[2024 Edition] Installing Cuckoo Sandbox!

What we are installing

We will be installing Cuckoo Sandbox.

https://cuckoo.sh/docs/

Actually, following the official Cuckoo documentation alone won't work.
It has been a long time since the last Cuckoo update, so the versions available via apt or pip are too new, or some packages no longer exist in apt.
So, let's install it while taking countermeasures against these issues.

Prerequisites

OS: Ubuntu 18.04.6 LTS

• Note: If the OS version is too high, VirtualBox might not start.

An environment where SSH XYC options can be used.

• Recommended: WSL works without installing external tools.

• If you can access the GUI environment directly, you can ignore the SSH part.

Initial Setup

sudo apt update

Disabling automatic apt updates

Run sudo vi /etc/apt/apt.conf.d/20auto-upgrades and edit the file as follows:

APT::Periodic::Update-Package-Lists "0";
APT::Periodic::Unattended-Upgrade "0";

Since we are intentionally installing older versions of packages this time, we need to stop automatic updates; otherwise, they will be updated to the latest versions automatically, causing errors.

Installing Python 2

sudo apt list | grep python | less

After confirming that the python package is version 2.x, run the following command:

sudo apt install python

Installing pip for Python 2

wget https://files.pythonhosted.org/packages/27/79/8a850fe3496446ff0d584327ae44e7500daf6764ca1a382d2d02789accf7/pip-20.3.4-py2.py3-none-any.whl
python pip-20.3.4-py2.py3-none-any.whl/pip install --no-index pip-20.3.4-py2.py3-none-any.whl

Installing VirtualBox

Check here for detailed explanations.

https://zenn.dev/test_myname/articles/old_virtualbox_install

wget https://download.virtualbox.org/virtualbox/5.2.44/virtualbox-5.2_5.2.44-139111~Ubuntu~bionic_amd64.deb
sudo apt install g++ iasl xsltproc libxml2-dev libidl-dev libvpx-dev libopus-dev libpng-dev libsdl1.2-dev libxmu-dev libdevmapper-dev libcap-dev libc6-dev-i386 libssl-dev libssh2-1-dev libxinerama-dev libxrandr-dev qt5-default makeself libpam0g-dev
sudo apt install ./virtualbox-5.2_5.2.44-139111~Ubuntu~bionic_amd64.deb

Check the operation just in case.

VBoxManage list vms

If no errors occur, you're all set!

python pip

sudo apt install python-pil
python -m pip install setuptools==44.1.1 setuptools_scm==5.0.2
python -m pip install configparser==4.0.2 zipp==1.2.0 importlib_metadata==2.1.3 importlib_resources==3.3.1 platformdirs==2.0.2 filelock==3.2.1 virtualenv==20.15.1

MongoDB

sudo apt install mongodb
sudo service mongodb start

• Note: Actually, the maximum supported version for MongoDB is 5, but since only a very old version is available in Ubuntu's apt, this is fine!

PostgreSQL

sudo apt install libpq-dev postgresql

cuckoo

sudo adduser cuckoo
sudo usermod -a -G vboxusers cuckoo
sudo usermod -a -G libvirtd cuckoo

virtualenv venv

sudo apt install libjpeg-dev python-dev zlib-devel
python2.7 -m pip install Pillow==3.2.0
python2.7 -m pip install cuckoo

tcpdump

sudo apt install tcpdump apparmor-utils
sudo aa-disable /usr/sbin/tcpdump

sudo groupadd pcap
sudo usermod -a -G pcap cuckoo
sudo chgrp pcap /usr/sbin/tcpdump
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

sudo apt install libcap2-bin
getcap /usr/sbin/tcpdump

guacd

sudo apt install libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd

M2Crypto

wget https://launchpad.net/ubuntu/+source/m2crypto/0.24.0-2/+build/13109848/+files/python-m2crypto_0.24.0-2_amd64.deb
sudo apt install swig 
sudo apt install ./python-m2crypto_0.24.0-2_amd64.deb

Starting Cuckoo

Check via Web

Set enabled = yes for mongodb in ~/.cuckoo/conf/reporting.conf as shown below.

[mongodb]
enabled = yes

Run the following command to start the server. You can then access it at **IP address**:8000.

cuckoo web runserver **IP address**:8000

Cuckoo configuration within the virtual environment

1. Start the python program located in ~/.cuckoo/agent/ inside the virtual environment.

• Note: If python is not installed in the virtual environment, install Python 2.

2. Take a snapshot.
3. Change the snapshot item in ~/.cuckoo/conf/virtualbox.conf to any string you like.

# (Optional) Specify the snapshot name to use. If you do not specify a snapshot
# name, the VirtualBox MachineManager will use the current snapshot.
# Example (Snapshot1 is the snapshot name):
snapshot = **The snapshot name you set**

Help

cuckoo or virtualenv commands don't work

If the cuckoo or virtualenv commands don't work, try logging in via SSH again.

• Note: This is because the PATH has not been updated. Using source is also an option, but logging in again is recommended as it's simpler to understand.