Closed jeffhammett closed 8 years ago
I got this working. It ended up not being an issue with Cuckoo directly. When Cuckoo restored the running VM in KVM the VM was freezing. I changed the cache mode on the virtual hard drive to "none" and it is working now.
I followed Seanthegeek's instructions here https://infosecspeakeasy.org/t/howto-build-a-cuckoo-sandbox/27 and setup Cuckoo-modified. Aside from changing the ip in kvm.conf and changing the interface in auxiliary.conf I followed the above directions exactly.
If I boot the vm (without Cuckoo) and run tcpdump on virbr0 I am able to see network requests (but the VM has no internet connection as expected). If I run "sudo torstart 192.168.100.101" the VM gets internet from Tor and I see the network traffic in tcpdump.
When I submit URLs or files to Cuckoo via the web interface I always get: "Error: The analysis hit the critical timeout, terminating." The pcap is empty. If I submit a file there will be details about the file (VT results, etc.) but it doesn't seem like the file has actually run. If I submit a URL the report is essentially empty. If I check the option for Tor when submitting the file I get ARP traffic in the pcap file, but nothing else.
Since the VM seems to work ok on its own, I'm starting my troubleshooting with Cuckoo.
If I watch the VM while running a Cuckoo analysis in the KVM console, I don't see anything happening, but looking at task manager it appears to be running the proper processes (iexplore.exe for URLs, winword.exe for Doc files, etc.)
If I manually open Internet Explorer while watching the VM in the KVM console while Cuckoo is running an analysis I see the network traffic for it loading my homepage in the results, but the VM seems to freeze up before I can do anything in the IE window.
There are also two pythonw.exe processes running while running a Cuckoo analysis, but only one when running the VM standalone, is this normal?
Here is my auxiliary.conf, cuckoo.conf, kvm.conf, processing.conf and reporting.conf
Any help would be much appreciated.