├── .codeclimate.yml ├── .gitignore ├── .travis.yml ├── LICENSE ├── README.md ├── agent ├── agent.py └── agent.sh ├── analyzer ├── __init__.py ├── android │ ├── __init__.py │ ├── analyzer.py │ ├── config │ │ └── hooks.json │ ├── lib │ │ ├── __init__.py │ │ ├── api │ │ │ ├── __init__.py │ │ │ ├── adb.py │ │ │ └── screenshot.py │ │ ├── common │ │ │ ├── __init__.py │ │ │ ├── abstracts.py │ │ │ ├── constants.py │ │ │ ├── exceptions.py │ │ │ ├── results.py │ │ │ └── utils.py │ │ └── core │ │ │ ├── __init__.py │ │ │ ├── config.py │ │ │ ├── packages.py │ │ │ └── startup.py │ └── modules │ │ ├── __init__.py │ │ ├── auxiliary │ │ ├── __init__.py │ │ └── screenshots.py │ │ └── packages │ │ ├── __init__.py │ │ ├── apk.py │ │ └── default_browser.py ├── darwin │ ├── __init__.py │ ├── analyzer.py │ ├── lib │ │ ├── __init__.py │ │ ├── api │ │ │ ├── __init__.py │ │ │ └── screenshot.py │ │ ├── common │ │ │ ├── __init__.py │ │ │ ├── abstracts.py │ │ │ ├── config.py │ │ │ ├── exceptions.py │ │ │ ├── hashing.py │ │ │ ├── rand.py │ │ │ └── results.py │ │ ├── core │ │ │ ├── __init__.py │ │ │ ├── constants.py │ │ │ ├── data │ │ │ │ ├── signatures.yml │ │ │ │ └── types.yml │ │ │ ├── filetimes.py │ │ │ ├── host.py │ │ │ ├── osx.py │ │ │ └── packages.py │ │ └── dtrace │ │ │ ├── __init__.py │ │ │ ├── apicalls.d │ │ │ ├── apicalls.py │ │ │ ├── autoprobes.py │ │ │ ├── common.py │ │ │ ├── dtruss.py │ │ │ ├── dtruss.sh │ │ │ ├── follow_children.d │ │ │ ├── ipconnections.d │ │ │ └── ipconnections.py │ └── modules │ │ ├── __init__.py │ │ ├── auxiliary │ │ ├── __init__.py │ │ └── screenshots.py │ │ └── packages │ │ ├── __init__.py │ │ ├── app.py │ │ ├── bash.py │ │ ├── macho.py │ │ └── zip.py ├── linux │ ├── analyzer.py │ ├── lib │ │ ├── __init__.py │ │ ├── api │ │ │ ├── __init__.py │ │ │ └── process.py │ │ ├── common │ │ │ ├── __init__.py │ │ │ ├── abstracts.py │ │ │ ├── constants.py │ │ │ ├── exceptions.py │ │ │ ├── hashing.py │ │ │ ├── results.py │ │ │ └── utils.py │ │ └── core │ │ │ ├── __init__.py │ │ │ ├── config.py │ │ │ └── startup.py │ └── modules │ │ ├── __init__.py │ │ ├── auxiliary │ │ ├── __init__.py │ │ ├── lkm.py │ │ └── stap.py │ │ └── packages │ │ ├── __init__.py │ │ └── generic.py └── windows │ ├── analyzer.py │ ├── bin │ └── execsc.exe │ ├── lib │ ├── __init__.py │ ├── api │ │ ├── __init__.py │ │ ├── process.py │ │ └── screenshot.py │ ├── common │ │ ├── __init__.py │ │ ├── abstracts.py │ │ ├── constants.py │ │ ├── defines.py │ │ ├── errors.py │ │ ├── exceptions.py │ │ ├── hashing.py │ │ ├── rand.py │ │ ├── registry.py │ │ └── results.py │ └── core │ │ ├── __init__.py │ │ ├── config.py │ │ ├── packages.py │ │ ├── pipe.py │ │ ├── privileges.py │ │ └── startup.py │ └── modules │ ├── __init__.py │ ├── auxiliary │ ├── __init__.py │ ├── disguise.py │ ├── dumptls.py │ ├── human.py │ ├── installcert.py │ ├── procmon.py │ ├── reboot.py │ ├── recentfiles.py │ └── screenshots.py │ └── packages │ ├── __init__.py │ ├── applet.py │ ├── bin.py │ ├── com.py │ ├── cpl.py │ ├── dll.py │ ├── doc.py │ ├── exe.py │ ├── ff.py │ ├── generic.py │ ├── ie.py │ ├── jar.py │ ├── js.py │ ├── msi.py │ ├── pdf.py │ ├── ppt.py │ ├── ps1.py │ ├── pub.py │ ├── python.py │ ├── reboot.py │ ├── vbs.py │ ├── wsf.py │ ├── xls.py │ └── zip.py ├── conf ├── auxiliary.conf ├── avd.conf ├── cuckoo.conf ├── esx.conf ├── kvm.conf ├── memory.conf ├── misp.json ├── physical.conf ├── processing.conf ├── qemu.conf ├── reporting.conf ├── virtualbox.conf ├── vmware.conf ├── vpn.conf ├── vsphere.conf └── xenserver.conf ├── cuckoo.py ├── cuckoo └── distributed │ └── .vs │ ├── VSWorkspaceState.json │ └── slnx.sqlite ├── data ├── __init__.py ├── android │ ├── anti-vm │ │ ├── fake-build.prop │ │ ├── fake-cpuinfo │ │ └── fake-drivers │ ├── apps │ │ ├── ImportContacts.apk │ │ ├── Superuser.apk │ │ └── de.robv.android.xposed.installer_v33_36570c.apk │ ├── binaries │ │ └── su │ ├── create_guest_avd.sh │ └── hooking │ │ ├── Droidmon.apk │ │ └── EmulatorAntiDetect.apk ├── elasticsearch │ └── template.json ├── gatherer.py ├── guids.txt ├── html │ ├── base-report.html │ ├── base-web.html │ ├── browse.html │ ├── css │ │ ├── bootstrap-responsive.min.css │ │ └── bootstrap.min.css │ ├── error.html │ ├── graphic │ │ └── logo.html │ ├── img │ │ ├── glyphicons-halflings-white.png │ │ └── glyphicons-halflings.png │ ├── js │ │ ├── bootstrap.min.js │ │ ├── functions.js │ │ └── jquery.min.js │ ├── pagination-menu.html │ ├── pagination-rpp.html │ ├── report.html │ ├── sections │ │ ├── behavior.html │ │ ├── dropped.html │ │ ├── errors.html │ │ ├── file.html │ │ ├── info.html │ │ ├── network.html │ │ ├── screenshots.html │ │ ├── signatures.html │ │ ├── static.html │ │ ├── url.html │ │ └── volatility.html │ ├── submit.html │ └── success.html ├── mitm.py ├── monitor │ ├── 14b2b875dbfa50d19f5967c4b150a7a2e9465e39 │ │ ├── inject-x64.exe │ │ ├── inject-x86.exe │ │ ├── is32bit.exe │ │ ├── monitor-x64.dll │ │ └── monitor-x86.dll │ ├── 2904ecd8163e96db69fe2ac8f48c5935e194fb08 │ │ ├── inject-x64.exe │ │ ├── inject-x86.exe │ │ ├── is32bit.exe │ │ ├── monitor-x64.dll │ │ └── monitor-x86.dll │ └── latest ├── peutils │ └── UserDB.TXT ├── src │ └── binpackage │ │ ├── Makefile │ │ └── execsc.c ├── strace.stp ├── test-internet.vbs ├── whitelist │ ├── domain.txt │ ├── ip.txt │ ├── url.txt │ └── url_regex.txt └── yara │ ├── binaries │ ├── embedded.yar │ ├── shellcodes.yar │ └── vmdetect.yar │ ├── memory │ ├── .gitignore │ └── index_memory.yar │ └── urls │ └── .gitignore ├── distributed ├── alembic.ini ├── app.py ├── distributed │ ├── __init__.py │ ├── api.py │ ├── app.py │ ├── db.py │ ├── exception.py │ └── views │ │ ├── __init__.py │ │ └── api.py ├── instance.py ├── migration │ ├── env.py │ ├── script.py.mako │ └── versions │ │ ├── 151400d38e03_node_status_timestamp_index.py │ │ ├── 166078eb1311_change_node_id_to_name.py │ │ ├── 2aa59981b59d_node_task_not_unique.py │ │ ├── 37c08c9655bb_initial_database.py │ │ ├── 3cc1509b7fdc_node_status.py │ │ ├── 3d1d8fd2cdbb_timestamps.py │ │ ├── 4b86bc0d40aa_node_mode.py │ │ ├── 4d0a2590e997_node_task_index.py │ │ └── 69ecf07a99b_finished_to_status.py ├── requirements.txt └── settings.py ├── docker ├── suricata │ ├── Dockerfile │ ├── repositories │ ├── requirements.txt │ ├── suri.py │ └── suricata.yaml └── yara │ ├── Dockerfile │ ├── requirements.txt │ └── yara2es.py ├── docs ├── AUTHORS ├── CHANGELOG ├── LICENSE ├── README └── book │ └── src │ ├── Makefile │ ├── _images │ ├── logo │ │ └── cuckoo.png │ ├── schemas │ │ └── architecture-main.png │ └── screenshots │ │ ├── error_template_rendering.png │ │ ├── fog_host_management.png │ │ ├── fog_image_management.png │ │ ├── fog_scheduled_job.png │ │ ├── shared_folders.png │ │ ├── unsupported_method.png │ │ ├── windows_network.png │ │ ├── windows_registry.png │ │ └── windows_security.png │ ├── conf.py │ ├── customization │ ├── auxiliary.rst │ ├── index.rst │ ├── machinery.rst │ ├── packages.rst │ ├── processing.rst │ ├── reporting.rst │ └── signatures.rst │ ├── development │ ├── code_style.rst │ ├── development_notes.rst │ └── index.rst │ ├── faq │ └── index.rst │ ├── finalremarks │ └── index.rst │ ├── index.rst │ ├── installation │ ├── guest │ │ ├── agent.rst │ │ ├── cloning.rst │ │ ├── creation.rst │ │ ├── index.rst │ │ ├── linux.rst │ │ ├── network.rst │ │ ├── requirements.rst │ │ └── saving.rst │ ├── guest_physical │ │ ├── creation.rst │ │ ├── index.rst │ │ ├── network.rst │ │ ├── requirements.rst │ │ └── saving.rst │ ├── host │ │ ├── configuration.rst │ │ ├── configuration_android.rst │ │ ├── index.rst │ │ ├── installation.rst │ │ └── requirements.rst │ ├── index.rst │ └── upgrade.rst │ ├── introduction │ ├── index.rst │ ├── license.rst │ ├── sandboxing.rst │ └── what.rst │ └── usage │ ├── api.rst │ ├── clean.rst │ ├── dist.rst │ ├── index.rst │ ├── packages.rst │ ├── results.rst │ ├── start.rst │ ├── submit.rst │ ├── utilities.rst │ └── web.rst ├── install ├── conf │ ├── cuckoo.conf │ ├── processing.conf │ ├── reporting.conf │ └── virtualbox.conf ├── crontab │ ├── crontab.template │ ├── crontab_root.template │ └── scripts │ │ ├── cuckoo │ │ ├── clean_mem.sh │ │ ├── del_memdump_from_reported.sh │ │ ├── openvpn_keepalive.sh │ │ └── optimize.sh │ │ └── root │ │ ├── cuckoo_full_restart.sh │ │ ├── cuckoo_monitor.sh │ │ ├── nord_route.sh │ │ └── openvpn_route.sh ├── cuckoo_install_vms.sh ├── docker-misp │ └── container │ │ ├── Dockerfile │ │ └── supervisord.conf ├── docker │ ├── crits │ │ └── Dockerfile │ ├── docker-compose.yml │ ├── elastic │ │ ├── docker.template │ │ ├── elastic.template │ │ ├── fail2ban.template │ │ ├── httpd.template │ │ ├── hunt.template │ │ ├── iptables.template │ │ ├── linux.template │ │ ├── mongostats.template │ │ └── suricata.template │ ├── grafana │ │ ├── configure_grafana.py │ │ ├── dashboard.json │ │ ├── es-monitoring.json │ │ ├── mongo-dashboard.json │ │ └── mongo-stats.json │ └── viper │ │ └── Dockerfile ├── elasticsearch2elastic.py ├── httpd │ ├── cuckoo.conf │ └── rev_proxy.conf ├── init.d │ ├── cuckoo_all │ ├── cuckooapi │ ├── cuckood │ ├── cuckoop │ ├── cuckoorooter │ └── cuckooweb ├── kibana │ ├── kibana_data.json │ └── kibana_mapping.json ├── moloch │ ├── config.ini │ └── viewer.js ├── mongodb │ └── mongod.conf ├── mysql │ └── mysqld.cnf ├── openvpn │ ├── readme │ └── readme.md ├── rc.local_template ├── rsyslog │ ├── 10-phoenix.conf │ ├── auth.rules │ ├── fail2ban.rules │ ├── iptables.rules │ └── rsyslog.conf ├── screencaps │ ├── 1.png │ ├── 2.png │ ├── 3.png │ ├── 4.png │ ├── 5.png │ ├── 6.png │ ├── SharingGroups1.png │ ├── SharingGroups2.png │ ├── SharingGroups3.png │ ├── SharingGroups4.png │ ├── Tags1.PNG │ ├── Tags2.png │ ├── Tags3.png │ ├── analysis_1.png │ ├── analysis_2.png │ ├── correlation.png │ ├── cuckoo_complete.png │ ├── full_restart.png │ ├── grafana_es.png │ ├── grafana_mongo.png │ ├── iptables4.png │ ├── iptables6.png │ ├── kibana_iptables.png │ ├── kibana_web_all.png │ ├── kibana_web_errors.png │ ├── kibana_web_normal.png │ ├── misp1.png │ ├── misp2.png │ ├── misp3.png │ ├── misp4.png │ ├── misp5.png │ ├── misp6.png │ ├── misp7.png │ ├── misp_viz.png │ ├── moloch.png │ ├── netdata.png │ ├── recents.png │ ├── submit.png │ ├── vboxlic.png │ └── vpnconf.PNG ├── ubuntu_install.sh └── virtualbox │ ├── limits.conf_template │ ├── readme │ └── readme.md ├── lib ├── __init__.py ├── api_fingerprint │ ├── __init__.py │ ├── api_fingerprint.py │ ├── api_profiles.json │ └── profile_generator.py ├── bluecoat_sitereview │ ├── __init__.py │ └── bluecoat_sitereview.py ├── cuckoo │ ├── __init__.py │ ├── common │ │ ├── __init__.py │ │ ├── abstracts.py │ │ ├── colors.py │ │ ├── compare.py │ │ ├── config.py │ │ ├── constants.py │ │ ├── defines.py │ │ ├── dns.py │ │ ├── exceptions.py │ │ ├── irc.py │ │ ├── logo.py │ │ ├── netlog.py │ │ ├── objects.py │ │ ├── utils.py │ │ ├── virustotal.py │ │ └── whitelist.py │ ├── core │ │ ├── __init__.py │ │ ├── database.py │ │ ├── guest.py │ │ ├── log.py │ │ ├── plugins.py │ │ ├── resultserver.py │ │ ├── rooter.py │ │ ├── scheduler.py │ │ └── startup.py │ └── misc.py ├── phoenix │ ├── HighLowSemaphore.py │ ├── __init__.py │ ├── constants.py │ └── rule_reader.py └── tldr │ ├── __init__.py │ ├── cli │ ├── crls │ ├── prefix │ ├── search │ └── tldr.py ├── modules ├── __init__.py ├── auxiliary │ ├── __init__.py │ ├── mitm.py │ ├── reboot.py │ ├── services.py │ └── sniffer.py ├── machinery │ ├── __init__.py │ ├── avd.py │ ├── esx.py │ ├── kvm.py │ ├── physical.py │ ├── qemu.py │ ├── virtualbox.py │ ├── vmware.py │ ├── vsphere.py │ └── xenserver.py ├── processing │ ├── __init__.py │ ├── analysisinfo.py │ ├── apkinfo.py │ ├── baseline.py │ ├── behavior.py │ ├── buffer.py │ ├── cobalt_strike_beacon.py │ ├── debug.py │ ├── droidmon.py │ ├── dropped.py │ ├── dumptls.py │ ├── googleplay.py │ ├── irma.py │ ├── memory.py │ ├── misp.py │ ├── network.py │ ├── platform │ │ ├── __init__.py │ │ ├── linux.py │ │ └── windows.py │ ├── procmemory.py │ ├── procmon.py │ ├── screenshots.py │ ├── snort.py │ ├── static.py │ ├── strings.py │ ├── suricata.py │ ├── targetinfo.py │ └── virustotal.py ├── reporting │ ├── __init__.py │ ├── elasticsearch.py │ ├── jsondump.py │ ├── mattermost.py │ ├── moloch.py │ ├── mongodb.py │ ├── notification.py │ ├── reporthtml.py │ ├── z_misp.py │ └── zz_file_indexing.py └── signatures │ ├── __init__.py │ ├── creates_exe.py │ └── generic_metrics.py ├── requirements.txt ├── tests ├── abstracts_tests.py ├── assets │ ├── probes │ │ └── test_probes_integration.d.reference │ ├── test_apicalls_basic.c │ ├── test_apicalls_children.c │ ├── test_apicalls_children_root.c │ ├── test_apicalls_errno.c │ ├── test_apicalls_errno_root.c │ ├── test_apicalls_from_dynamic_library.c │ ├── test_apicalls_from_dynamic_library_root.c │ ├── test_apicalls_root.c │ ├── test_apicalls_timeout.c │ ├── test_apicalls_timeout_root.c │ ├── test_apicalls_with_args.c │ ├── test_apicalls_with_args_root.c │ ├── test_apicalls_without_target.c │ ├── test_cuckoo_dropped_files │ ├── test_cuckoo_dropped_files.c │ ├── test_cuckoo_parents_and_children │ ├── test_cuckoo_parents_and_children.c │ ├── test_dtruss_children.c │ ├── test_dtruss_helloworld.c │ ├── test_dtruss_non_root.c │ ├── test_dtruss_root.c │ ├── test_dtruss_specific_syscall.c │ ├── test_dtruss_timeout.c │ ├── test_dtruss_with_args.c │ ├── test_dtruss_without_target.c │ ├── test_ipconnections_empty.c │ ├── test_ipconnections_target_with_args.c │ ├── test_ipconnections_tcp.c │ ├── test_ipconnections_tcp_with_timeout.c │ └── test_ipconnections_udp.c ├── colors_tests.py ├── common.py ├── config_tests.py ├── database_tests.py ├── integrity.py ├── objects_tests.py ├── processor_tests.py ├── reporter_tests.py ├── sniffer_tests.py ├── test_analyzer.py ├── test_apicalls.py ├── test_cuckoo.py ├── test_dtruss.py ├── test_ipconnections.py ├── test_packages.py ├── test_probesgenerator.py └── utils_tests.py ├── update_phoenix.sh ├── utils ├── api.py ├── api_wsgi.py ├── auto_submit.py ├── community.py ├── darwin │ ├── bootstrap_guest.sh │ └── bootstrap_host.sh ├── db_migration │ ├── alembic.ini │ ├── env.py │ ├── script.py.mako │ └── versions │ │ ├── create_filepath_table.py │ │ ├── from_0_6_to_1_1.py │ │ ├── from_1_1_to_1_2-added_states.py │ │ ├── from_1_1_to_1_2-extend_file_type.py │ │ ├── from_1_2_to_1_3-add_task_owner.py │ │ ├── from_1_2_to_2_0-guest_status.py │ │ ├── from_1_2_to_2_0-machine_options.py │ │ ├── from_1_2_to_2_0-processing-column.py │ │ └── from_1_2_to_2_0-taken-route.py ├── dnsserve.py ├── elasticsearch2elastic.py ├── fix_openvpn.sh ├── init │ ├── cuckoo_all │ ├── cuckooapi │ ├── cuckood │ ├── cuckoop │ ├── cuckoorooter │ └── cuckooweb ├── load_filepaths_to_mysql.py ├── load_mongo_into_elastic.py ├── machine.py ├── migrate_users.py ├── mongo_stats.sh ├── nw.sh ├── process.py ├── process2.py ├── rawdb.py ├── rooter.py ├── searchMISP.py ├── service.sh ├── setup.sh ├── setup_user.py ├── smtp_sinkhole.py ├── so_watcher │ ├── rules │ │ └── watcher_rules.yar │ └── so_watcher.py ├── start-distributed.sh ├── stats.py ├── stop-distributed.sh ├── submit.py ├── submitters │ ├── __init__.py │ ├── a10002phoenix.py │ └── vt_autosubmit.py ├── suricata.sh └── vpncheck.py └── web ├── .gitignore ├── __init__.py ├── advanced_search ├── __init__.py ├── search │ ├── fields.json │ └── search.js ├── urls.py └── views.py ├── analysis ├── __init__.py ├── forms.py ├── migrations │ ├── 0001_initial.py │ ├── 0002_publishers.py │ ├── 0003_merge.py │ └── __init__.py ├── models.py ├── search │ ├── fields.json │ └── search.js ├── templatetags │ ├── __init__.py │ └── analysis_tags.py ├── urls.py └── views.py ├── compare ├── __init__.py ├── urls.py └── views.py ├── dashboard ├── __init__.py ├── urls.py └── views.py ├── helpers.py ├── hunting ├── __init__.py ├── urls.py └── views.py ├── manage.py ├── start.sh ├── static ├── css │ ├── bootstrap.min.css │ ├── buttons.dataTables.min.css │ ├── jquery.dataTables.css │ ├── lightbox.css │ ├── query-builder.default.min.css │ ├── responsive.dataTables.min.css │ ├── select.dataTables.min.css │ └── style.css ├── fonts │ ├── glyphicons-halflings-regular.eot │ ├── glyphicons-halflings-regular.svg │ ├── glyphicons-halflings-regular.ttf │ ├── glyphicons-halflings-regular.woff │ └── glyphicons-halflings-regular.woff2 ├── graphic │ ├── background.png │ ├── cuckoo.png │ └── cuckoo_inverse.png ├── images │ ├── SparkIT_grayscale.png │ ├── green_check.png │ ├── intelligence-small.png │ ├── newtab.png │ ├── newtab_32.png │ ├── newtab_white.png │ ├── red_cross.png │ ├── reversinglabs.png │ ├── sort_asc.png │ ├── sort_asc_disabled.png │ ├── sort_both.png │ ├── sort_desc.png │ ├── sort_desc_disabled.png │ └── virustotal.png ├── img │ ├── close.png │ ├── loader_gifs │ │ ├── ball_loader.gif │ │ ├── gallery_loader.gif │ │ ├── sausage_loader.gif │ │ ├── spinning_head_loader.gif │ │ └── wave_loader.gif │ ├── loading.gif │ ├── next.png │ └── prev.png └── js │ ├── ColReorderWithResize.js │ ├── app.js │ ├── bootstrap-fileupload.js │ ├── bootstrap.min.js │ ├── buttons.html5.min.js │ ├── dataTables.buttons.min.js │ ├── dataTables.responsive.js │ ├── dataTables.responsive.min.js │ ├── dataTables.select.min.js │ ├── datetime-moment.js │ ├── hexdump.js │ ├── jquery.dataTables.js │ ├── jquery.js │ ├── jszip.min.js │ ├── lightbox.js │ ├── moment.min.js │ ├── pdfmake.min.js │ ├── query-builder-elasticsearch.js │ └── query-builder.standalone.min.js ├── submission ├── __init__.py ├── urls.py └── views.py ├── templates ├── advanced_search │ └── index.html ├── analysis │ ├── admin │ │ └── index.html │ ├── behavior │ │ ├── _api_call.html │ │ ├── _chunk.html │ │ ├── _processes.html │ │ ├── _search.html │ │ ├── _search_results.html │ │ ├── _tree.html │ │ ├── _tree_process.html │ │ └── index.html │ ├── buffers │ │ └── index.html │ ├── dropped │ │ └── index.html │ ├── export.html │ ├── import.html │ ├── index.html │ ├── memory │ │ ├── _apihooks.html │ │ ├── _callbacks.html │ │ ├── _devicetree.html │ │ ├── _gdt.html │ │ ├── _idt.html │ │ ├── _malfind.html │ │ ├── _messagehooks.html │ │ ├── _modscan.html │ │ ├── _netscan.html │ │ ├── _pslist.html │ │ ├── _sockscan.html │ │ ├── _ssdt.html │ │ ├── _svcscan.html │ │ ├── _timers.html │ │ ├── _yarascan.html │ │ └── index.html │ ├── misp │ │ └── index.html │ ├── network │ │ ├── _dns.html │ │ ├── _hosts.html │ │ ├── _http.html │ │ ├── _icmp.html │ │ ├── _irc.html │ │ ├── _snort.html │ │ ├── _suricata.html │ │ ├── _tcp.html │ │ ├── _udp.html │ │ └── index.html │ ├── overview │ │ ├── _file.html │ │ ├── _info.html │ │ ├── _screenshots.html │ │ ├── _signatures.html │ │ ├── _summary.html │ │ ├── _url.html │ │ └── index.html │ ├── pending.html │ ├── procmemory │ │ └── index.html │ ├── report.html │ ├── search.html │ ├── search_results.html │ └── static │ │ ├── _antivirus.html │ │ ├── _irma.html │ │ ├── _office.html │ │ ├── _pdf.html │ │ ├── _pe32.html │ │ ├── _strings.html │ │ └── index.html ├── base.html ├── compare │ ├── _info.html │ ├── _summary_table.html │ ├── both.html │ ├── hash.html │ └── left.html ├── dashboard │ └── index.html ├── error.html ├── footer.html ├── header.html ├── hunting │ ├── index.html │ ├── output_templates │ │ ├── suricata.html │ │ └── yara.html │ ├── report.html │ └── status.html ├── registration │ └── login.html ├── standalone_error.html ├── submission │ ├── complete.html │ ├── index.html │ ├── reboot.html │ └── status.html └── success.html └── web ├── __init__.py ├── admin.py ├── dev_settings.py ├── headers.py ├── local_settings.py ├── settings.py ├── tlp_methods.py ├── urls.py └── wsgi.py /.codeclimate.yml: -------------------------------------------------------------------------------- 1 | languages: 2 | Python: true 3 | exclude_paths: 4 | - "tests/*" 5 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Ignore Cuckoo Database 2 | db/cuckoo.db 3 | 4 | # Ignore Cuckoo logs 5 | log/*.log 6 | 7 | # Ignore Cuckoo analyses 8 | storage/* 9 | 10 | # Ignore Python byte code 11 | *.pyc 12 | 13 | # Ignore certificates 14 | *.pem 15 | *.cert 16 | 17 | # Ignore OS generated files 18 | .DS_Store* 19 | .AppleDouble 20 | ehthumbs.db 21 | Icon? 22 | Thumbs.db 23 | 24 | # Ignore development files 25 | docs/book/src/_build/ 26 | .idea/ 27 | .project 28 | .pydevproject 29 | 30 | # Ignore Django secret_key 31 | web/web/secret_key.py 32 | 33 | # Ignore yara rules 34 | data/yara/index_*.yar 35 | 36 | # Ignore venv 37 | venv 38 | 39 | # Python package stuff 40 | lib/python2.7/ 41 | build/ 42 | modules/signatures/ 43 | agent/android/ 44 | analyzer/windows/bin/procmon.pmc 45 | docs/book/ 46 | docs/epydoc/ 47 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | branches: 2 | only: 3 | - master 4 | language: python 5 | python: 6 | - 2.7 7 | before_install: 8 | - sudo apt-get update -qq 9 | - sudo apt-get install python-dev python-libvirt libffi-dev libssl-dev libxml2-dev libxslt1-dev 10 | - wget http://downloads.sourceforge.net/project/ssdeep/ssdeep-2.12/ssdeep-2.12.tar.gz 11 | - tar -zxvf ssdeep-2.12.tar.gz 12 | - cd ssdeep-2.12 13 | - ./configure && make 14 | - sudo make install 15 | - cd .. 