search

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
2.01k stars 425 forks source link

cape2.sh script bug prevents installation of sandbox #2374

Closed lesszzen closed 2 weeks ago

lesszzen commented 2 weeks ago

Prerequisites

Expected Behavior

sudo ./cape2.sh base cape | tee cape-sandbox.log Installed correctly without errors

Current Behavior

Use the script cape2.sh to install CAPEv2 sandbox. Python prompts an error. There was no error before.

[+] Installing capa
...
NoSuchOptionException
The "--directory" option does not exist.
...
./cape2.sh: line 910: cd: /opt/CAPEv2: No such file or directory

Failure Information (for bugs)

Preparing to unpack de4dot_3.1.41592.3405-2_all.deb ...
Unpacking de4dot (3.1.41592.3405-2) ...
Setting up de4dot (3.1.41592.3405-2) ...
[+] Installing capa
Already up to date.
Submodule path 'rules': checked out 'b325cf8a50fc1293455a0822170422734d6977dc'

  Stack trace:

  11  /usr/lib/python3/dist-packages/clikit/console_application.py:123 in run
      io = io_factory(

  10  /usr/lib/python3/dist-packages/poetry/console/config/application_config.py:221 in create_io
      resolved_command = application.resolve_command(args)

   9  /usr/lib/python3/dist-packages/clikit/console_application.py:110 in resolve_command
      return self._config.command_resolver.resolve(args, self)

   8  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:43 in resolve
      result = self.process_default_commands(args, application.default_commands)

   7  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:104 in process_default_commands
      if resolved_command.is_parsable():

   6  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:43 in is_parsable
      self._parse()

   5  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:49 in _parse
      self._parsed_args = self._command.parse(self._raw_args)

   4  /usr/lib/python3/dist-packages/clikit/api/command/command.py:113 in parse
      return self._config.args_parser.parse(args, self._args_format, lenient)

   3  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:53 in parse
      self._parse(args, _fmt, lenient)

   2  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:101 in _parse
      self._parse_long_option(token, tokens, fmt, lenient)

   1  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:247 in _parse_long_option
      self._add_long_option(name, None, tokens, fmt, lenient)

  NoSuchOptionException

  The "--directory" option does not exist.

  at /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:300 in _add_long_option
      296│     def _add_long_option(
      297│         self, name, value, tokens, fmt, lenient
      298│     ):  # type: (str, Optional[str], List[str], ArgsFormat, bool) -> None
      299│         if not fmt.has_option(name):
    → 300│             raise NoSuchOptionException(name)
      301│ 
      302│         option = fmt.get_option(name)
      303│ 
      304│         if value is False:
[+] Installing PostgreSQL
Hit:1 http://cn.archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [129 kB]
Get:3 http://apt.postgresql.org/pub/repos/apt jammy-pgdg InRelease [129 kB]
Get:4 http://cn.archive.ubuntu.com/ubuntu jammy-updates InRelease [128 kB]

Steps to Reproduce

1.wget https://raw.githubusercontent.com/kevoreilly/CAPEv2/master/installer/cape2.sh download script 2.sed -i s/NETWORK_IFACE=virbr1/NETWORK_IFACE=virbr0/g cape2.sh 3.sed -i s/IFACE_IP=\"192.168.1.1\"/IFACE_IP=\"192.168.122.1\"/g cape2.sh 4.sudo ./cape2.sh base cape | tee cape-sandbox.log

Context

Question Answer
Git commit commit a89bd2bb426c58f5ab5a6852c670f80dde49376f
OS version Ubuntu 22.04.5
Python3 version 3.10.12
doomedraven commented 2 weeks ago

fixed, thanks

lesszzen commented 2 weeks ago

The "--directory" option does not exist This option creates more bugs

[+] Checking for old YARA version to uninstall
[+] Installing Yara
Unpacking yara (4.5.2) ...
Setting up yara (4.5.2) ...
Processing triggers for man-db (2.10.2-1) ...

