hatching / vmcloak

Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
479 stars 118 forks source link

HTTPConnectionPool(host='192.168.30.2', port=8000): Read timed out. (read timeout=5) #213

Closed benibomba closed 9 months ago

benibomba commented 9 months ago

Good afternoon, I came across a problem and I don't know what to do with it. When creating a snapshot, this error appears. Increasing timeouts does not help. As I understood it during the snapshot creation it changes the IP address of the virtual machine, but at the same time knocks to the old IP, but changing the IP address during the snapshot creation still does not help. Please give me some advice

2023-10-05 03:33:22,895 vmcloak.misc DEBUG: No response 2023-10-05 03:33:32,906 vmcloak.misc DEBUG: Sending ping to agent on: 192.168.30.2:8000 2023-10-05 03:33:32,909 vmcloak.misc DEBUG: No response 2023-10-05 03:33:42,919 vmcloak.misc DEBUG: Sending ping to agent on: 192.168.30.2:8000 2023-10-05 03:33:42,921 vmcloak.misc DEBUG: No response 2023-10-05 03:33:52,932 vmcloak.misc DEBUG: Sending ping to agent on: 192.168.30.2:8000 2023-10-05 03:33:52,934 vmcloak.misc DEBUG: No response 2023-10-05 03:34:02,944 vmcloak.misc DEBUG: Sending ping to agent on: 192.168.30.2:8000 2023-10-05 03:34:02,978 vmcloak.agent DEBUG: Executing command in VM: netsh interface ip set address name="Ethernet" static 192.168.30.10 255.255.255.0 192.168.30.1 1 Traceback (most recent call last): File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 421, in _make_request six.raise_from(e, None) File "", line 3, in raise_from File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 416, in _make_request httplib_response = conn.getresponse() File "/usr/lib/python3.8/http/client.py", line 1348, in getresponse response.begin() File "/usr/lib/python3.8/http/client.py", line 316, in begin version, status, reason = self._read_status() File "/usr/lib/python3.8/http/client.py", line 277, in _read_status line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1") File "/usr/lib/python3.8/socket.py", line 669, in readinto return self._sock.recv_into(b) socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send resp = conn.urlopen( File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen retries = retries.increment( File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 400, in increment raise six.reraise(type(error), error, _stacktrace) File "/usr/lib/python3/dist-packages/six.py", line 703, in reraise raise value File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 665, in urlopen httplib_response = self._make_request( File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 423, in _make_request self._raise_timeout(err=e, url=url, timeout_value=read_timeout) File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 330, in _raise_timeout raise ReadTimeoutError( urllib3.exceptions.ReadTimeoutError: HTTPConnectionPool(host='192.168.30.2', port=8000): Read timed out. (read timeout=5)

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/bin/vmcloak", line 8, in sys.exit(main()) File "/usr/local/lib/python3.8/dist-packages/click/core.py", line 716, in call return self.main(args, kwargs) File "/usr/local/lib/python3.8/dist-packages/click/core.py", line 696, in main rv = self.invoke(ctx) File "/usr/local/lib/python3.8/dist-packages/click/core.py", line 1060, in invoke return _process_result(sub_ctx.command.invoke(sub_ctx)) File "/usr/local/lib/python3.8/dist-packages/click/core.py", line 889, in invoke return ctx.invoke(self.callback, ctx.params) File "/usr/local/lib/python3.8/dist-packages/click/core.py", line 534, in invoke return callback(args, *kwargs) File "/usr/local/lib/python3.8/dist-packages/click/decorators.py", line 17, in new_func return f(get_current_context(), args, kwargs) File "/usr/local/lib/python3.8/dist-packages/vmcloak/main.py", line 797, in snapshot new_snapshot = _snapshot(image, vmname, attr, interactive) File "/usr/local/lib/python3.8/dist-packages/vmcloak/main.py", line 581, in _snapshot a.static_ip(attr["ip"], attr["netmask"], attr["gateway"], h.interface) File "/usr/local/lib/python3.8/dist-packages/vmcloak/agent.py", line 121, in static_ip session.post( File "/usr/lib/python3/dist-packages/requests/sessions.py", line 583, in post return self.request('POST', url, data=data, json=json, kwargs) File "/usr/lib/python3/dist-packages/requests/sessions.py", line 535, in request resp = self.send(prep, send_kwargs) File "/usr/lib/python3/dist-packages/requests/sessions.py", line 648, in send r = adapter.send(request, kwargs) File "/usr/lib/python3/dist-packages/requests/adapters.py", line 529, in send raise ReadTimeout(e, request=request) requests.exceptions.ReadTimeout: HTTPConnectionPool(host='192.168.30.2', port=8000): Read timed out. (read timeout=5)

Cryss76 commented 9 months ago

the issue is on the command netsh interface ip set address name="Ethernet" static 192.168.30.10 255.255.255.0 192.168.30.1. The name field is not guaranteed to be the same on each install of Windows. I even had name differences with the same windows image.

Here is the workaround: create the image as always but before you create the snapshots or finalize the image you need to figure out the real name of the network adapter. You will need to manually start the image VM to do that.

After that you will need to change the interface field in the corresponding windows class e.g.: For Windows 10 you need to change the field interface in the windows10 class of the file win10.py

BTW: this project is dead and you shouldn't be using it ...

benibomba commented 9 months ago

@Cryss76 What virtual machine projects can you recommend? I plan to use cuckoo3. Its documentation recommended using vmcloak, but apparently it is outdated too). Or should I use qemu-system-x86-64 directly?

Cryss76 commented 9 months ago

tbh everything with cuckoo is quite messy. There isn't an easy and fast way to create the analysis VMs. Doing things manually is the most reliable but also takes the most effort...

On my fork of vmcloak I fixed some bugs (Not this one though). That might help if you are using qemu+kvm (but nothing else).

benibomba commented 9 months ago

@Cryss76 Thank you so much for the tip! Now I will try to fix it using your vmcloak version. If it's not too much trouble, can I contact you for hints and tips? If yes, is there any public network you are sitting on?

Cryss76 commented 9 months ago

there is a mattermost for cuckoo3 hosted by cert-ee. You just need to mail cert@cert.ee and request an invite.