cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.56k stars 1.71k forks source link

when cuckoo process started using supervisor , error: it appears that the VM hasn't been able to contact back to the Cuckoo Host. #3192

Closed siftuser closed 3 years ago

siftuser commented 3 years ago

Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html

My issue is:

My setup works when cuckoo procs are started manually (rooter, daemon & web). I can access VM from host using curl

curl 192.168.56.101:8000
{"message": "Cuckoo Agent!", "version": "0.10", "features": ["execpy", "pinning", "logs", "largefile", "unicodepath"]}(cuckoo-test)

However, the VM does not start, when cuckoo procs are autostarted using supervisor

My Cuckoo version and operating system are:

Cuckoo V 2.0.7, Host: Ubuntu 18.04, Guest: Win 7 using virtualbox

This can be reproduced by:

starting cuckoo procs using supervisor

The log, error, files etc can be found at:

Time [cuckoo.processing.debug] ERROR: Error processing task #****: it appears that the Virtual Machine hasn't been able to contact back to the Cuckoo Host.

Supervisor conf

logfile = /home/cuckoo/.cuckoo/supervisord/log.log
pidfile = /home/cuckoo/.cuckoo/supervisord/pidfile
user = root
environment = CUCKOO_CWD="/home/cuckoo/.cuckoo/"

[supervisorctl]
serverurl = unix:///home/cuckoo/.cuckoo/supervisord/unix.sock

[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[unix_http_server]
file = /home/cuckoo/.cuckoo/supervisord/unix.sock

[program:cuckoo-rooter]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo rooter
user = root
startsecs = 10
autostart = true
autorestart = true
priority = 100

[program:cuckoo-daemon]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo -d -m 10000
user = cuckoo
startsecs = 30
autorestart = true
stderr_logfile = /home/cuckoo/.cuckoo/supervisord/cuckoostderr.log
priority = 200

[program:cuckoo-process]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo process p%(process_num)d
process_name = cuckoo-process_%(process_num)d
numprocs = 4
user = cuckoo
startsecs = 40
autorestart = true
priority = 300

[program:cuckoo-web]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo web -H 192.168.57.4 -p 8080
user = cuckoo
startsecs = 50
autorestart = true
priority = 400

[program:cuckoo-api]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo api -H 192.168.57.4 -p 8090
user = cuckoo
startsecs = 50
autorestart = true
priority = 400

[group:cuckoo]
programs = cuckoo-daemon, cuckoo-process

[program:distributed]
command = /home/cuckoo/.virtualenvs/cuckoo-test/bin/python -m cuckoo.distributed.worker
user = cuckoo
autostart = false
autorestart = true
environment = CUCKOO_APP="worker",CUCKOO_CWD="/home/cuckoo/.cuckoo"

supervisor_service_status

           ├─15118 /usr/bin/python /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
           ├─15121 /home/cuckoo/.virtualenvs/cuckoo-test/bin/python2.7 /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo rooter
           ├─15122 /home/cuckoo/.virtualenvs/cuckoo-test/bin/python2.7 /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo web -H 192.168.57.4 -p 8080
           ├─15123 /home/cuckoo/.virtualenvs/cuckoo-test/bin/python2.7 /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo api -H 192.168.57.4 -p 8090
           ├─15124 /home/cuckoo/.virtualenvs/cuckoo-test/bin/python2.7 /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo -d -m 10000
           └─15145 /home/cuckoo/.virtualenvs/cuckoo-test/bin/python2.7 /home/cuckoo/.virtualenvs/cuckoo-test/bin/cuckoo web -H 192.168.57.4 -p 8080

Mar 31 01:48:14 cuckoo-VirtualBox systemd[1]: Started Supervisor process control system for UNIX.
Mar 31 01:48:14 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:14,443 CRIT Set uid to user 0
Mar 31 01:48:14 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:14,443 INFO Included extra file "/etc/supervisor/conf.d/cuckoo.conf" during parsing
Mar 31 01:48:14 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:14,450 INFO RPC interface 'supervisor' initialized
Mar 31 01:48:14 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:14,450 CRIT Server 'unix_http_server' running without any HTTP authentication checking
Mar 31 01:48:14 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:14,450 INFO supervisord started with pid 15118
Mar 31 01:48:15 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:15,453 INFO spawned: 'cuckoo-rooter' with pid 15121
Mar 31 01:48:15 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:15,455 INFO spawned: 'cuckoo-web' with pid 15122
Mar 31 01:48:15 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:15,457 INFO spawned: 'cuckoo-api' with pid 15123
Mar 31 01:48:15 cuckoo-VirtualBox supervisord[15118]: 2021-03-31 01:48:15,459 INFO spawned: 'cuckoo-daemon' with pid 15124
siftuser commented 3 years ago

Figured. fixed by updating cuckoo conf.