16 | install: 17 | - pip install -r requirements.txt 18 | script: 19 | - python utils/community.py -wafb monitor 20 | - python cuckoo.py --debug --test 21 | #- nosetests 22 | -------------------------------------------------------------------------------- /agent/agent.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Copyright (C) 2010-2013 Claudio Guarnieri. 3 | # Copyright (C) 2014-2016 Cuckoo Foundation. 4 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 5 | # See the file 'docs/LICENSE' for copying permission. 6 | 7 | FILEPATH=$(readlink -f ${0%}) 8 | FILEPATHDIR=$(dirname $FILEPATH) 9 | 10 | cd /tmp/ 11 | python $FILEPATHDIR/agent.py >$FILEPATHDIR/agent.stdout 2>$FILEPATHDIR/agent.stderr & 12 | 13 | -------------------------------------------------------------------------------- /analyzer/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/__init__.py -------------------------------------------------------------------------------- /analyzer/android/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/lib/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/lib/api/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/lib/common/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/lib/common/constants.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | import os 7 | import string 8 | import random 9 | 10 | def _rand_string(a, b): 11 | return "".join(random.choice(string.ascii_lowercase) for x in xrange(random.randint(a, b))) 12 | 13 | ROOT = os.path.join("/data/local/tmp", _rand_string(6, 10)) 14 | 15 | PATHS = { 16 | "root" : ROOT, 17 | "logs" : os.path.join(ROOT, "logs"), 18 | "files" : os.path.join(ROOT, "files"), 19 | "shots" : os.path.join(ROOT, "shots"), 20 | "memory" : os.path.join(ROOT, "memory"), 21 | "drop" : os.path.join(ROOT, "drop") 22 | } 23 | -------------------------------------------------------------------------------- /analyzer/android/lib/common/exceptions.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | class CuckooError(Exception): 7 | pass 8 | 9 | class CuckooPackageError(Exception): 10 | pass 11 | -------------------------------------------------------------------------------- /analyzer/android/lib/common/utils.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | from lib.common.results import NetlogFile 7 | 8 | def send_file(name, data): 9 | """Send file to result server""" 10 | nf = NetlogFile(name) 11 | nf.sock.sendall(data) 12 | nf.close() 13 | -------------------------------------------------------------------------------- /analyzer/android/lib/core/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/lib/core/config.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | import ConfigParser 7 | 8 | class Config: 9 | def __init__(self, cfg): 10 | """@param cfg: configuration file.""" 11 | config = ConfigParser.ConfigParser(allow_no_value=True) 12 | config.read(cfg) 13 | 14 | for section in config.sections(): 15 | for name, raw_value in config.items(section): 16 | try: 17 | value = config.getboolean(section, name) 18 | except ValueError: 19 | try: 20 | value = config.getint(section, name) 21 | except ValueError: 22 | value = config.get(section, name) 23 | 24 | setattr(self, name, value) 25 | -------------------------------------------------------------------------------- /analyzer/android/lib/core/packages.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | def choose_package(file_type, file_name): 7 | """Choose analysis package due to file type and file extension. 8 | @param file_type: file type. 9 | @return: package or None. 10 | """ 11 | if not file_type: 12 | return None 13 | 14 | file_type = file_type.lower() 15 | file_name = file_name.lower() 16 | 17 | if "apk" in file_name: 18 | return "apk" 19 | elif "zip" in file_type: 20 | return "apk" 21 | # elif "DEX" in file_type: 22 | # return "dex" 23 | else: 24 | return "apk" 25 | -------------------------------------------------------------------------------- /analyzer/android/lib/core/startup.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | import os 7 | import logging 8 | 9 | from lib.common.constants import PATHS 10 | from lib.common.results import NetlogHandler 11 | 12 | log = logging.getLogger() 13 | 14 | def create_folders(): 15 | """Create folders in PATHS.""" 16 | for name, folder in PATHS.items(): 17 | if os.path.exists(folder): 18 | continue 19 | 20 | try: 21 | os.makedirs(folder) 22 | except OSError: 23 | pass 24 | 25 | def init_logging(): 26 | """Initialize logger.""" 27 | formatter = logging.Formatter("%(asctime)s [%(name)s] %(levelname)s: %(message)s") 28 | sh = logging.StreamHandler() 29 | sh.setFormatter(formatter) 30 | log.addHandler(sh) 31 | 32 | nh = NetlogHandler() 33 | nh.setFormatter(formatter) 34 | log.addHandler(nh) 35 | 36 | log.setLevel(logging.DEBUG) 37 | -------------------------------------------------------------------------------- /analyzer/android/modules/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/modules/packages/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | -------------------------------------------------------------------------------- /analyzer/android/modules/packages/apk.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | import logging 7 | 8 | from lib.api.adb import dump_droidmon_logs, execute_sample, install_sample 9 | from lib.common.abstracts import Package 10 | 11 | log = logging.getLogger(__name__) 12 | 13 | class Apk(Package): 14 | """Apk analysis package.""" 15 | def __init__(self, options={}): 16 | super(Apk, self).__init__(options) 17 | 18 | self.package, self.activity = options.get("apk_entry", ":").split(":") 19 | 20 | def start(self, path): 21 | install_sample(path) 22 | execute_sample(self.package, self.activity) 23 | 24 | def check(self): 25 | return True 26 | 27 | def finish(self): 28 | dump_droidmon_logs(self.package) 29 | return True 30 | -------------------------------------------------------------------------------- /analyzer/android/modules/packages/default_browser.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | # Originally contributed by Check Point Software Technologies, Ltd. 5 | 6 | from lib.common.abstracts import Package 7 | from lib.api.adb import execute_browser 8 | 9 | class default_browser(Package): 10 | """Default Browser analysis package.""" 11 | def __init__(self, options={}): 12 | super(default_browser, self).__init__(options) 13 | 14 | def start(self, target): 15 | execute_browser(target) 16 | 17 | def check(self): 18 | return True 19 | 20 | def finish(self): 21 | return True 22 | -------------------------------------------------------------------------------- /analyzer/darwin/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/lib/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/lib/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/lib/api/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/common/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/common/abstracts.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | class Auxiliary(object): 7 | def __init__(self, options={}, analyzer=None): 8 | self.options = options 9 | self.analyzer = analyzer 10 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/common/exceptions.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | class CuckooError(Exception): 7 | pass 8 | 9 | class CuckooPackageError(Exception): 10 | pass 11 | 12 | class CuckooDisableModule(CuckooError): 13 | """Exception for disabling a module dynamically.""" 14 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/common/hashing.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | BUFSIZE = 1024*1024 6 | 7 | 8 | def hash_file(method, path): 9 | """Calculates an hash on a file by path. 10 | @param method: callable hashing method 11 | @param path: file path 12 | @return: computed hash string 13 | """ 14 | f = open(path, "rb") 15 | h = method() 16 | while True: 17 | buf = f.read(BUFSIZE) 18 | if not buf: 19 | break 20 | h.update(buf) 21 | return h.hexdigest() 22 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/common/rand.py: -------------------------------------------------------------------------------- 1 | import random 2 | import string 3 | 4 | def random_string(minimum, maximum=None): 5 | if maximum is None: 6 | maximum = minimum 7 | 8 | count = random.randint(minimum, maximum) 9 | return "".join(random.choice(string.ascii_letters) for x in xrange(count)) 10 | 11 | def random_integer(digits): 12 | start = 10 ** (digits - 1) 13 | end = (10 ** digits) - 1 14 | return random.randint(start, end) 15 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/core/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/lib/core/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/lib/core/constants.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | from tempfile import gettempdir 7 | from ..common.rand import random_string 8 | 9 | ROOT = os.path.join(gettempdir() + os.sep, random_string(6, 10)) 10 | 11 | PATHS = { 12 | "root" : ROOT, 13 | "logs" : os.path.join(ROOT, "logs"), 14 | "files" : os.path.join(ROOT, "files"), 15 | "shots" : os.path.join(ROOT, "shots"), 16 | "memory" : os.path.join(ROOT, "memory"), 17 | "drop" : os.path.join(ROOT, "drop") 18 | } 19 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/core/osx.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | from os import system 7 | from datetime import datetime 8 | 9 | def set_wallclock(clock_str, **kwargs): 10 | clock = datetime.strptime(clock_str, "%Y%m%dT%H:%M:%S") 11 | # NOTE: On OS X there's `date` utility that accepts 12 | # new date/time as a string of the folowing format: 13 | # {month}{day}{hour}{minutes}{year}.{seconds} 14 | # where every {x} is a 2 digit number. 15 | cmd = "sudo date {0}".format(clock.strftime("%m%d%H%M%y.%S")) 16 | 17 | if "just_testing" in kwargs: 18 | return cmd 19 | else: 20 | system(cmd) 21 | -------------------------------------------------------------------------------- /analyzer/darwin/lib/dtrace/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/lib/dtrace/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/lib/dtrace/common.