  Stack trace:

  11  /usr/lib/python3/dist-packages/clikit/console_application.py:123 in run
      io = io_factory(

  10  /usr/lib/python3/dist-packages/poetry/console/config/application_config.py:221 in create_io
      resolved_command = application.resolve_command(args)

   9  /usr/lib/python3/dist-packages/clikit/console_application.py:110 in resolve_command
      return self._config.command_resolver.resolve(args, self)

   8  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:43 in resolve
      result = self.process_default_commands(args, application.default_commands)

   7  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:104 in process_default_commands
      if resolved_command.is_parsable():

   6  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:43 in is_parsable
      self._parse()

   5  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:49 in _parse
      self._parsed_args = self._command.parse(self._raw_args)

   4  /usr/lib/python3/dist-packages/clikit/api/command/command.py:113 in parse
      return self._config.args_parser.parse(args, self._args_format, lenient)

   3  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:53 in parse
      self._parse(args, _fmt, lenient)

   2  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:101 in _parse
      self._parse_long_option(token, tokens, fmt, lenient)

   1  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:247 in _parse_long_option
      self._add_long_option(name, None, tokens, fmt, lenient)

  NoSuchOptionException

  The "--directory" option does not exist.

  at /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:300 in _add_long_option
      296│     def _add_long_option(
      297│         self, name, value, tokens, fmt, lenient
      298│     ):  # type: (str, Optional[str], List[str], ArgsFormat, bool) -> None
      299│         if not fmt.has_option(name):
    → 300│             raise NoSuchOptionException(name)
      301│ 
      302│         option = fmt.get_option(name)
      303│ 
      304│         if value is False:
[+] Installing CAPEv2
....
Building wheels for collected packages: libvirt-python
  Building wheel for libvirt-python (pyproject.toml): started
  Building wheel for libvirt-python (pyproject.toml): finished with status 'done'
  Created wheel for libvirt-python: filename=libvirt_python-10.7.0-cp310-cp310-linux_x86_64.whl size=507561 sha256=5383c61b6f41eefb8e8cbd7b643967548f3a7b95b6fdb533eba2832a8341a581
  Stored in directory: /home/cape/.cache/pip/wheels/6c/49/63/7b1b2031f0fb4c7ec7121a229f9eac43dba5218bdf78a5d3dc
Successfully built libvirt-python
Installing collected packages: libvirt-python
Successfully installed libvirt-python-10.7.0
Reading package lists...
Building dependency tree...
Reading state information...
libmagic1 is already the newest version (1:5.41-3ubuntu0.1).
libmagic1 set to manually installed.
The following NEW packages will be installed:
  libjansson-dev libmagic-dev
0 upgraded, 2 newly installed, 0 to remove and 10 not upgraded.
Need to get 140 kB of archives.
After this operation, 532 kB of additional disk space will be used.
Get:1 http://cn.archive.ubuntu.com/ubuntu jammy/main amd64 libjansson-dev amd64 2.13.1-1.1build3 [35.3 kB]
Get:2 http://cn.archive.ubuntu.com/ubuntu jammy-updates/main amd64 libmagic-dev amd64 1:5.41-3ubuntu0.1 [105 kB]
Fetched 140 kB in 1s (93.9 kB/s)
Selecting previously unselected package libjansson-dev:amd64.
(Reading database ... 227689 files and directories currently installed.)
Preparing to unpack .../libjansson-dev_2.13.1-1.1build3_amd64.deb ...
Unpacking libjansson-dev:amd64 (2.13.1-1.1build3) ...
Selecting previously unselected package libmagic-dev:amd64.
Preparing to unpack .../libmagic-dev_1%3a5.41-3ubuntu0.1_amd64.deb ...
Unpacking libmagic-dev:amd64 (1:5.41-3ubuntu0.1) ...
Setting up libmagic-dev:amd64 (1:5.41-3ubuntu0.1) ...
Setting up libjansson-dev:amd64 (2.13.1-1.1build3) ...
Processing triggers for man-db (2.10.2-1) ...
Submodule path 'yara': checked out '0e5b6bb9660cba500eb58dbccb027757c82cc4cf'

  Stack trace:

  11  /usr/lib/python3/dist-packages/clikit/console_application.py:123 in run
      io = io_factory(

  10  /usr/lib/python3/dist-packages/poetry/console/config/application_config.py:221 in create_io
      resolved_command = application.resolve_command(args)

   9  /usr/lib/python3/dist-packages/clikit/console_application.py:110 in resolve_command
      return self._config.command_resolver.resolve(args, self)

   8  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:43 in resolve
      result = self.process_default_commands(args, application.default_commands)

   7  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:104 in process_default_commands
      if resolved_command.is_parsable():

   6  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:43 in is_parsable
      self._parse()

   5  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:49 in _parse
      self._parsed_args = self._command.parse(self._raw_args)

   4  /usr/lib/python3/dist-packages/clikit/api/command/command.py:113 in parse
      return self._config.args_parser.parse(args, self._args_format, lenient)

   3  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:53 in parse
      self._parse(args, _fmt, lenient)

   2  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:101 in _parse
      self._parse_long_option(token, tokens, fmt, lenient)

