search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.56k stars 1.7k forks source link

ERROR: AttributeError: 'NoneType' object has no attribute 'shutdown' #2867

Closed samuelkneppel closed 5 years ago

samuelkneppel commented 5 years ago

My issue is whenever I run cuckoo -d from my virtualenv, i receive this error: ERROR: AttributeError: 'NoneType' object has no attribute 'shutdown'.

My Cuckoo version and operating system are 2.0.7 running on Ubuntu 19.04. I am using KVM, not VirtualBox.

This can be reproduced by simply running cuckoo -d from within my virtualenv. This is after a fairly fresh reinstall. I noticed that, when I was trying to get this to run in my vSphere environment, i was getting the same error. I assumed it had to do with the part that connected to vSphere. However, after trying to set it up on my physical box, I am wrong.

The log, error, files etc can be found attached. Please let me know if anymore logs would be necessary.

errorlog.txt

nbargnesi commented 5 years ago

You're missing libvirt in your virtual environment.

There's a bit of an indication in your log here:

2019-09-11 13:38:58,097 [cuckoo.core.scheduler] INFO: Using "kvm" as machine manager
Oops! Cuckoo failed in an unhandled exception!

2.0.7 wraps the libvirt import in a try/except that effectively hides the ImportError and replaces it instead with a CuckooDependencyError.

Though the dependency errors never hit the logs or console. 🤷‍♂

samuelkneppel commented 5 years ago

@nbargnesi Ah, ok, thanks. I completely missed the step about KVM when setting up my environment. Thanks for pointing it out!

However, when I try to install libvirt-bin, i get an error stating that it has no installation candidate. I also get E: Unable to locate package ubuntu-vm-builder

Do you know what these packages are called in Ubuntu 19.04 by any chance?

samuelkneppel commented 5 years ago

OK, so upon further troubleshooting, according to Ask Ubuntu and Ubuntu Help, it looks like libvirt-bin and ubuntu-vm-builder were both replaced by both libvirt-daemon-system and libvirt-clients on Ubuntu 18.10 and later, which are both already installed on my system, as well as qemu-kvm and bridge-utils:

~$ sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients python-libvirt 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
python-libvirt is already the newest version (5.0.0-1).
libvirt-clients is already the newest version (5.0.0-1ubuntu2.4).
libvirt-daemon-system is already the newest version (5.0.0-1ubuntu2.4).
qemu-kvm is already the newest version (1:3.1+dfsg-2ubuntu3.4).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

That all being said, I am trying getting the same error when I try to run cuckoo -d from virtual environment with my cuckoo user:

(venv) cuckoo@ubuntu:~$ cuckoo -d

2019-09-14 17:35:22,556 [cuckoo.core.scheduler] INFO: Using "kvm" as machine manager
Oops! Cuckoo failed in an unhandled exception!
Sometimes bugs are already fixed in the development release, it is therefore recommended to retry with the latest development release available https://github.com/cuckoosandbox/cuckoo
If the error persists please open a new issue at https://github.com/cuckoosandbox/cuckoo/issues

=== Exception details ===
Cuckoo version: 2.0.7
OS version: posix
OS release: Ubuntu 19.04 disco
Python version: 2.7.16
Python implementation: CPython
Machine arch: x86_64
Modules: alembic:1.0.10 androguard:3.0.1 argparse:1.2.1 asn1crypto:0.24.0 attrs:19.1.0 beautifulsoup4:4.5.3 capstone:3.0.5rc2 cffi:1.12.3 chardet:2.3.0 click:6.6 colorama:0.3.7 cryptography:2.7 cuckoo:2.0.7 django-extensions:1.6.7 django:1.8.4 dpkt:1.8.7 ecdsa:0.13.2 egghatch:0.2.3 elasticsearch:5.3.0 enum34:1.1.6 flask-sqlalchemy:2.4.0 flask:0.12.2 functools32:3.2.3.post2 future:0.17.1 gevent:1.2.2 greenlet:0.4.15 httpreplay:0.2.6 idna:2.8 ipaddress:1.0.22 itsdangerous:1.1.0 jinja2:2.9.6 jsbeautifier:1.6.2 jsonschema:3.0.2 mako:1.1.0 markupsafe:1.1.1 olefile:0.43 oletools:0.51 peepdf:0.4.2 pefile2:1.2.11 pillow:3.2.0 pip:19.2.3 pkg-resources:0.0.0 pycparser:2.19 pycrypto:2.6.1 pyelftools:0.24 pyguacamole:0.6 pymisp:2.4.106 pymongo:3.0.3 pyopenssl:19.0.0 pyrsistent:0.15.4 python-dateutil:2.4.2 python-editor:1.0.4 python-magic:0.4.12 python:2.7.16 pythonaes:1.0 pyvmomi:6.7.3 requests:2.13.0 roach:0.1.2 scapy:2.3.2 setuptools:41.2.0 sflock:0.3.10 six:1.12.0 sqlalchemy:1.3.3 tlslite-ng:0.6.0 unicorn:1.0.1 urllib3:1.25.3 wakeonlan:0.2.2 werkzeug:0.15.6 wheel:0.33.6 wsgiref:0.1.2 yara-python:3.6.3

