Does anyone succeed to set up android sandbox??

[snemes]

Yes, it is possible to set it up, just did it a few days ago. There are several minor glitches though, which need some code patches. I'll try to submit a pull request as soon as I have some time.

Here's a list of steps/issues that I found so far:

• Make sure that 'ip = 127.0.0.1' or 'ip = 0.0.0.0' is set in your cuckoo.conf file and 'machinery = avd' is selected.
• Make sure that 'resultserver_ip = 10.0.2.2' is set in avd.conf.
• Ensure that droidmon processing is enabled in processing.conf.
• Install the Androguard Python module using 'pip install androguard'.
• You will need to patch https://github.com/cuckoosandbox/cuckoo/blob/master/lib/cuckoo/common/objects.py#L352 to check for "Java archive data" too (or whatever the Linux 'file' command returns for your .jar file).
• You will have to add a time.sleep(5) command after https://github.com/cuckoosandbox/cuckoo/blob/master/modules/machinery/avd.py#L294 to make sure the Android agent has enough time to start up. (Android ADB port forwarding shows a port open even if there is nothing listening on that port on the emulator side - this confuses Cuckoo and it think that agent has started up.)

Things that don't currently work:

• Droidmon analysis will appear in the report.json file, but it will not be visible on the web interface. It seems that the UI parts were simply not migrated at all from the CuckooDroid project.
• There are some Android signatures present in Cuckoo, but they won't be invoked. This is due to the fact that Cuckoo uses the task's 'platform' setting when looking for signatures, and if that field is empty it defaults to Windows signatures. It appears to me that all tasks have an empty 'platform' field when you submit them from the web UI, so this needs some fixing too.

Hope that helps.

[snemes]

It looks like most of the fixes required here already have pull requests waiting to be merged: https://github.com/cuckoosandbox/cuckoo/pull/855, https://github.com/cuckoosandbox/cuckoo/pull/865

[jbremer]

Sounds about right @snemes :-)

[ghost]

For what it is worth, I have a patch to the HTML report lying around on a VM somewhere, that will include some of the "specialness" from the cuckoo droid HTML report. If I can find the time, i'll try to finish the patch and make a pull request.

[jbremer]

That's great @RuneTM, I haven't had the time to do this myself. Looking forward to it.

[lovina37]

lovina@ubuntu:~/cuckoo$ python cuckoo.py

---

//\ //\//\ //\ //\//\ //\ /_/\
\:::\/ \:\ \:\ \:::\/ \::.\ \ \ \::: \ \::: \ \
\:\ \ \:\ \:\ \:\ \ _\:: \/) \ \:\ \ \ \:\ \ \ \
\:\ \//\:\ \:\ \:\ \//\:. ( ( \:\ \ \ \:\ \ \ \
\:_\ \ \:_\:\ \:_\ \ \: \ ) \ \ \:_\ \ \:_\ \ \ _\/ _\/ _\/ _\/_\/ _\/ _____\/

Cuckoo Sandbox 1.2 www.cuckoosandbox.org Copyright (c) 2010-2015

Checking for updates... Outdated! Cuckoo Sandbox version 2.0-rc1 is available now.

2017-02-10 12:14:42,723 [root] INFO: Generating grammar tables from /usr/lib/python2.7/lib2to3/Grammar.txt 2017-02-10 12:14:42,757 [root] INFO: Generating grammar tables from /usr/lib/python2.7/lib2to3/PatternGrammar.txt /usr/local/lib/python2.7/dist-packages/sqlalchemy/sql/compiler.py:572: SAWarning: Can't resolve label reference 'added_on desc'; converting to text() (this warning may be suppressed after 10 occurrences) util.ellipses_string(element.element)) 2017-02-10 12:14:43,114 [lib.cuckoo.core.scheduler] INFO: Using "avd" machine manager 2017-02-10 12:14:43,194 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s 2017-02-10 12:14:43,209 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks. /usr/local/lib/python2.7/dist-packages/sqlalchemy/sql/compiler.py:572: SAWarning: Can't resolve label reference 'priority desc, added_on'; converting to text() (this warning may be suppressed after 10 occurrences) util.ellipses_string(element.element)) 2017-02-10 12:17:05,974 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE "/tmp/cuckoo-tmp/upload_Ms40VK/locker-6ca7420a4c46a627b20d95ff8f54d9b7c78df08efdb1dca17168f14c60cb0a68.apk" (task=5) 2017-02-10 12:17:06,069 [lib.cuckoo.core.scheduler] INFO: Task #5: acquired machine aosx_1 (label=aosx_1) 2017-02-10 12:17:06,108 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 6880 (interface=vboxnet0, host=127.0.0.1, dump path=/home/lovina/cuckoo/storage/analyses/5/dump.pcap) 2017-02-10 12:18:28,835 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=aosx_1, ip=127.0.0.1) 2017-02-10 12:21:29,747 [lib.cuckoo.core.scheduler] ERROR: aosx_1: the guest initialization hit the critical timeout, analysis aborted. 2017-02-10 12:21:29,815 [modules.machinery.avd] INFO: Stopping AVD listening on port 5554 2017-02-10 12:21:31,331 [modules.processing.apkinfo] WARNING: Dex size bigger than: None 2017-02-10 12:21:31,335 [modules.processing.behavior] WARNING: Analysis results folder does not exist at path "/home/lovina/cuckoo/storage/analyses/5/logs". 2017-02-10 12:21:31,534 [lib.cuckoo.common.objects] WARNING: Unable to import pydeep (install with pip install pydeep) 2017-02-10 12:21:31,535 [lib.cuckoo.common.objects] WARNING: Unable to import yara (please compile from sources) 2017-02-10 12:21:32,519 [lib.cuckoo.core.plugins] ERROR: Failed to run the reporting module "MongoDB": Traceback (most recent call last): File "/home/lovina/cuckoo/lib/cuckoo/core/plugins.py", line 505, in process current.run(self.results) File "/home/lovina/cuckoo/modules/reporting/mongodb.py", line 216, in run self.conn.disconnect() File "/usr/local/lib/python2.7/dist-packages/pymongo/database.py", line 1053, in call self.name, self.client.class.name)) TypeError: 'Database' object is not callable. If you meant to call the 'disconnect' method on a 'MongoClient' object it is failing because no such method exists. 2017-02-10 12:21:32,774 [lib.cuckoo.core.plugins] WARNING: The reporting module "ReportAndroidHTML" returned the following error: Failed to generate HTML report: 'dict object' has no attribute 'debug' 2017-02-10 12:21:32,937 [lib.cuckoo.core.plugins] WARNING: The reporting module "ReportHTML" returned the following error: Failed to generate HTML report: 'dict object' has no attribute 'debug' 2017-02-10 12:21:32,938 [lib.cuckoo.core.scheduler] INFO: Task #5: reports generation completed (path=/home/lovina/cuckoo/storage/analyses/5) 2017-02-10 12:21:32,970 [lib.cuckoo.core.scheduler] INFO: Task #5: analysis procedure completed

^Clovina@ubuntu:~/cuckoo$ mongo cuckoo MongoDB shell version: 2.4.9 connecting to: cuckoo Welcome to the MongoDB shell. For interactive help, type "help". For more comprehensive documentation, see http://docs.mongodb.org/ Questions? Try the support group http://groups.google.com/group/mongodb-user