   1  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:247 in _parse_long_option
      self._add_long_option(name, None, tokens, fmt, lenient)

  NoSuchOptionException

  The "--directory" option does not exist.

  at /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:300 in _add_long_option
      296│     def _add_long_option(
      297│         self, name, value, tokens, fmt, lenient
      298│     ):  # type: (str, Optional[str], List[str], ArgsFormat, bool) -> None
      299│         if not fmt.has_option(name):
    → 300│             raise NoSuchOptionException(name)
      301│ 
      302│         option = fmt.get_option(name)
      303│ 
      304│         if value is False:
make[1]: Leaving directory '/tmp/passivedns'

checkinstall 1.6.3, Copyright 2010 Felipe Eduardo Sanchez Diaz Duran

 [y]: y

Making install in src
make[1]: Entering directory '/tmp/passivedns/src'
make[2]: Entering directory '/tmp/passivedns/src'
 /usr/bin/mkdir -p '/usr/local/bin'
  /usr/bin/install -c passivedns '/usr/local/bin'
make[2]: Nothing to be done for 'install-data-am'.
make[2]: Leaving directory '/tmp/passivedns/src'
make[1]: Leaving directory '/tmp/passivedns/src'
make[1]: Entering directory '/tmp/passivedns'
make[2]: Entering directory '/tmp/passivedns'
make[2]: Nothing to be done for 'install-exec-am'.
make[2]: Nothing to be done for 'install-data-am'.
make[2]: Leaving directory '/tmp/passivedns'
make[1]: Leaving directory '/tmp/passivedns'

Copying documentation directory...
./
./doc/
./doc/LICENSE
./doc/How-it-works.txt
./doc/AUTHORS
./doc/INSTALL
./doc/ROADMAP
./doc/ISSUES
./doc/README.upgrading
./doc/TODO
./doc/ChangeLog
./doc/README
./README

**********************************************************************

**********************************************************************

  Stack trace:

  11  /usr/lib/python3/dist-packages/clikit/console_application.py:123 in run
      io = io_factory(

  10  /usr/lib/python3/dist-packages/poetry/console/config/application_config.py:221 in create_io
      resolved_command = application.resolve_command(args)

   9  /usr/lib/python3/dist-packages/clikit/console_application.py:110 in resolve_command
      return self._config.command_resolver.resolve(args, self)

   8  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:43 in resolve
      result = self.process_default_commands(args, application.default_commands)

   7  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:104 in process_default_commands
      if resolved_command.is_parsable():

   6  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:43 in is_parsable
      self._parse()

   5  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:49 in _parse
      self._parsed_args = self._command.parse(self._raw_args)

   4  /usr/lib/python3/dist-packages/clikit/api/command/command.py:113 in parse
      return self._config.args_parser.parse(args, self._args_format, lenient)

   3  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:53 in parse
      self._parse(args, _fmt, lenient)

   2  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:101 in _parse
      self._parse_long_option(token, tokens, fmt, lenient)

   1  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:247 in _parse_long_option
      self._add_long_option(name, None, tokens, fmt, lenient)

  NoSuchOptionException

  The "--directory" option does not exist.

  at /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:300 in _add_long_option
      296│     def _add_long_option(
      297│         self, name, value, tokens, fmt, lenient
      298│     ):  # type: (str, Optional[str], List[str], ArgsFormat, bool) -> None
      299│         if not fmt.has_option(name):
    → 300│             raise NoSuchOptionException(name)
      301│ 
      302│         option = fmt.get_option(name)
      303│ 
      304│         if value is False:

  Stack trace:

  11  /usr/lib/python3/dist-packages/clikit/console_application.py:123 in run
      io = io_factory(

  10  /usr/lib/python3/dist-packages/poetry/console/config/application_config.py:221 in create_io
      resolved_command = application.resolve_command(args)

   9  /usr/lib/python3/dist-packages/clikit/console_application.py:110 in resolve_command
      return self._config.command_resolver.resolve(args, self)

   8  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:43 in resolve
      result = self.process_default_commands(args, application.default_commands)

   7  /usr/lib/python3/dist-packages/clikit/resolver/default_resolver.py:104 in process_default_commands
      if resolved_command.is_parsable():

   6  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:43 in is_parsable
      self._parse()

   5  /usr/lib/python3/dist-packages/clikit/resolver/resolve_result.py:49 in _parse
      self._parsed_args = self._command.parse(self._raw_args)

   4  /usr/lib/python3/dist-packages/clikit/api/command/command.py:113 in parse
      return self._config.args_parser.parse(args, self._args_format, lenient)