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | from os import path 7 | from time import sleep 8 | 9 | def sanitize_path(raw_path): 10 | """ Replace spaces with backslashes+spaces """ 11 | return raw_path.replace(" ", "\\ ") 12 | 13 | def path_for_script(script): 14 | """ Return the full path for the given script """ 15 | return path.join(current_directory(), script) 16 | 17 | def current_directory(): 18 | return path.dirname(path.abspath(__file__)) 19 | 20 | def filelines(source_file): 21 | """ A generator that returns lines of the file. 22 | If there're no new lines it waits until the file is updated. 23 | """ 24 | # Go to the end of the file 25 | source_file.seek(0, 2) 26 | while True: 27 | line = source_file.readline() 28 | if not line: 29 | # Sleep briefly 30 | sleep(0.1) 31 | continue 32 | yield line 33 | -------------------------------------------------------------------------------- /analyzer/darwin/modules/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/modules/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/modules/auxiliary/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/modules/packages/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/darwin/modules/packages/__init__.py -------------------------------------------------------------------------------- /analyzer/darwin/modules/packages/app.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | from os import system, path 7 | from plistlib import readPlist 8 | from lib.core.packages import Package 9 | 10 | class App(Package): 11 | """ OS X application analysys package. """ 12 | 13 | def prepare(self): 14 | # We'll launch an executable file of this .app directly, 15 | # but we need to know what it is, don't we? 16 | info = readPlist(path.join(self.target, "Contents", "Info.plist")) 17 | exe_name = info.get("CFBundleExecutable") 18 | if not exe_name: 19 | raise Exception("Could not locate an executable of the app bundle") 20 | 21 | self.target = path.join(self.target, "Contents", "MacOS", exe_name) 22 | # Make sure that our target is executable 23 | system("/bin/chmod +x \"%s\"" % self.target) 24 | -------------------------------------------------------------------------------- /analyzer/darwin/modules/packages/bash.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | from lib.core.packages import Package 7 | 8 | class Bash(Package): 9 | """ Bash shell script analysys package. """ 10 | 11 | def prepare(self): 12 | self.args = [self.target] + self.args 13 | self.target = "/bin/bash" 14 | -------------------------------------------------------------------------------- /analyzer/darwin/modules/packages/macho.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | from os import system 7 | from lib.core.packages import Package 8 | 9 | class Macho(Package): 10 | """ Mach-O executable analysys package. """ 11 | 12 | def prepare(self): 13 | # Make sure that our target is executable 14 | system("/bin/chmod +x \"%s\"" % self.target) 15 | -------------------------------------------------------------------------------- /analyzer/linux/lib/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/lib/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/lib/api/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/lib/api/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/lib/common/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/lib/common/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/lib/common/constants.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | import tempfile 7 | from lib.common.utils import random_string 8 | 9 | ROOT = os.path.join(tempfile.gettempdir(), random_string(6, 10)) 10 | 11 | PATHS = {"root" : ROOT, 12 | "logs" : os.path.join(ROOT, "logs"), 13 | "files" : os.path.join(ROOT, "files"), 14 | "shots" : os.path.join(ROOT, "shots"), 15 | "memory" : os.path.join(ROOT, "memory"), 16 | "drop" : os.path.join(ROOT, "drop")} 17 | -------------------------------------------------------------------------------- /analyzer/linux/lib/common/exceptions.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | class CuckooError(Exception): 6 | pass 7 | 8 | class CuckooPackageError(Exception): 9 | pass -------------------------------------------------------------------------------- /analyzer/linux/lib/common/hashing.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import hashlib 6 | 7 | BUFSIZE = 1024*1024 8 | 9 | def sha256_file(path): 10 | return hash_file(hashlib.sha256, path) 11 | 12 | def hash_file(method, path): 13 | """Calculates an hash on a file by path. 14 | @param method: callable hashing method 15 | @param path: file path 16 | @return: computed hash string 17 | """ 18 | f = open(path, "rb") 19 | h = method() 20 | while True: 21 | buf = f.read(BUFSIZE) 22 | if not buf: 23 | break 24 | h.update(buf) 25 | return h.hexdigest() 26 | -------------------------------------------------------------------------------- /analyzer/linux/lib/common/utils.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import random 6 | import string 7 | 8 | def random_string(minimum, maximum=None): 9 | if maximum is None: 10 | maximum = minimum 11 | 12 | count = random.randint(minimum, maximum) 13 | return "".join(random.choice(string.ascii_letters) for x in xrange(count)) 14 | 15 | def random_integer(digits): 16 | start = 10 ** (digits - 1) 17 | end = (10 ** digits) - 1 18 | return random.randint(start, end) 19 | -------------------------------------------------------------------------------- /analyzer/linux/lib/core/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/lib/core/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/lib/core/startup.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | import logging 7 | 8 | from lib.common.constants import PATHS 9 | from lib.common.results import NetlogHandler 10 | 11 | log = logging.getLogger() 12 | 13 | def create_folders(): 14 | """Create folders in PATHS.""" 15 | for name, folder in PATHS.items(): 16 | if os.path.exists(folder): 17 | continue 18 | 19 | try: 20 | os.makedirs(folder) 21 | except OSError: 22 | pass 23 | 24 | def init_logging(): 25 | """Initialize logger.""" 26 | formatter = logging.Formatter("%(asctime)s [%(name)s] %(levelname)s: %(message)s") 27 | sh = logging.StreamHandler() 28 | sh.setFormatter(formatter) 29 | log.addHandler(sh) 30 | 31 | nh = NetlogHandler() 32 | nh.setFormatter(formatter) 33 | log.addHandler(nh) 34 | 35 | log.setLevel(logging.DEBUG) 36 | -------------------------------------------------------------------------------- /analyzer/linux/modules/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/modules/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/modules/auxiliary/__init__.py -------------------------------------------------------------------------------- /analyzer/linux/modules/packages/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/linux/modules/packages/__init__.py -------------------------------------------------------------------------------- /analyzer/windows/bin/execsc.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/analyzer/windows/bin/execsc.exe -------------------------------------------------------------------------------- /analyzer/windows/lib/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/lib/api/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/constants.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.rand import random_string 7 | 8 | SHUTDOWN_MUTEX = "Global\\" + random_string(6, 10) 9 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/exceptions.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | class CuckooError(Exception): 7 | pass 8 | 9 | class CuckooPackageError(Exception): 10 | pass 11 | 12 | class CuckooDisableModule(CuckooError): 13 | """Exception for disabling a module dynamically.""" 14 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/hashing.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | BUFSIZE = 1024*1024 7 | 8 | 9 | def hash_file(method, path): 10 | """Calculates an hash on a file by path. 11 | @param method: callable hashing method 12 | @param path: file path 13 | @return: computed hash string 14 | """ 15 | f = open(path, "rb") 16 | h = method() 17 | while True: 18 | buf = f.read(BUFSIZE) 19 | if not buf: 20 | break 21 | h.update(buf) 22 | return h.hexdigest() 23 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/rand.py: -------------------------------------------------------------------------------- 1 | import random 2 | import string 3 | 4 | def random_string(minimum, maximum=None): 5 | if maximum is None: 6 | maximum = minimum 7 | 8 | count = random.randint(minimum, maximum) 9 | return "".join(random.choice(string.ascii_letters) for x in xrange(count)) 10 | 11 | def random_integer(digits): 12 | start = 10 ** (digits - 1) 13 | end = (10 ** digits) - 1 14 | return random.randint(start, end) 15 | -------------------------------------------------------------------------------- /analyzer/windows/lib/core/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/lib/core/startup.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import ctypes 7 | import logging 8 | 9 | from lib.common.defines import KERNEL32, SYSTEMTIME 10 | from lib.common.results import NetlogHandler 11 | 12 | log = logging.getLogger() 13 | 14 | def init_logging(): 15 | """Initialize logger.""" 16 | formatter = logging.Formatter("%(asctime)s [%(name)s] %(levelname)s: %(message)s") 17 | sh = logging.StreamHandler() 18 | sh.setFormatter(formatter) 19 | log.addHandler(sh) 20 | 21 | nh = NetlogHandler() 22 | nh.setFormatter(formatter) 23 | log.addHandler(nh) 24 | 25 | log.setLevel(logging.DEBUG) 26 | 27 | def set_clock(clock): 28 | st = SYSTEMTIME() 29 | st.wYear = clock.year 30 | st.wMonth = clock.month 31 | st.wDay = clock.day 32 | st.wHour = clock.hour 33 | st.wMinute = clock.minute 34 | st.wSecond = clock.second 35 | st.wMilliseconds = 0 36 | KERNEL32.SetLocalTime(ctypes.byref(st)) 37 | -------------------------------------------------------------------------------- /analyzer/windows/modules/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/modules/auxiliary/dumptls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.api.process import Process 7 | from lib.common.abstracts import Auxiliary 8 | 9 | class DumpTLSMasterSecrets(Auxiliary): 10 | """Dump TLS master secrets as used by various Windows libraries.""" 11 | def start(self): 12 | Process(process_name="lsass.exe").inject(track=False, mode="dumptls") 13 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/bin.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class Shellcode(Package): 9 | """Shellcode (any x86 executable code) analysis package.""" 10 | 11 | def start(self, path): 12 | return self.execute("bin/execsc.exe", args=[path]) 13 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/cpl.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class CPL(Package): 9 | """Control Panel Applet analysis package.""" 10 | PATHS = [ 11 | ("System32", "control.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | control = self.get_path("control.exe") 16 | return self.execute(control, args=[path]) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/exe.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import os 7 | import shlex 8 | 9 | from lib.common.abstracts import Package 10 | 11 | class Exe(Package): 12 | """EXE analysis package.""" 13 | 14 | def start(self, path): 15 | args = self.options.get("arguments", "") 16 | 17 | name, ext = os.path.splitext(path) 18 | if not ext: 19 | new_path = name + ".exe" 20 | os.rename(path, new_path) 21 | path = new_path 22 | 23 | return self.execute(path, args=shlex.split(args)) 24 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ff.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class Firefox(Package): 9 | """Firefox analysis package.""" 10 | PATHS = [ 11 | ("ProgramFiles", "Mozilla Firefox", "firefox.exe"), 12 | ] 13 | 14 | def start(self, url): 15 | firefox = self.get_path("Firefox") 16 | return self.execute(firefox, args=[url]) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/jar.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class Jar(Package): 9 | """Java analysis package.""" 10 | PATHS = [ 11 | ("ProgramFiles", "Java", "jre*", "bin", "java.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | java = self.get_path_glob("Java") 16 | class_path = self.options.get("class") 17 | 18 | if class_path: 19 | args = ["-cp", path, class_path] 20 | else: 21 | args = ["-jar", path] 22 | 23 | return self.execute(java, args=args, trigger="file:%s" % path) 24 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/js.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import logging 7 | import os 8 | 9 | from lib.common.abstracts import Package 10 | 11 | log = logging.getLogger(__name__) 12 | 13 | class Javascript(Package): 14 | """Javascript analysis package.""" 15 | PATHS = [ 16 | ("System32", "wscript.exe"), 17 | ] 18 | 19 | def start(self, path): 20 | wscript = self.get_path("WScript") 21 | 22 | # Enforce the .js file extension as is required by wscript. 23 | if not path.endswith(".js"): 24 | os.rename(path, path + ".js") 25 | path += ".js" 26 | log.info("Submitted file is missing extension, added .js") 27 | 28 | return self.execute(wscript, args=[path], trigger="file:%s" % path) 29 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/msi.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class Msi(Package): 9 | """MSI analysis package.""" 10 | 11 | PATHS = [ 12 | ("System32", "msiexec.exe"), 13 | ] 14 | 15 | def start(self, path): 16 | msi_path = self.get_path("msiexec.exe") 17 | return self.execute(msi_path, args=["/I", path]) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ps1.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | # Originally proposed by David Maciejak. 9 | 10 | class PS1(Package): 11 | """PowerShell analysis package.""" 12 | PATHS = [ 13 | ("System32", "WindowsPowerShell", "v1.0", "powershell.exe"), 14 | ("System32", "WindowsPowerShell", "v2.0", "powershell.exe"), 15 | ("System32", "WindowsPowerShell", "v3.0", "powershell.exe"), 16 | ] 17 | 18 | def start(self, path): 19 | powershell = self.get_path("PowerShell") 20 | args = [ 21 | "-NoProfile", "-ExecutionPolicy", "unrestricted", "-File", path 22 | ] 23 | return self.execute(powershell, args=args, trigger="file:%s" % path) 24 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/python.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import shlex 7 | 8 | from lib.common.abstracts import Package 9 | 10 | class Python(Package): 11 | """Python analysis package.""" 12 | 13 | PATHS = [ 14 | ("HomeDrive", "Python24", "python.exe"), 15 | ("HomeDrive", "Python25", "python.exe"), 16 | ("HomeDrive", "Python26", "python.exe"), 17 | ("HomeDrive", "Python27", "python.exe"), 18 | ("HomeDrive", "Python32", "python.exe"), 19 | ("HomeDrive", "Python33", "python.exe"), 20 | ("HomeDrive", "Python34", "python.exe"), 21 | ] 22 | 23 | def start(self, path): 24 | python = self.get_path("Python") 25 | arguments = self.options.get("arguments", "") 26 | 27 | args = [path] + shlex.split(arguments) 28 | return self.execute(python, args=args, trigger="file:%s" % path) 29 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/reboot.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import logging 6 | 7 | from lib.common.abstracts import Package 8 | 9 | log = logging.getLogger(__name__) 10 | 11 | class Reboot(Package): 12 | """Reboot analysis package.""" 13 | 14 | def _handle_create_process(self, filepath, command_line, source): 15 | self.pids.append(self.execute(filepath, command_line)) 16 | 17 | def start(self, path): 18 | for category, args in self.analyzer.reboot: 19 | if not hasattr(self, "_handle_%s" % category): 20 | log.warning("Unhandled reboot command: %s", category) 21 | continue 22 | 23 | getattr(self, "_handle_%s" % category)(*args) 24 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/vbs.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class VBS(Package): 9 | """VBS analysis package.""" 10 | PATHS = [ 11 | ("System32", "wscript.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | wscript = self.get_path("WScript") 16 | return self.execute(wscript, args=[path], trigger="file:%s" % path) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/wsf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import logging 6 | import os 7 | 8 | from lib.common.abstracts import Package 9 | 10 | log = logging.getLogger(__name__) 11 | 12 | class WSF(Package): 13 | """Windows Scripting File analysis package.""" 14 | PATHS = [ 15 | ("System32", "wscript.exe"), 16 | ] 17 | 18 | def start(self, path): 19 | wscript = self.get_path("WScript") 20 | 21 | # Enforce the .wsf file extension as is required by wscript. 22 | if not path.endswith(".wsf"): 23 | os.rename(path, path + ".wsf") 24 | path += ".wsf" 25 | log.info("Submitted file is missing extension, added .wsf") 26 | 27 | return self.execute(wscript, args=[path], trigger="file:%s" % path) 28 | -------------------------------------------------------------------------------- /conf/misp.json: -------------------------------------------------------------------------------- 1 | { 2 | "purge" : { 3 | "values" : [".gvt1.com/edgedl/release", "GoogleUpdateSetup.exe?cms"], 4 | "comments" : [".gvt1.com/edgedl/release", "GoogleUpdateSetup.exe?cms"] 5 | }, 6 | "add_tags" : { 7 | "values" : [ 8 | {"regex" : "extractorexpress.exe", "tags" : ["3","8"], "name": "Emotet"}, 9 | {"regex" : "faultserif.exe", "tags" : ["3","8"], "name": "Emotet" } 10 | ], 11 | "comments" : [ 12 | {"regex" : "extractorexpress.exe", "tags" : ["3","8"], "name": "Emotet"}, 13 | {"regex" : "faultserif.exe", "tags" : ["3","8"], "name": "Emotet" } 14 | ] 15 | } 16 | } -------------------------------------------------------------------------------- /cuckoo/distributed/.vs/VSWorkspaceState.json: -------------------------------------------------------------------------------- 1 | { 2 | "ExpandedNodes": [ 3 | "" 4 | ], 5 | "PreviewInSolutionExplorer": false 6 | } -------------------------------------------------------------------------------- /cuckoo/distributed/.vs/slnx.sqlite: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/cuckoo/distributed/.vs/slnx.sqlite -------------------------------------------------------------------------------- /data/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /data/android/anti-vm/fake-cpuinfo: -------------------------------------------------------------------------------- 1 | Processor : ARMv7 Processor rev 0 (v7l) 2 | BogoMIPS : 366.18 3 | Features : swp half thumb fastmult vfp edsp neon vfpv3 4 | CPU implementer : 0x41 5 | CPU architecture: 7 6 | CPU variant : 0x0 7 | CPU part : 0xc08 8 | CPU revision : 0 9 | 10 | Hardware : Qualcomm MSM 8974 HAMMERHEAD (Flattened Device Tree) 11 | Revision : 0000 12 | Serial : 0000000000000000 -------------------------------------------------------------------------------- /data/android/anti-vm/fake-drivers: -------------------------------------------------------------------------------- 1 | /dev/tty /dev/tty 5 0 system:/dev/tty 2 | /dev/console /dev/console 5 1 system:console 3 | /dev/ptmx /dev/ptmx 5 2 system 4 | /dev/vc/0 /dev/vc/0 4 0 system:vtmaster 5 | rfcomm /dev/rfcomm 216 0-255 serial 6 | acm /dev/ttyACM 166 0-31 serial 7 | hso /dev/ttyHS 243 0-255 serial 8 | msm_serial_hsl /dev/ttyHSL 247 0-2 serial 9 | msm_serial_hs /dev/ttyHS 248 0-255 serial 10 | pty_slave /dev/pts 136 0-1048575 pty:slave 11 | pty_master /dev/ptm 128 0-1048575 pty:master 12 | unknown /dev/tty 4 1-63 console 13 | -------------------------------------------------------------------------------- /data/android/apps/ImportContacts.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/apps/ImportContacts.apk -------------------------------------------------------------------------------- /data/android/apps/Superuser.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/apps/Superuser.apk -------------------------------------------------------------------------------- /data/android/apps/de.robv.android.xposed.installer_v33_36570c.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/apps/de.robv.android.xposed.installer_v33_36570c.apk -------------------------------------------------------------------------------- /data/android/binaries/su: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/binaries/su -------------------------------------------------------------------------------- /data/android/hooking/Droidmon.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/hooking/Droidmon.apk -------------------------------------------------------------------------------- /data/android/hooking/EmulatorAntiDetect.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/android/hooking/EmulatorAntiDetect.apk -------------------------------------------------------------------------------- /data/html/error.html: -------------------------------------------------------------------------------- 1 | {% extends "base-web.html" %} 2 | {% block content %} 3 |
4 |

Ouch! KaBoom!

5 |
6 |
7 |
8 | Error: {{error}} 9 |
10 |
11 | {% endblock %} -------------------------------------------------------------------------------- /data/html/img/glyphicons-halflings-white.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/html/img/glyphicons-halflings-white.png -------------------------------------------------------------------------------- /data/html/img/glyphicons-halflings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/html/img/glyphicons-halflings.png -------------------------------------------------------------------------------- /data/html/js/functions.js: -------------------------------------------------------------------------------- 1 | function showHide(id, lbl) { 2 | var e = document.getElementById(id); 3 | 4 | if (lbl !== "undefined") 5 | var l = document.getElementById(lbl); 6 | 7 | if(e.style.display == "none") { 8 | e.style.display = "block"; 9 | if (l) { 10 | l.innerHTML = "Collapse"; 11 | } 12 | } 13 | else { 14 | e.style.display = "none"; 15 | if (l) 16 | l.innerHTML = "Expand"; 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /data/html/pagination-rpp.html: -------------------------------------------------------------------------------- 1 | 4 |
5 | 16 |
17 | -------------------------------------------------------------------------------- /data/html/report.html: -------------------------------------------------------------------------------- 1 | {% extends "base-report.html" %} 2 | {% block content %} 3 | {% include "sections/info.html" %} 4 | {% include "sections/errors.html" %} 5 | {% if results.info.category == "file" %} 6 | {% include "sections/file.html" %} 7 | {% elif results.info.category == "url" %} 8 | {% include "sections/url.html" %} 9 | {% endif %} 10 | {% include "sections/signatures.html" %} 11 | {% include "sections/screenshots.html" %} 12 | {% if results.info.category == "file" %} 13 | {% include "sections/static.html" %} 14 | {% endif %} 15 | {% include "sections/dropped.html" %} 16 | {% include "sections/network.html" %} 17 | {% include "sections/behavior.html" %} 18 | {% include "sections/volatility.html" %} 19 | {% endblock %} -------------------------------------------------------------------------------- /data/html/sections/errors.html: -------------------------------------------------------------------------------- 1 | {% if results.debug.errors %} 2 |
3 |

Errors

4 |
5 |
6 | 11 |
12 | {% endif %} -------------------------------------------------------------------------------- /data/html/sections/screenshots.html: -------------------------------------------------------------------------------- 1 |
2 |
3 |

Screenshots

4 |
5 | {% if results.screenshots %} 6 | {% for shot in results.screenshots %} 7 | 8 | {% endfor %} 9 | {% else %} 10 | No screenshots available. 11 | {% endif %} 12 |
13 | -------------------------------------------------------------------------------- /data/html/success.html: -------------------------------------------------------------------------------- 1 | {% extends "base-web.html" %} 2 | {% block content %} 3 |
4 |

New Analysis

5 |
6 |
7 |
8 | GOOD! File {{submitfile}} was submitted for analysis with Task ID {{taskid}}. 9 |
10 |
11 | {% endblock %} -------------------------------------------------------------------------------- /data/mitm.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | # This is an empty boilerplate script where one can define a mitmdump script 7 | # for doing man in the middle interception. 8 | -------------------------------------------------------------------------------- /data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/inject-x64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/inject-x64.exe -------------------------------------------------------------------------------- /data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/inject-x86.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/inject-x86.exe -------------------------------------------------------------------------------- /data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/is32bit.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/is32bit.exe -------------------------------------------------------------------------------- /data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/monitor-x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/monitor-x64.dll -------------------------------------------------------------------------------- /data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/monitor-x86.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/14b2b875dbfa50d19f5967c4b150a7a2e9465e39/monitor-x86.dll -------------------------------------------------------------------------------- /data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/inject-x64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/inject-x64.exe -------------------------------------------------------------------------------- /data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/inject-x86.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/inject-x86.exe -------------------------------------------------------------------------------- /data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/is32bit.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/is32bit.exe -------------------------------------------------------------------------------- /data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/monitor-x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/monitor-x64.dll -------------------------------------------------------------------------------- /data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/monitor-x86.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/monitor/2904ecd8163e96db69fe2ac8f48c5935e194fb08/monitor-x86.dll -------------------------------------------------------------------------------- /data/monitor/latest: -------------------------------------------------------------------------------- 1 | cf3b0957e39242885f7e5a7d6f49245b3a88a2fd -------------------------------------------------------------------------------- /data/peutils/UserDB.TXT: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/peutils/UserDB.TXT -------------------------------------------------------------------------------- /data/src/binpackage/Makefile: -------------------------------------------------------------------------------- 1 | execsc.exe: execsc.c 2 | i586-mingw32msvc-cc -Wall -o $@ $< 3 | 4 | -------------------------------------------------------------------------------- /data/src/binpackage/execsc.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main (int argc, char ** argv) { 6 | int fd; 7 | char buf[2048] = {0}; 8 | 9 | if (argc < 2) return 1; 10 | 11 | // read in shellcode from analysis target file 12 | fd = open(argv[1], 0); 13 | read(fd, buf, 2048); 14 | close(fd); 15 | 16 | // jump into shellcode 17 | int (*func)(); 18 | func = (int (*)()) buf; 19 | (int)(*func)(); 20 | 21 | return 0; 22 | } 23 | 24 | -------------------------------------------------------------------------------- /data/whitelist/ip.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/whitelist/ip.txt -------------------------------------------------------------------------------- /data/whitelist/url_regex.txt: -------------------------------------------------------------------------------- 1 | \.thawte\.com\/ 2 | \.verisign\.com\/ 3 | \.verisign\.com[0-9]{1,} 4 | \.geotrust\.com[0-9]{1,} 5 | \.geotrust\.com\/ 6 | \.certum\.pl\/ -------------------------------------------------------------------------------- /data/yara/binaries/shellcodes.yar: -------------------------------------------------------------------------------- 1 | // Copyright (C) 2010-2014 Cuckoo Foundation. 2 | // This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | // See the file 'docs/LICENSE' for copying permission. 4 | 5 | rule shellcode 6 | { 7 | meta: 8 | author = "nex" 9 | description = "Matched shellcode byte patterns" 10 | 11 | strings: 12 | $mz = { 4d 5a } 13 | $shell1 = { 64 8b 64 } 14 | $shell2 = { 64 a1 30 } 15 | $shell3 = { 64 8b 15 30 } 16 | $shell4 = { 64 8b 35 30 } 17 | $shell5 = { 55 8b ec 83 c4 } 18 | $shell6 = { 55 8b ec 81 ec } 19 | $shell7 = { 55 8b ec e8 } 20 | $shell8 = { 55 8b ec e9 } 21 | condition: 22 | not ($mz at 0) and 23 | any of ($shell*) 24 | } 25 | -------------------------------------------------------------------------------- /data/yara/memory/.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/yara/memory/.gitignore -------------------------------------------------------------------------------- /data/yara/memory/index_memory.yar: -------------------------------------------------------------------------------- 1 | // Copyright (C) 2010-2014 Cuckoo Foundation. 2 | // This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | // See the file 'docs/LICENSE' for copying permission. 4 | 5 | // The contents of this file are Yara rules processed by procmemory.py processing 6 | // module. Add your signatures here. -------------------------------------------------------------------------------- /data/yara/urls/.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/data/yara/urls/.gitignore -------------------------------------------------------------------------------- /distributed/alembic.ini: -------------------------------------------------------------------------------- 1 | # A generic, single database configuration. 2 | 3 | [alembic] 4 | # path to migration scripts 5 | script_location = migration 6 | 7 | # Logging configuration 8 | [loggers] 9 | keys = root,sqlalchemy,alembic 10 | 11 | [handlers] 12 | keys = console 13 | 14 | [formatters] 15 | keys = generic 16 | 17 | [logger_root] 18 | level = WARN 19 | handlers = console 20 | qualname = 21 | 22 | [logger_sqlalchemy] 23 | level = WARN 24 | handlers = 25 | qualname = sqlalchemy.engine 26 | 27 | [logger_alembic] 28 | level = INFO 29 | handlers = 30 | qualname = alembic 31 | 32 | [handler_console] 33 | class = StreamHandler 34 | args = (sys.stderr,) 35 | level = NOTSET 36 | formatter = generic 37 | 38 | [formatter_generic] 39 | format = %(levelname)-5.5s [%(name)s] %(message)s 40 | datefmt = %H:%M:%S 41 | -------------------------------------------------------------------------------- /distributed/distributed/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /distributed/distributed/exception.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | class InvalidReport(Exception): 6 | pass 7 | -------------------------------------------------------------------------------- /distributed/distributed/views/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014-2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | __all__ = ["blueprints"] 8 | blueprints = [] 9 | 10 | for fname in os.listdir(os.path.dirname(__file__)): 11 | if fname.endswith(".py") and not fname.startswith("__init__"): 12 | view = __import__("distributed.views.%s" % fname.rstrip(".py"), 13 | globals(), locals(), ["blueprint", "routes"], -1) 14 | blueprints.append((view.blueprint, view.routes)) 15 | -------------------------------------------------------------------------------- /distributed/migration/env.py: -------------------------------------------------------------------------------- 1 | from __future__ import with_statement 2 | from alembic import context 3 | from sqlalchemy import create_engine, pool 4 | 5 | import os.path 6 | import sys 7 | 8 | sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..")) 