Ecosyste.ms: Repos
An open API service providing repository metadata for many open source software ecosystems.
Bitbucket.org / ldklinux / cuckoo-ldk
Customized cuckoo sandbox - automates running of pintools within Cuckoo, and provide primitives to lift large traces from sandbox to host filesystem.
JSON API: https://repos.ecosyste.ms/api/v1/hosts/Bitbucket.org/repositories/ldklinux%2Fcuckoo-ldk
Stars:
Forks:
Open Issues:
License: None
Language: python
Repo Size: 6.93 MB
Dependencies:
160
Created: over 5 years ago
Updated: over 5 years ago
Last synced: over 1 year ago
Files
Loading...
Readme
Loading...
Dependencies
- AdditionalSoftware *
- AlsointhiscasePython2.7ispreferred. *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckootorun *
- Cuckooguestcomponent.Theyinclude *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindofsandboxed *
- InordertomakeCuckoorunproperlyinyourvirtualizedWindowssystem ,you
- InstallPython *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Remebertodisablethe *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditionalfeaturesto *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouareencouraged
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcangetsomehints *
- Windowsenvironmentyouwanttorunthemalwaresin ,youmightwanttoinstall
- YoucandownloadtheproperWindowsinstallerfromthe *
- additionalsoftwaresuchasbrowsers ,PDFreaders,officesuitesetc.
- anyadditionalsoftware. *
- byreadingthe *
- ordertorunproperly. *
- properly. *
- todownloadandinstalltheproperpackagesaccordingtoyourPythonversion. *
- toinstallthemifyouwanttohaveaccesstoallavailablefeatures.Makesure *
- willhavetoinstallsomerequiredsoftwaresandlibraries. *
- AssumingyoudecidetogoforVirtualBox ,youcangettheproperpackagefor
- Asyouwillseethroughoutthisdocumentation ,you
- BeforeproceedingonconfiguringCuckoo ,you
- BydefaultCuckooadopts *
- CuckoohostcomponentsarecompletelywritteninPython ,thereforemakesureto
- Despiteheavilyrelyingon *
- Exceptfor *
- ForthesakeofthisguidewewillassumethatyouhaveVirtualBoxinstalled *
- IfwanttouseKVMit *
- Ifyoudon *
- IncombinationwithCuckoo ,itcanautomaticallyprovideadditionalvisibility
- Inordertodumpthenetworkactivityperformedbythemalwareduring *
- Inordertofunctionproperly ,Cuckoorequiresatleastversion2.3ofVolatility.
- Inordertoproperlyfunction ,CuckoorequiresSQLAlchemyandPythonBSONtobeinstalled.
- InstallPythononUbuntu *
- InstallingPythonlibraries *
- InstallingTcpdump *
- InstallingVolatility *
- InstallitonUbuntu *
- Installwith *
- Orotherwise *
- Requirements *
- Seethevolatilitydocumentationfordetailedinstructionsonhowtoinstallit. *
- SomeofthemarealreadypackagedinDebian *
- Tcpdumprequiresrootprivileges ,butsinceyoudon
- Thefollowinglibrariesarenotstrictlyrequired ,buttheirinstallationisrecommended
- TheinstallationofVirtualBoxisoutsidethescopeofthisdocumentation ,ifyou
- Thereareotheroptionaldependenciesthataremostlyusedbymodulesandutilities. *
- VirtualizationSoftware *
- Volatilityisanoptionaltooltodoforensicanalysisonmemorydumps. *
- Youarecompletelyresponsibleforthechoice ,configurationandexecutionof
- Youcangetitfromthe *
- Youcanverifytheresultsoflastcommandwith *
- andsupport. *
- architecturallyindependentfromthevirtualizationsoftware. *
- arenotfamiliarwithitpleaserefertothe *
- execution ,you
- executionandgeneralconfigurationofthesandbox. *
- haveanappropriateversioninstalled.Forthecurrentrelease *
- intodeepmodificationsintheoperatingsystemaswellasdetectthepresence *
- itinourchannelsandlists *
- modulestosupportanysoftwareofyourchoice. *
- ofrootkittechnologythatescapedthemonitoringdomainofCuckoo *
- softwareandlibraries. *
- thetrafficanddumpittoafile. *
