Pin
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
@@ -0,0 +1,3 @@
|
||||
*.iso
|
||||
ansible.cfg
|
||||
.ansible.hosts.yml
|
||||
238
analysis.sh
Normal file
238
analysis.sh
Normal file
@@ -0,0 +1,238 @@
|
||||
#!/bin/bash
|
||||
|
||||
function EchoStatus {
|
||||
printf "\033[33;5m$1\033[0m\n"
|
||||
}
|
||||
|
||||
function EchoWarn {
|
||||
printf "\033[31;5m$1\033[0m\n"
|
||||
}
|
||||
|
||||
if [[ "$EUID" -ne 0 ]]; then
|
||||
EchoWarn "Please run as root... exiting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! $(pwd | grep -E ".cuckoo/storage/analyses/[0-9]{1,}") ]] && [[ -z "$SKIP_CHECKS" ]]; then
|
||||
echo "This script is intended to be called while you are in
|
||||
~/.cuckoo/storage/analyses/{n}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! command -v docker >/dev/null; then
|
||||
EchoWarn "Please ensure Docker is installed"
|
||||
fi
|
||||
|
||||
EchoStatus "Creating /opt/latex-gen"
|
||||
mkdir -p /opt/latex-gen
|
||||
|
||||
EchoStatus "Generating Memory Profile"
|
||||
mem_profile=${mem_profile:-$(volatility -f $1 imageinfo 2>/dev/null | grep "Suggested Profile(s)" | tr -s " " | cut -d " " -f 5 | sed 's/,$//')}
|
||||
|
||||
## Psxview Section
|
||||
EchoStatus "Generating psxview report"
|
||||
psxview_report=$(volatility -f "$1" --profile="$mem_profile" psxview 2>/dev/null | tail -n +3 | tr -s " " | sed 's/ / \& /g;s/$/ \\\\/g')
|
||||
|
||||
## Svcscan Section
|
||||
EchoStatus "Generating svcscan report"
|
||||
svcscan_scan=$(volatility -f "$1" --profile="$mem_profile" svcscan 2>/dev/null)
|
||||
declare -a svcscan_array=()
|
||||
|
||||
x=0
|
||||
while IFS= read -r line; do
|
||||
if [[ -z $line ]]; then
|
||||
x=$(( $x + 1 ))
|
||||
else
|
||||
svcscan_array[$x]="${svcscan_array[$x]}$line "
|
||||
fi
|
||||
done <<< $svcscan_scan
|
||||
|
||||
## Dlllist Section
|
||||
EchoStatus "Generating dlllist report"
|
||||
dlllist_scan=$(volatility -f "$1" --profile="$mem_profile" dlllist 2>/dev/null)
|
||||
declare -a dlllist_array=()
|
||||
|
||||
x=0
|
||||
while IFS= read -r line; do
|
||||
if [[ $line == "************************************************************************" ]]; then
|
||||
x=$(( $x + 1 ))
|
||||
else
|
||||
dlllist_array[$x]="${dlllist_array[$x]}$line|"
|
||||
fi
|
||||
done <<< $dlllist_scan
|
||||
|
||||
## Hash Dump Section
|
||||
EchoStatus "Generating hashdump report"
|
||||
hashdump_scan=$(volatility -f "$1" --profile="$mem_profile" hashdump 2>/dev/null)
|
||||
|
||||
## Envars Section
|
||||
EchoStatus "Generating envars report"
|
||||
envars_scan=$(volatility -f "$1" --profile="$mem_profile" envars 2>/dev/null | tail -n +3 | sed -E 's|[ ]{2,}| \& |g;s|(.*)(0x[0-9a-fA-F]{1,})(.*)|\1\2 \&\3|;s|( \& [0-9]{1,})|\1 \&|;s|\\|\\textbackslash{}|g;s/^ \& //g;s/$/ \\\\/g;s|\$|\\\$|g;s|_|\\_|g')
|
||||
|
||||
## Json Report Data
|
||||
EchoStatus "Generating general run information"
|
||||
report_started=$(date -d@$(jq .info.started reports/report.json))
|
||||
run_options=$(jq .info.options reports/report.json)
|
||||
run_score=$(jq .info.score reports/report.json)
|
||||
run_log=$(jq -r .debug.log reports/report.json | tail -n +2 | head -n -1 | sed -E 's/[ ]{1,}"//g;s/\\n"[,]{0,1}$//g')
|
||||
|
||||
# Set file var
|
||||
EchoStatus "Generating /opt/latex-gen/main.tex"
|
||||
tex_file="/opt/latex-gen/main.tex"
|
||||
|
||||
EchoStatus "Generating LaTeX Doc"
|
||||
# Empty Temp File
|
||||
echo "" > $tex_file
|
||||
|
||||
# Generate file header
|
||||
echo "\documentclass[12pt]{article}
|
||||
\usepackage[margin=1in]{geometry} % Set margin to 1in
|
||||
\usepackage{tgtermes} % Times Font
|
||||
\usepackage{setspace} % Set spacing to 1.5
|
||||
\onehalfspacing
|
||||
\usepackage{graphicx} % Include Graphicx
|
||||
\graphicspath{{./images}}
|
||||
\usepackage{hyperref}
|
||||
\usepackage{float}
|
||||
\usepackage{listings}
|
||||
\usepackage{tabularx}
|
||||
\usepackage{ltablex}
|
||||
\usepackage{multicol}
|
||||
\newcolumntype{s}{>{\hsize=.45\hsize}X}
|
||||
\newcolumntype{m}{>{\hsize=.95\hsize}X}
|
||||
\newcolumntype{b}{>{\hsize=1.5\hsize}X}
|
||||
\lstset{
|
||||
basicstyle=\small\ttfamily,
|
||||
columns=flexible,
|
||||
breaklines=true
|
||||
}
|
||||
|
||||
\title{Cuckoo Report for: $(basename $(jq -r .target task.json))}
|
||||
\author{Report generated with analysis.sh}
|
||||
|
||||
|
||||
\date{\today}
|
||||
|
||||
\begin{document}
|
||||
|
||||
\maketitle
|
||||
|
||||
\newpage
|
||||
|
||||
\tableofcontents
|
||||
|
||||
\newpage
|
||||
" >> $tex_file
|
||||
|
||||
# Basic info section
|
||||
|
||||
echo "\section{Basic Information}" >> $tex_file
|
||||
|
||||
echo "\begin{lstlisting}[
|
||||
basicstyle=\small
|
||||
]
|
||||
Run Started: $report_started
|
||||
Memory Profile Used: $mem_profile
|
||||
Run Options: $run_options
|
||||
Run Score: $run_score
|
||||
Executable Name: $(basename $(jq -r .target task.json))
|
||||
Cuckoo Run ID: $(jq -r .id task.json)
|
||||
\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Generate psxview section
|
||||
echo "
|
||||
\section{Psxview Log}
|
||||
\tiny
|
||||
\begin{tabularx}{\linewidth}{ |b|m|s|s|s|s|s|s|s|s|s|s|s| }
|
||||
\hline
|
||||
Offset & Name & PID & pslist & psscan & thrdproc & pspcid & csrss & session & deskthrd & Exit Date & Exit Time & Exit Zone \\\\
|
||||
\hline" >> $tex_file
|
||||
|
||||
echo "$psxview_report" >> $tex_file
|
||||
|
||||
echo " \hline
|
||||
\end{tabularx}
|
||||
" >> $tex_file
|
||||
|
||||
# Svcscan Section
|
||||
|
||||
echo "\section{Svcscan Section}" >> $tex_file
|
||||
|
||||
echo "\begin{multicols}{2}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$svcscan_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
\end{multicols}" >> $tex_file
|
||||
|
||||
# Generate run log section
|
||||
echo "\section{Run Log}
|
||||
" >> $tex_file
|
||||
|
||||
echo "\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$run_log" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# User HashDump Section
|
||||
|
||||
echo "\section{Hash Dump}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\small
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$hashdump_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Envar Section
|
||||
echo "
|
||||
\section{Envars}
|
||||
\tiny
|
||||
\begin{tabularx}{\linewidth}{ |s|s|m|m|b| }
|
||||
\hline
|
||||
Pid & Process Name & Offset & Var & Value \\\\
|
||||
\hline" >> $tex_file
|
||||
|
||||
echo "$envars_scan" >> $tex_file
|
||||
|
||||
echo " \hline
|
||||
\end{tabularx}
|
||||
" >> $tex_file
|
||||
|
||||
# Dlllist Section
|
||||
|
||||
echo "\section{Dlllist}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$dlllist_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Generate file end
|
||||
|
||||
echo "\end{document}
|
||||
" >> $tex_file
|
||||
|
||||
## Docker Setup
|
||||
|
||||
EchoStatus "Ensureing docker image is present"
|
||||
docker pull blang/latex >/dev/null
|
||||
EchoStatus "Typesetting LaTeX Doc"
|
||||
docker run -it --rm -v /opt/latex-gen:/mnt blang/latex pdflatex -halt-on-error -output-directory=/mnt /mnt/main.tex >/dev/null && EchoStatus "/opt/latex-gen/main.pdf has been created" || EchoWarn "There was an issue generating main.pdf"
|
||||
185
tasks/main.yml
Normal file
185
tasks/main.yml
Normal file
@@ -0,0 +1,185 @@
|
||||
---
|
||||
- name:
|
||||
package:
|
||||
name: "{{ package_name }}"
|
||||
state: present
|
||||
loop:
|
||||
- python
|
||||
- python-pip
|
||||
- python-dev
|
||||
- libffi-dev
|
||||
- libssl-dev
|
||||
- python-virtualenv
|
||||
- python-setuptools
|
||||
- libjpeg-dev
|
||||
- zlib1g-dev
|
||||
- swig
|
||||
- postgresql
|
||||
- libpq-dev
|
||||
- qemu-kvm
|
||||
- libvirt-bin
|
||||
- bridge-utils
|
||||
- python-libvirt
|
||||
- ubuntu-vm-builder
|
||||
- tcpdump
|
||||
- apparmor-utils
|
||||
- volatility
|
||||
- mongodb
|
||||
- virt-manager
|
||||
- inetsim
|
||||
- curl
|
||||
loop_control:
|
||||
loop_var: package_name
|
||||
|
||||
- name: Disable AppArmor for Tcpdump
|
||||
shell: aa-disable /usr/sbin/tcpdump || echo "Disabled"
|
||||
|
||||
- name: Create groups
|
||||
group:
|
||||
name: "{{ group_name }}"
|
||||
state: present
|
||||
loop:
|
||||
- pcap
|
||||
- cuckoo
|
||||
loop_control:
|
||||
loop_var: group_name
|
||||
|
||||
- name: Create the Cuckoo user
|
||||
user:
|
||||
name: cuckoo
|
||||
comment: "Cuckoo user"
|
||||
group: cuckoo
|
||||
shell: /bin/bash
|
||||
|
||||
- name: Add groups to Cuckoo user
|
||||
user:
|
||||
name: cuckoo
|
||||
groups: pcap,libvirt,libvirt-qemu
|
||||
append: yes
|
||||
|
||||
- name: Change tcpdump to pcap group
|
||||
file:
|
||||
path: /usr/sbin/tcpdump
|
||||
group: pcap
|
||||
mode: "2755"
|
||||
|
||||
- name: Set cap for tcpdump binary
|
||||
community.general.capabilities:
|
||||
path: /usr/sbin/tcpdump
|
||||
capability: cap_net_admin,cap_net_raw+eip
|
||||
state: present
|
||||
|
||||
- name: Create Cuckoo Python Virt Env
|
||||
file:
|
||||
path: /opt/cuckoo-env
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0744"
|
||||
|
||||
- name: Upgrade Pip
|
||||
pip:
|
||||
name:
|
||||
- pip
|
||||
- setuptools
|
||||
virtualenv: /opt/cuckoo-env
|
||||
virtualenv_python: python2
|
||||
|
||||
- name: Install m2crypto & Cuckoo
|
||||
pip:
|
||||
name:
|
||||
- m2crypto
|
||||
- cuckoo
|
||||
virtualenv: /opt/cuckoo-env
|
||||
virtualenv_python: python2
|
||||
|
||||
- name: Setting Activate Binary to executable
|
||||
file:
|
||||
path: /opt/cuckoo-env/bin/activate
|
||||
mode: u+x,g+x
|
||||
|
||||
- name:
|
||||
shell: /opt/cuckoo-env/bin/activate && /opt/cuckoo-env/bin/cuckoo init || echo "Created"
|
||||
|
||||
- name: Enabling MongoDB
|
||||
ini_file:
|
||||
path: /root/.cuckoo/conf/reporting.conf
|
||||
section: mongodb
|
||||
option: enabled
|
||||
value: 'yes'
|
||||
|
||||
- name: Setting qemu as virtual machine provider
|
||||
lineinfile:
|
||||
path: /root/.cuckoo/conf/cuckoo.conf
|
||||
state: present
|
||||
regexp: '^machinery'
|
||||
line: machinery = qemu
|
||||
|
||||
- name: Enabling memory dump
|
||||
lineinfile:
|
||||
path: /root/.cuckoo/conf/cuckoo.conf
|
||||
state: present
|
||||
regexp: '^memory_dump'
|
||||
line: memory_dump = yes
|
||||
|
||||
- name: Configuring Cuckoo kvm
|
||||
ini_file:
|
||||
path: /root/.cuckoo/conf/qemu.conf
|
||||
section: "{{ kvm_conf.section }}"
|
||||
option: "{{ kvm_conf.option }}"
|
||||
value: "{{ kvm_conf.value }}"
|
||||
loop:
|
||||
- option: label
|
||||
value: win7
|
||||
section: win7
|
||||
- option: image
|
||||
value: /var/lib/libvirt/images/win7.qcow2
|
||||
section: win7
|
||||
- option: snapshot
|
||||
value: 1619566313
|
||||
section: win7
|
||||
- option: enable_kvm
|
||||
value: 'no'
|
||||
section: win7
|
||||
- option: platform
|
||||
value: linux
|
||||
section: win7
|
||||
- option: ip
|
||||
value: 192.168.24.200
|
||||
section: win7
|
||||
- option: machines
|
||||
value: win7
|
||||
section: qemu
|
||||
- option: interface
|
||||
value: virbr1
|
||||
section: qemu
|
||||
loop_control:
|
||||
loop_var: kvm_conf
|
||||
tags:
|
||||
- never
|
||||
- conf_kvm
|
||||
|
||||
- name: Set correct listening IP address
|
||||
lineinfile:
|
||||
path: /root/.cuckoo/conf/cuckoo.conf
|
||||
state: present
|
||||
regexp: '^ip ='
|
||||
line: "ip = {{ ansible_default_ipv4.address }}"
|
||||
|
||||
- name: Create ISO Folder
|
||||
file:
|
||||
path: /root/iso
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Copy Win10 ISO to host
|
||||
copy:
|
||||
src: ./Win10_20H2_v2_English_x64.iso
|
||||
dest: /root/iso/Win10.iso
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
...
|
||||
7
tests/test.yml
Normal file
7
tests/test.yml
Normal file
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- hosts: all
|
||||
become: true
|
||||
roles:
|
||||
- src
|
||||
...
|
||||
|
||||
Reference in New Issue
Block a user