search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.56k stars 1.7k forks source link

cuckoo Unable to stop auxiliary module: Sniffer #2049

Open jmg49 opened 6 years ago

jmg49 commented 6 years ago

hi,

i have this error in a task summary report,

i've tried what i have found here 👍

sudo apt-get install apparmor-utils sudo aa-disable /usr/sbin/tcpdump sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump getcap /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip

reboot but always the same error ,

thanks in advance

doomedraven commented 6 years ago

try

groupadd pcap
usermod -a -G pcap cuckoo
chgrp pcap /usr/sbin/tcpdump
setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
jmg49 commented 6 years ago

i change for a fedora 25 in root to not be in trouble with sudo same thing, even with your suggestion

doomedraven commented 6 years ago

ubuntu 16.04 is tested and suggested OS for cuckoo, about root facepalm, never do it

jbremer commented 6 years ago

Hehe, yeah, no Fedora expert here. Perhaps it requires a different workaround ;-) Anyone else know what's up?

mativl commented 6 years ago

check the analysis.log and if something like this appears:

"Traceback (most recent call last): File "C: /tmpxavkbv/analyzer.py", line 624, in run aux.start () File "C: \ tmpxavkbv \ modules \ auxiliary \ recentfiles.py", line 55, in start dirpath = self.get_path () File "C: \ tmpxavkbv \ modules \ auxiliary \ recentfiles.py", line 43, in get_path r = SHELL32.SHGetKnownFolderPath ( File "C: \ Python27 \ lib \ ctypes \ init.py", line 379, in getattr func = self . getitem (name) File "C: \ Python27 \ lib \ ctypes \ init.py", line 384, in getitem func = self._FuncPtr ((name_or_ordinal, self)) AttributeError: function 'SHGetKnownFolderPath' not found " It may be a problem similar to #1934 . It seems that it is from XP, I solved it by installing a Windows 7 as a virtual machine and I got it perfectly.