   3  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:53 in parse
      self._parse(args, _fmt, lenient)

   2  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:101 in _parse
      self._parse_long_option(token, tokens, fmt, lenient)

   1  /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:247 in _parse_long_option
      self._add_long_option(name, None, tokens, fmt, lenient)

  NoSuchOptionException

  The "--directory" option does not exist.

  at /usr/lib/python3/dist-packages/clikit/args/default_args_parser.py:300 in _add_long_option
      296│     def _add_long_option(
      297│         self, name, value, tokens, fmt, lenient
      298│     ):  # type: (str, Optional[str], List[str], ArgsFormat, bool) -> None
      299│         if not fmt.has_option(name):
    → 300│             raise NoSuchOptionException(name)
      301│ 
      302│         option = fmt.get_option(name)
      303│ 
      304│         if value is False:
lesszzen commented 2 weeks ago

@doomedraven

doomedraven commented 2 weeks ago

ok i will review later today community contribution that introduced that bug

but i do see directory option, what version of poetry do you have? https://python-poetry.org/docs/cli/

lesszzen commented 2 weeks ago

ok i will review later today community contribution that introduced that bug

but i do see directory option, what version of poetry do you have? https://python-poetry.org/docs/cli/

installed by script should be ubuntu22.04 default version 

cape@kvm:~$ python3 -m poetry -V   
Poetry version 1.1.12
doomedraven commented 2 weeks ago

wow is extremely old, now is 1.8.x

lesszzen commented 2 weeks ago

:)

sed -i "s|poetry --directory /opt/CAPEv2/|cd /opt/CAPEv2/ \&\& poetry|g" cape2.sh
sed -i "s|poetry --directory /opt/CAPEv2|cd /opt/CAPEv2/ \&\& poetry|g" cape2.sh
doomedraven commented 2 weeks ago

i have updated install script to use oficial installer isntead of outdated APT, curl -sSL https://install.python-poetry.org | python3 - use taht to upgrade your poetry

lesszzen commented 2 weeks ago

i have updated install script to use oficial installer isntead of outdated APT, curl -sSL https://install.python-poetry.org | python3 - use taht to upgrade your poetry

after test it work fine no error

steps:

git clone https://github.com/kevoreilly/CAPEv2.git
cp ./CAPEv2/installer/cape2.sh ./
sudo chmod +x ./cape2.sh
sed -i s/NETWORK_IFACE=virbr1/NETWORK_IFACE=virbr0/g cape2.sh 
export http_proxy=http://192.168.0.1:1081
export pip_proxy="https://example.com/simple"
num=$(grep -n "CRYPTOGRAPHY_DONT_BUILD_RUST=1" cape2.sh | cut -d: -f1)
sed -i "${num}i \ \ \ \ sudo poetry source add --priority=default mirrors $pip_proxy && sudo poetry lock" cape2.sh
sed -i "s|python3 utils/community.py -waf -cr|python3 utils/community.py -waf -cr --proxy $http_proxy|g" cape2.sh
sudo mv CAPEv2/ /opt/CAPEv2
sudo ./cape2.sh base cape | tee cape-sandbox.log
prantoran commented 1 week ago

@lesszzen Noob question 😅 what is happening in this command? 

sed -i "${num}i \ \ \ \ sudo poetry source add --priority=default mirrors $pip_proxy && sudo poetry lock" cape2.sh

Specifically sed -i "${num}i \ \ \ \

misogare commented 6 days ago

@lesszzen Noob question 😅 what is happening in this command?

sed -i "${num}i \ \ \ \ sudo poetry source add --priority=default mirrors $pip_proxy && sudo poetry lock" cape2.sh

Specifically sed -i "${num}i \ \ \ \

if you look here he greps the number line in here num=$(grep -n "CRYPTOGRAPHY_DONT_BUILD_RUST=1" cape2.sh | cut -d: -f1)

this grep the number line where CRYPTOGRAPHY_DONT_BUILD_RUST=1 exist in cape2.sh then it sed it which means goes to that line number lets say 50 then usually it replaces but since it has ${num}i after this i (inserts) a new line then \ \ \ \ ( 4 spaces) 51 sudo poetry source add --priority=default mirrors https://example.com/simple && sudo poetry lock

lesszzen commented 6 days ago

@lesszzen Noob question 😅 what is happening in this command?

sed -i "${num}i \ \ \ \ sudo poetry source add --priority=default mirrors $pip_proxy && sudo poetry lock" cape2.sh

Specifically sed -i "${num}i \ \ \ \

Switch to the nearest mirror source. Lock is required after modification. The four spaces are for alignment