9 | 10 | import settings 11 | 12 | from distributed.db import db 13 | target_metadata = db.metadata 14 | 15 | config = context.config 16 | 17 | def run_migrations(): 18 | engine = create_engine(settings.SQLALCHEMY_DATABASE_URI, 19 | poolclass=pool.NullPool) 20 | 21 | connection = engine.connect() 22 | context.configure(connection=connection, target_metadata=target_metadata) 23 | 24 | try: 25 | with context.begin_transaction(): 26 | context.run_migrations() 27 | finally: 28 | connection.close() 29 | 30 | run_migrations() 31 | -------------------------------------------------------------------------------- /distributed/migration/script.py.mako: -------------------------------------------------------------------------------- 1 | """${message} 2 | 3 | Revision ID: ${up_revision} 4 | Revises: ${down_revision | comma,n} 5 | Create Date: ${create_date} 6 | 7 | """ 8 | 9 | revision = ${repr(up_revision)} 10 | down_revision = ${repr(down_revision)} 11 | branch_labels = ${repr(branch_labels)} 12 | depends_on = ${repr(depends_on)} 13 | 14 | from alembic import op 15 | import sqlalchemy as sa 16 | ${imports if imports else ""} 17 | 18 | def upgrade(): 19 | ${upgrades if upgrades else "pass"} 20 | 21 | def downgrade(): 22 | ${downgrades if downgrades else "pass"} 23 | -------------------------------------------------------------------------------- /distributed/migration/versions/151400d38e03_node_status_timestamp_index.py: -------------------------------------------------------------------------------- 1 | """node status timestamp index 2 | 3 | Revision ID: 151400d38e03 4 | Revises: 4d0a2590e997 5 | Create Date: 2015-07-15 15:53:56.016839 6 | 7 | """ 8 | 9 | revision = "151400d38e03" 10 | down_revision = "4d0a2590e997" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | 16 | def upgrade(): 17 | op.create_index("ix_node_status_timestamp", "node_status", ["timestamp"], unique=False) 18 | 19 | def downgrade(): 20 | op.drop_index("ix_node_status_timestamp", table_name="node_status") 21 | -------------------------------------------------------------------------------- /distributed/migration/versions/2aa59981b59d_node_task_not_unique.py: -------------------------------------------------------------------------------- 1 | """node task not unique 2 | 3 | Revision ID: 2aa59981b59d 4 | Revises: 151400d38e03 5 | Create Date: 2015-07-17 10:54:27.568346 6 | 7 | """ 8 | 9 | revision = "2aa59981b59d" 10 | down_revision = "151400d38e03" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | 16 | def upgrade(): 17 | op.drop_index("ix_node_task", table_name="task") 18 | op.create_index("ix_node_task", "task", ["node_id", "task_id"]) 19 | 20 | def downgrade(): 21 | op.drop_index("ix_node_task", table_name="task") 22 | op.create_index("ix_node_task", "task", ["node_id", "task_id"], unique=True) 23 | -------------------------------------------------------------------------------- /distributed/migration/versions/3cc1509b7fdc_node_status.py: -------------------------------------------------------------------------------- 1 | """node status 2 | 3 | Revision ID: 3cc1509b7fdc 4 | Revises: 37c08c9655bb 5 | Create Date: 2015-03-30 17:14:39.604125 6 | 7 | """ 8 | 9 | revision = "3cc1509b7fdc" 10 | down_revision = "37c08c9655bb" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | import sqlalchemy as sa 16 | 17 | def upgrade(): 18 | op.create_table( 19 | "node_status", 20 | sa.Column("id", sa.Integer(), nullable=False), 21 | sa.Column("node_id", sa.Integer(), nullable=True), 22 | sa.Column("timestamp", sa.DateTime(), nullable=False), 23 | sa.Column("status", sa.Text(), nullable=False), 24 | sa.ForeignKeyConstraint(["node_id"], ["node.id"]), 25 | sa.PrimaryKeyConstraint("id") 26 | ) 27 | 28 | def downgrade(): 29 | op.drop_table("node_status") 30 | -------------------------------------------------------------------------------- /distributed/migration/versions/3d1d8fd2cdbb_timestamps.py: -------------------------------------------------------------------------------- 1 | """timestamps 2 | 3 | Revision ID: 3d1d8fd2cdbb 4 | Revises: 69ecf07a99b 5 | Create Date: 2015-06-03 22:55:51.357575 6 | 7 | """ 8 | 9 | revision = "3d1d8fd2cdbb" 10 | down_revision = "69ecf07a99b" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | import sqlalchemy as sa 16 | 17 | def upgrade(): 18 | op.add_column("task", sa.Column("submitted", sa.DateTime(), nullable=True)) 19 | op.add_column("task", sa.Column("delegated", sa.DateTime(), nullable=True)) 20 | op.add_column("task", sa.Column("started", sa.DateTime(), nullable=True)) 21 | op.add_column("task", sa.Column("completed", sa.DateTime(), nullable=True)) 22 | 23 | def downgrade(): 24 | op.drop_column("task", "submitted") 25 | op.drop_column("task", "started") 26 | op.drop_column("task", "delegated") 27 | op.drop_column("task", "completed") 28 | -------------------------------------------------------------------------------- /distributed/migration/versions/4b86bc0d40aa_node_mode.py: -------------------------------------------------------------------------------- 1 | """node mode 2 | 3 | Revision ID: 4b86bc0d40aa 4 | Revises: 2aa59981b59d 5 | Create Date: 2015-09-09 00:04:56.119968 6 | 7 | """ 8 | 9 | revision = "4b86bc0d40aa" 10 | down_revision = "2aa59981b59d" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | import sqlalchemy as sa 16 | 17 | def upgrade(): 18 | op.add_column("node", sa.Column("mode", sa.Text())) 19 | op.execute("update node set mode = 'normal'") 20 | op.alter_column("node", "mode", nullable=False) 21 | 22 | def downgrade(): 23 | op.drop_column("node", "mode") 24 | -------------------------------------------------------------------------------- /distributed/migration/versions/4d0a2590e997_node_task_index.py: -------------------------------------------------------------------------------- 1 | """node task index 2 | 3 | Revision ID: 4d0a2590e997 4 | Revises: 166078eb1311 5 | Create Date: 2015-06-30 15:46:11.780052 6 | 7 | """ 8 | 9 | revision = "4d0a2590e997" 10 | down_revision = "166078eb1311" 11 | branch_labels = None 12 | depends_on = None 13 | 14 | from alembic import op 15 | 16 | def upgrade(): 17 | op.create_index("ix_node_task", "task", ["node_id", "task_id"], unique=True) 18 | 19 | def downgrade(): 20 | op.drop_index("ix_node_task", table_name="task") 21 | -------------------------------------------------------------------------------- /distributed/requirements.txt: -------------------------------------------------------------------------------- 1 | flask 2 | flask-sqlalchemy 3 | requests 4 | sqlalchemy 5 | psycopg2 6 | alembic 7 | -------------------------------------------------------------------------------- /docker/suricata/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM alpine:latest 2 | RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories 3 | RUN apk add --no-cache \ 4 | python \ 5 | suricata \ 6 | py-pip \ 7 | git 8 | 9 | RUN git clone https://github.com/OISF/suricata 10 | RUN cp suricata/python/suricata/config/defaults.py.in suricata/python/suricata/config/defaults.py 11 | 12 | WORKDIR /suricata/python 13 | RUN python setup.py install 14 | 15 | WORKDIR /app 16 | COPY . /app 17 | RUN pip install -r /app/requirements.txt 18 | ENTRYPOINT ["python", "suri.py"] -------------------------------------------------------------------------------- /docker/suricata/repositories: -------------------------------------------------------------------------------- 1 | "http://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64" -------------------------------------------------------------------------------- /docker/suricata/requirements.txt: -------------------------------------------------------------------------------- 1 | elasticsearch 2 | 3 | -------------------------------------------------------------------------------- /docker/yara/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM blacktop/yara 2 | WORKDIR /app 3 | COPY requirements.txt /app/requirements.txt 4 | RUN apk add --update py-pip 5 | RUN pip install -r /app/requirements.txt 6 | COPY yara2es.py /app/yara2es.py 7 | ENTRYPOINT ["python", "/app/yara2es.py"] -------------------------------------------------------------------------------- /docker/yara/requirements.txt: -------------------------------------------------------------------------------- 1 | elasticsearch 2 | pymongo -------------------------------------------------------------------------------- /docs/README: -------------------------------------------------------------------------------- 1 | README 2 | 3 | The documentation for installing, using and customizing Cuckoo Sandbox is 4 | available under different forms and formats. 5 | 6 | Under "docs/book/" you can find the complete Cuckoo Sandbox Book in three 7 | different formats: 8 | * HTML 9 | * PDF 10 | * Text 11 | 12 | Under "docs/books/src" you'll find the Sphinx sources used to build the book. 13 | 14 | Under "epydoc/" you'll find the Python documentation of Cuckoo's libs and apis 15 | generated by Epydoc. This directory contains two sub-directories: "host" and 16 | "guest", containing references for Cuckoo's Host and Guest components 17 | respectively. 18 | -------------------------------------------------------------------------------- /docs/book/src/_images/logo/cuckoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/logo/cuckoo.png -------------------------------------------------------------------------------- /docs/book/src/_images/schemas/architecture-main.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/schemas/architecture-main.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/error_template_rendering.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/error_template_rendering.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/fog_host_management.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/fog_host_management.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/fog_image_management.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/fog_image_management.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/fog_scheduled_job.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/fog_scheduled_job.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/shared_folders.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/shared_folders.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/unsupported_method.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/unsupported_method.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/windows_network.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/windows_network.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/windows_registry.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/windows_registry.png -------------------------------------------------------------------------------- /docs/book/src/_images/screenshots/windows_security.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/docs/book/src/_images/screenshots/windows_security.png -------------------------------------------------------------------------------- /docs/book/src/customization/index.rst: -------------------------------------------------------------------------------- 1 | .. Customization chapter frontpage 2 | 3 | Customization 4 | ============= 5 | 6 | This chapter explains how to customize Cuckoo. 