2019-09-14 17:35:22,557 [cuckoo] ERROR: AttributeError: 'NoneType' object has no attribute 'shutdown'
Traceback (most recent call last):
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/main.py", line 298, in main
    cuckoo_main(maxcount)
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/main.py", line 248, in cuckoo_main
    stop()
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/main.py", line 231, in stop
    sched.stop()
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/core/scheduler.py", line 945, in stop
    machinery.shutdown()
AttributeError: 'NoneType' object has no attribute 'shutdown'

Has anyone else been able to successfully setup the sandbox on an Ubuntu 19.04 system using KVM?

nbargnesi commented 5 years ago

You're still missing libvirt in your virtual environment.

As the cuckoo user on your box, enter your virtual environment and pip install the libvirt bindings.

source ~/venv/bin/activate
pip install libvirt-python
samuelkneppel commented 5 years ago

@nbargnesi Thanks, that helped point me in the right direction. I had to install a couple of other pieces but finally got it mostly working.

I am able to run files through my sandbox, however, I keep getting the following error when I run an analysis:

2019-09-18 12:33:53,498 [cuckoo.core.plugins] ERROR: Failed to run the processing module "NetworkAnalysis" for task #3:
Traceback (most recent call last):
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/core/plugins.py", line 246, in process
    data = current.run()
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/processing/network.py", line 877, in run
    sort_pcap(self.pcap_path, sorted_path)
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/processing/network.py", line 1021, in sort_pcap
    inc, outpath, lambda path: SortCap(path, linktype=inc.linktype)
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/processing/network.py", line 943, in batch_sort
    current_chunk = list(itertools.islice(input_iterator, 32000))
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/processing/network.py", line 1006, in next
    sip, dip, sport, dport, proto = flowtuple_from_raw(raw, self.linktype)
  File "/home/cuckoo/venv/local/lib/python2.7/site-packages/cuckoo/processing/network.py", line 1035, in flowtuple_from_raw
    sport, dport = l3.sport, l3.dport
AttributeError: 'str' object has no attribute 'sport'

I am currently using the Cuckoo Rooter in "drop" mode. Any idea as to what this means?

nbargnesi commented 5 years ago

You should open another issue with your new topic.

But close this one first, since your initial KVM problem has been addressed.

samuelkneppel commented 5 years ago

@nbargnesi Good point. Thanks.

hkozushk commented 4 years ago

I just encountered this problem as well, installed libvirt-python in the virtual environment and ensured it was there, but still encountered the issue. I installed it as well outside of the virtual environment as well as the cuckoo user. Then I got back into the virtual environment and cuckoo worked. It makes me think I have something wrong in my virtual env. As reference I had to install

pip install libvirt-python==5.10.0

Verify with:

pip list | grep libvirt

cccs-kevin commented 3 years ago

Hey everyone. This issue persists on a fresh install of Cuckoo (v2.0.7) using the KVM machinery. I'm using an Ubuntu 18.04 LTS host. The fix was the following three lines:

sudo apt-get install libvirt-dev
. venv/bin/activate
pip install libvirt-python==5.10.0

Related to https://github.com/cuckoosandbox/cuckoo/issues/1926#issuecomment-342470859