a PCAP file. I used the KVM script during the installation and I also checked if the user cape is part of pcap group and it is.
Analysis Log
To the problem related to IE11, I have changed to Edge Legacy, I will test it. In case you know browsers versions that are compatible with Cape, please let me know.
Thank you so much! =D |
|
Glad to hear you solved that problem. I'm sorry to say that browser compatibility is not good in cape - with Chrome, Firefox and Edge all using Chromium with a very complex architecture split across dozens of processes, the model of injecting a monitor dll into each process was stretched to the extreme. But it's the locked-down nature of a lot of the browser processes that really does for the injected monitor's abilities - it was never designed to run within locked-down low privilege 'sandboxed' processes... So the only good compatibility in cape is with older style browsers like Internet Explorer and Firefox versions from a few years ago! But cape is not really intended for this use case - when it was conceived of in Cuckoo the idea was to catch browser exploits. These are rarer these days and for reasons mentioned above are not able to be easily monitored. If catching exploits is not your aim then I am afraid to say cape probably isn't designed to do what you want... What it's really all about is detonating malware... |
|
Thank you so much for being supportive of my question @kevoreilly . Do you have any idea what might be causing the that I mentioned?
==> ./process.log <== There is no dump.pcap file in the folder. |
|
The pcap is captured by the 'sniffer' auxiliary module which is server-side (logs to cuckoo.kog). It might be worth debugging this module or trying to test tcpdump manually (called by sniffer). |
|
Since the original issue is solved I will close this. |
|
I noticed that the issue with pcap file was because the command I found a solution here > Cuckoo Network Analysis Failure What I did?
If the solution above doesn't work we can test only with the first command. In case of persistent issue we can try the commands below.
Checking the result Perform the command
Possible script updateI also update my script cape2.sh as mentioned below to avoid future issues like that. I hope this can help you.
|
|
Thank you for this feedback - hopefully this will help others in future. I hope your sandbox is now working well. |
|
thanks for feedback, to make everyone's life easier, try to push your updates back to source, as that would help to others get it and for us to have one central place. i have added |
About accounts on capesandbox.com
This is opensource and you getting free support so be friendly!
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Please describe the behavior you are expecting. If your samples(x64) stuck in pending ensure that you set tags=x64 in hypervisor conf for x64 vms
Current Behavior
What is the current behavior?
For every file or URL submitted to the guest nothing happen. On the guest (Win10) were installed, chocolatey(dotnetfx dotnet4.7.2 vcredist-all wixtoolset msxml4.sp3 msxml6.sp1), python 3.7.9, pillow, and pywintrace.
The guest network is configurated as isolated (virbr1 - 192.168.121.0)
As you could see below there is no error evidence during the file upload, but I can't see any result based on the file sent to the guest. I've been working on it for one week without any positive results.
Many thanks for any help provided.
Context
Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions.
$ git log | head -n1to find outFailure Logs
Please include any relevant log snippets or files here.
Sample of cuckoo.log
Sample of process.log
Cuckoo conf files:
https://pastebin.com/2VH4N4Ad
The text was updated successfully, but these errors were encountered: