Cuckoo Sandbox 中文文档

Cuckoo Sandbox 是一个开源的自动分析可疑文件的软件。它通过在独立环境内使用自定义组件来监控恶意进程的行为。

本文档旨在说明如何配置、使用和定制Cuckoo

译者说明

联系方式: xyyvsxh@gmail.com

本次翻译的是为了更深入的了解整个Cuckoo的设计理念和架构，以便在使用的过程中能够更合理。

翻译的过程中并没有完全翻译所有内容，而是侧重于有助理解Cuckoo的内容，见谅。

首次使用Cuckoo?

在新版的Cuckoo中，有很多有关可用性的较大的改动。为了更好的使用Cuckoo，建议使用前阅读以下相关的几个章节:

• Cuckoo 工作目录
• Cuckoo 工作目录使用说明
• Cuckoo 安装
• Upgrading from a previous release
• Cuckoo Feedback

有疑问?

如果你在使用过程中遇到问题，建议先阅读下 FAQ 章节，其中可以已经包含了相关的解答。

• FAQ
  • General Questions
    • Can I analyze URLs with Cuckoo?
    • Can I use Volatility with Cuckoo?
    • What do I need to use Cuckoo with VMware ESXi?
  • Troubleshooting
    • After upgrade Cuckoo stops to work
    • Cuckoo stumbles and produces some error I don’t understand
    • Check and restore current snapshot with KVM
    • Check and restore current snapshot with VirtualBox
    • Unable to bind result server error
    • Error during template rendering
    • 501 Unsupported Method (‘GET’)
    • Permission denied for tcpdump
    • DistributionNotFound / No distribution matching the version..
    • IOError: [Errno 24] Too many open files
    • pkg_resources.ContextualVersionConflict
    • ValueError: incomplete format key
    • Troubleshooting VM network configuration
    • Cuckoo says there’s a version 2.1.0?
    • No handlers could be found for logger X in UWSGI log

除此之外，你也可以向Cuckoo的开发者或者其他Cuckoo用户咨询： Join the discussion.

文档目录

• 介绍
  • 沙箱
    • 沙箱使用
  • Cuckoo 是什么?
    • Cuckoo的历史
    • Use Cases
    • 架构
    • Obtaining Cuckoo
  • License
  • Disclaimer
  • Cuckoo Foundation
  • Community guidelines
    • Introduction
    • Creating issues
      • Reporting bugs, errors, and unexpected behavior
      • Feature requests/suggestions
      • Asking questions
    • Code and documentation contributions
      • Testing
      • Pull requests
• 安装
  • 宿主机的准备
    • 依赖
      • 安装 Python 库 (Ubuntu/Debian-based)
      • Installing Python libraries (on Mac OS X)
      • Installing Python libraries (on Windows 7)
      • 虚拟化软件
      • 安装 tcpdump
      • 安装 Volatility
      • 安装 M2Crypto
      • 安装 guacd
    • Cuckoo 安装
      • 创建用户
      • 增加打开文件数限制
      • 安装 Cuckoo
      • Install Cuckoo from file
      • Build/Install Cuckoo from source
    • Cuckoo 工作目录
      • 配置
      • CWD 路径
    • 配置
      • cuckoo.conf
      • auxiliary.conf
      • <machinery>.conf
      • memory.conf
      • processing.conf
      • reporting.conf
    • 单次分析路由
      • 全局路由
      • 单次分析路由配置
      • 使用单次网络分析路由
      • 配置 iproute2
        • None Routing
        • Drop Routing
        • Internet Routing
        • InetSim Routing
        • Tor Routing
        • VPN Routing
    • Configuration (Android Analysis)
      • avd.conf
  • 客户机的准备
    • 创建虚拟机
    • 依赖
      • 安装 Python
      • 其他软件
    • 网络配置
      • Windows 设置
      • 虚拟网络
    • 安装客户端
    • 保存虚拟机
      • VirtualBox
      • KVM
      • VMware Workstation
      • XenServer
        • Memory Snapshots
        • Booting from Disk
    • 虚拟机克隆
    • Installing the Linux host
      • The following instructions are only for x32/x64 ubuntu 17.04 linux guests
  • Preparing the Guest (Physical Machine)
    • Creation of the Physical Machine
    • Requirements
      • Install Python
      • Additional Software
      • Additional Host Requirements
      • Cuckoo Configuration Requirements
    • Network Configuration
      • Windows Settings
      • Networking
    • Installing the Agent
    • Saving the Guest
      • Fog
      • Setup using VMWare (Bonus!)
  • Upgrading from a previous release
    • The cuckoo import command
• 使用说明
  • 启动 Cuckoo
    • 后台运行 Cuckoo
  • Cuckoo 工作目录使用说明
    • Usage
  • 提交分析
    • 提交工具
    • API
    • 分布式 Cuckoo
    • Python 函数库
  • Web 界面
    • 配置
    • 启动 Web 界面
      • Web 界面部署
        • uWSGI 设置
        • nginx 设置
  • REST API
    • 启动 API 服务
      • Web 部署
        • uWSGI 设置
        • nginx 设置
    • 接口
      • /tasks/create/file
      • /tasks/create/url
      • /tasks/create/submit
      • /tasks/list
      • /tasks/sample
      • /tasks/view
      • /tasks/reschedule
      • /tasks/delete
      • /tasks/report
      • /tasks/screenshots
      • /tasks/rereport
      • /tasks/reboot
      • /memory/list
      • /memory/get
      • /files/view
      • /files/get
      • /pcap/get
      • /machines/list
      • /machines/view
      • /cuckoo/status
      • /vpn/status
      • /exit
  • Distributed Cuckoo
    • Starting the Distributed REST API
    • Distributed Cuckoo Configuration
      • Report Formats
      • Samples Directory
      • Reports Directory
    • RESTful resources
      • GET /api/node
      • POST /api/node
      • GET /api/node/<name>
      • PUT /api/node/<name>
      • POST /api/node/<name>/refresh
      • DELETE /api/node/<name>
      • GET /api/task
      • POST /api/task
      • GET /api/task/<id>
      • DELETE /api/task/<id>
      • GET /api/report/<id>/<format>
    • Proposed setup
      • Configuration settings
        • conf/cuckoo.conf
        • conf/processing.conf
        • conf/reporting.conf
        • conf/virtualbox.conf
      • Setup Cuckoo
      • Setup Distributed Cuckoo
      • Register Cuckoo nodes
    • Quick usage
  • 工具
    • Cuckoo Apps
    • Submission Utility
    • Web Utility
    • Processing Utility
    • Community Download Utility
    • Database migration utility
    • Stats utility
    • Machine utility
    • Distributed scripts
    • Mac OS X Bootstrap scripts
    • SMTP Sinkhole
    • Setup script
  • Cuckoo Rooter
    • Virtualenv
    • Cuckoo Rooter Usage
  • Cuckoo Feedback
  • Analysis Packages
  • Analysis Results
    • analysis.log
    • dump.pcap
    • dump_sorted.pcap
    • memory.dmp
    • files/
    • files.json
    • logs/
    • reports/
    • shots/
    • tlsmaster.txt
  • Clean all Tasks and Samples
• Customization
  • Auxiliary Modules
  • Machinery Modules
    • Configuration
    • LibVirt
  • Analysis Packages
    • Getting started
      • start()
      • check()
      • execute()
      • finish()
    • Options
    • Process API
      • Methods
  • Processing Modules
    • Global Container
    • Getting started
  • Signatures
    • Getting started
    • Creating your new signature
    • Evented Signatures
    • Marks & Helpers
  • Reporting Modules
    • Getting Started
• Development
  • Development Notes
    • Git branches
    • Release Versioning
    • Ticketing system
    • Contribute
  • Coding Style
    • Formatting
      • Copyright header
      • Indentation
      • Maximum Line Length
      • Blank Lines
      • Imports
      • Strings
      • Printing and Logging
    • Exceptions
      • Naming
      • Exception handling
    • Documentation
    • Automated testing
  • Development with the Python Package
  • Frontend
    • NPM Executables
    • Transpiling/Compiling
    • Creating new tasks
  • Developing with Pycharm
    • Cuckoo Web
      • Locations and concepts
      • Running and debugging
      • JavaScript transpiling
      • Testing
• Final Remarks
  • Links
  • Join the discussion
  • Support Us
  • People
    • Active Developers
    • Contributors
  • Supporters