- you *
- yourdistributionatthe *
- yourvirtualizationsoftware ,thereforepleaserefrainfromaskingforhelpon
- AdditionalSoftware *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckooto *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindof *
- InordertomakeCuckoorunproperlyinyourvirtualizedWindows *
- InstallPython *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditional *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouare
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcanget *
- Windowsdesktopduringtheanalysis. *
- YoucandownloadtheproperWindowsinstallerfromtheofficial *
- accordingtoyourPythonversion. *
- encouragedtoinstallthemifyouwanttohaveaccesstoallavailable *
- features.Makesuretodownloadandinstalltheproperpackages *
- featurestoCuckooguestcomponent.Theyinclude *
- libraries. *
- mightwanttoinstalladditionalsoftwaresuchasbrowsers ,PDF
- readers ,officesuitesetc.Remebertodisablethe
- runproperly. *
- sandboxedWindowsenvironmentyouwanttorunthemalwaresin ,you
- somehintsbyreadingthe *
- system ,youwillhavetoinstallsomerequiredsoftwaresand
- website.AlsointhiscasePython2.7ispreferred. *
- AssumingyoudecidetogoforVirtualBox ,youcangettheproper
- BSONtobeinstalled. *
- BeforeproceedingonconfiguringCuckoo ,you
- BydefaultCuckooadoptstcpdump ,theprominentopensourcesolution.
- CuckoohostcomponentsarecompletelywritteninPython ,therefore
- DespiteheavilyrelyingonVirtualBoxinthepast ,Cuckoohasmovedon
- Exceptfor *
- ForthesakeofthisguidewewillassumethatyouhaveVirtualBox *
- IfwanttouseKVMit *
- Ifyoudon *
- Inordertodumpthenetworkactivityperformedbythemalwareduring *
- Inordertofunctionproperly ,Cuckoorequiresatleastversion2.3of
- Inordertoproperlyfunction ,CuckoorequiresSQLAlchemyandPython
- InstallPythononUbuntu *
- InstallingPythonlibraries *
- InstallingTcpdump *
- InstallingVolatility *
- InstallitonUbuntu *
- Installwith *
- Orotherwise *
- Requirements *
- Seethevolatilitydocumentationfordetailedinstructionsonhowto *
- SomeofthemarealreadypackagedinDebian *
- Tcpdumprequiresrootprivileges ,butsinceyoudon
- Thereareotheroptionaldependenciesthataremostlyusedbymodules *
- VirtualizationSoftware *
- Volatility.Youcangetitfromtheofficialrepository. *
- Volatilityisanoptionaltooltodoforensicanalysisonmemory *
- Youarecompletelyresponsibleforthechoice ,configurationand
- Youcanverifytheresultsoflastcommandwith *
- additionalvisibilityintodeepmodificationsintheoperatingsystem *
- affectanyhowtheexecutionandgeneralconfigurationofthesandbox. *
- andutilities.Thefollowinglibrariesarenotstrictlyrequired ,but
- andwritemodulestosupportanysoftwareofyourchoice. *
- aswellasdetectthepresenceofrootkittechnologythatescapedthe *
- beingarchitecturallyindependentfromthevirtualizationsoftware.As *
- binary *
- capturethetrafficanddumpittoafile. *
- database. *
- documentation. *
- dumps.IncombinationwithCuckoo ,itcanautomaticallyprovide
- execution ,you
- executionofyourvirtualizationsoftware ,thereforepleaserefrain
- followingcommand *
- fromPCAPfiles. *
- fromaskingforhelponitinourchannelsandlists *
- ifyouarenotfamiliarwithitpleaserefertotheofficial *
- installationofVirtualBoxisoutsidethescopeofthisdocumentation ,
- installed *
- installedwiththefollowingcommand *
- installit. *
- makesuretohaveanappropriateversioninstalled.Forthecurrent *
- monitoringdomainofCuckoo *
- orabove *
- otherscanbeinstalledthrough *
- packageforyourdistributionattheofficialdownloadpage.The *
- refertotheirwebsites. *
- release >=4.0,but<4.1
- release *
- requiredsoftwareandlibraries. *
- runasrootyou *
- software *
- theirinstallationisrecommended *
- thewebinterface. *
- youwillseethroughoutthisdocumentation ,you