7 | Cuckoo is written in a modular architecture built to be as customizable as it can, 8 | to fit the needs of all users. 9 | 10 | .. toctree:: 11 | 12 | auxiliary 13 | machinery 14 | packages 15 | processing 16 | signatures 17 | reporting 18 | -------------------------------------------------------------------------------- /docs/book/src/development/index.rst: -------------------------------------------------------------------------------- 1 | .. Development chapter frontpage 2 | 3 | Development 4 | =========== 5 | 6 | This chapter explains how to write Cuckoo's code and how to contribute. 7 | 8 | .. toctree:: 9 | 10 | development_notes 11 | code_style 12 | -------------------------------------------------------------------------------- /docs/book/src/index.rst: -------------------------------------------------------------------------------- 1 | 2 | .. _index: 3 | 4 | =================== 5 | Cuckoo Sandbox Book 6 | =================== 7 | 8 | Cuckoo Sandbox is an *Open Source* software for automating analysis of suspicious files. 9 | To do so it makes use of custom components that monitor the behavior of the malicious 10 | processes while running in an isolated environment. 11 | 12 | This guide will explain how to set up Cuckoo, use it and customize it. 13 | 14 | Having troubles? 15 | ================ 16 | 17 | If you're having troubles you might want to check out the :doc:`FAQ ` 18 | as it may already have the answers to your questions. 19 | 20 | .. toctree:: 21 | 22 | faq/index 23 | 24 | Otherwise you can ask the developers and/or other Cuckoo users, see 25 | :doc:`Join the discussion `. 26 | 27 | Contents 28 | ======== 29 | 30 | .. toctree:: 31 | 32 | introduction/index 33 | installation/index 34 | usage/index 35 | customization/index 36 | development/index 37 | finalremarks/index 38 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest/agent.rst: -------------------------------------------------------------------------------- 1 | ==================== 2 | Installing the Agent 3 | ==================== 4 | 5 | From release 0.4 Cuckoo adopts a custom agent that runs inside the Guest and 6 | that handles the communication and the exchange of data with the Host. 7 | This agent is designed to be cross-platform, therefore you should be able 8 | to use it on Windows as well as on Linux and OS X. 9 | In order to make Cuckoo work properly, you'll have to install and start this 10 | agent. 11 | 12 | It's very simple. 13 | 14 | In the *agent/* directory you will find and *agent.py* file, just copy it 15 | to the Guest operating system (in whatever way you want, perhaps a temporary 16 | shared folder or by downloading it from a Host webserver) and run it. 17 | This will launch the XMLRPC server which will be listening for connections. 18 | 19 | On Windows simply launching the script will also spawn a Python window, if 20 | you want to hide it you can rename the file from *agent.py* to **agent.pyw** 21 | which will prevent the window from spawning. 22 | 23 | If you want the script to be launched at Windows' boot, just place the file in 24 | the `Startup` folder. 25 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest/cloning.rst: -------------------------------------------------------------------------------- 1 | =========================== 2 | Cloning the Virtual Machine 3 | =========================== 4 | 5 | In case you planned to use more than one virtual machine, there's no need to 6 | repeat all the steps done so far: you can clone it. In this way you'll have 7 | a copy of the original virtualized Windows with all requirements already 8 | installed. 9 | 10 | The new virtual machine will also contain all the settings of the original one, 11 | which is not good. Now you need to proceed repeating the steps explained in 12 | :doc:`network`, :doc:`agent` and :doc:`saving` for this new machine. 13 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest/index.rst: -------------------------------------------------------------------------------- 1 | =================== 2 | Preparing the Guest 3 | =================== 4 | 5 | At this point you should have configured the Cuckoo host component and you 6 | should have designed and defined the number and the names of the virtual 7 | machines you are going to use for malware execution. 8 | 9 | Now it's time to create such machines and to configure them properly. 10 | 11 | .. toctree:: 12 | 13 | creation 14 | requirements 15 | network 16 | agent 17 | saving 18 | cloning 19 | 20 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest/linux.rst: -------------------------------------------------------------------------------- 1 | ========================== 2 | Installing the Linux guest 3 | ========================== 4 | 5 | Add agent to autorun, the easier way is to add it to crontab:: 6 | 7 | sudo crontab -e 8 | @reboot python path_to_agent.py 9 | 10 | The following instructions are only for x32/x64 linux guests 11 | =========================================================== 12 | 13 | Install dependencies:: 14 | 15 | sudo apt-get install systemtap gcc linux-headers-$(uname -r) 16 | 17 | Compile Kernel extension:: 18 | 19 | wget https://raw.githubusercontent.com/cuckoosandbox/cuckoo/master/data/strace.stp 20 |   sudo stap -p4 -r $(uname -r) strace.stp -m stap_ -v 21 | 22 | Once finished it you should see stap_.ko in the same folder 23 | 24 | Test Kernel extension:: 25 | 26 | staprun -v ./stap_.ko 27 | 28 | Output should be something like **staprun:insert_module:x Module stap_ inserted from file path_to_stap_.ko** 29 | stap_.ko should be placed in /root/.cuckoo:: 30 | 31 | mkdir /root/.cuckoo 32 | mv stap_.ko /root/.cuckoo/ 33 | 34 | 35 | Disable firewall:: 36 | 37 | sudo ufw disable 38 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest_physical/creation.rst: -------------------------------------------------------------------------------- 1 | ================================ 2 | Creation of the Physical Machine 3 | ================================ 4 | 5 | Once you have :doc:`properly installed <../host/requirements>` your imaging 6 | software, you can proceed on creating all the physical machines you need. 7 | 8 | Using and configuring your imaging software is out of the scope of this 9 | guide, so please refer to the official documentation. 10 | 11 | .. note:: 12 | You can find some hints and considerations on how to design and create 13 | your virtualized environment in the :doc:`../../introduction/sandboxing` 14 | chapter. 15 | 16 | .. note:: 17 | For analysis purposes you are recommended to use Windows XP Service Pack 18 | 3, but Cuckoo Sandbox also proved to work with Windows 7 with User 19 | Access Control disabled. 20 | 21 | 22 | When creating the physical machine, Cuckoo doesn't require any specific 23 | configuration. You can choose the options that best fit your needs. 24 | -------------------------------------------------------------------------------- /docs/book/src/installation/guest_physical/index.rst: -------------------------------------------------------------------------------- 1 | ====================================== 2 | Preparing the Guest (Physical Machine) 3 | ====================================== 4 | 5 | At this point you should have configured the Cuckoo host component and you 6 | should have designed and defined the number and the names of the physical 7 | machines you are going to use for malware execution. 8 | 9 | Now it's time to create such machines and to configure them properly. 10 | 11 | .. toctree:: 12 | 13 | creation 14 | requirements 15 | network 16 | ../guest/agent 17 | saving 18 | -------------------------------------------------------------------------------- /docs/book/src/installation/host/configuration_android.rst: -------------------------------------------------------------------------------- 1 | ================================ 2 | Configuration (Android Analysis) 3 | ================================ 4 | 5 | To get Cuckoo running Android analysis you should download the `Android SDK `_ 6 | and extract it in a folder Cuckoo can access. 7 | You should also configure :ref:`avd_conf` with the settings of your setup. 8 | 9 | .. _avd_conf: 10 | 11 | avd.conf 12 | ======== 13 | 14 | The main file for Android environment settings is *conf/avd.conf*, it contains 15 | all the generic configuration used to launch the Android emulator and run the 16 | analysis. 17 | 18 | The file is largely commented and self-explaining, but some of the options you 19 | might want to pay more attention to are: 20 | 21 | * ``emulator_path``: this defines the Android emulator path (it is located inside Android SDK) 22 | * ``adb_path``: this defines the ADB path (it is located inside Android SDK) 23 | * ``avd_path``: this defines where AVD images are located 24 | -------------------------------------------------------------------------------- /docs/book/src/installation/host/index.rst: -------------------------------------------------------------------------------- 1 | ================== 2 | Preparing the Host 3 | ================== 4 | 5 | Even though it's reported to run on other operating systems too, Cuckoo is 6 | originally supposed to run on a *GNU/Linux* native system. 7 | For the purpose of this documentation, we chose **latest Ubuntu LTS** as 8 | reference system for the commands examples. 9 | 10 | .. toctree:: 11 | 12 | requirements 13 | installation 14 | configuration 15 | configuration_android 16 | -------------------------------------------------------------------------------- /docs/book/src/installation/index.rst: -------------------------------------------------------------------------------- 1 | .. Installation chapter frontpage 2 | 3 | Installation 4 | ============ 5 | 6 | This chapter explains how to install Cuckoo. 7 | 8 | Although the recommended setup is *GNU/Linux* (Debian or Ubuntu preferably) 9 | Cuckoo has proved to work smoothly also on *Mac OS X* as host; the recommended 10 | and tested setup for guests are *Windows 7* for Windows analysis, *Mac OS X 11 | Yosemite* for Mac OS X analysis and Debian for Linux Analysis, although Cuckoo 12 | should work with other releases of guest os. 13 | 14 | .. note:: 15 | 16 | This documentation refers to *Host* as the underlying operating systems on 17 | which you are running Cuckoo (generally being a GNU/Linux distribution) and 18 | to *Guest* as the Windows virtual machine used to run the isolated analysis. 19 | 20 | .. toctree:: 21 | 22 | host/index 23 | guest/index 24 | guest_physical/index 25 | upgrade 26 | 27 | -------------------------------------------------------------------------------- /docs/book/src/introduction/index.rst: -------------------------------------------------------------------------------- 1 | .. Introduction chapter frontpage 2 | 3 | Introduction 4 | ============ 5 | 6 | This is an introductory chapter to Cuckoo Sandbox. 7 | It explains some basic malware analysis concepts, what's Cuckoo and how it can fit 8 | in malware analysis. 9 | 10 | .. toctree:: 11 | 12 | sandboxing 13 | what 14 | license 15 | 16 | -------------------------------------------------------------------------------- /docs/book/src/introduction/license.rst: -------------------------------------------------------------------------------- 1 | ======= 2 | License 3 | ======= 4 | 5 | Cuckoo Sandbox license is shipped with Cuckoo and contained in the "LICENSE" 6 | file inside the "docs" folder. 7 | 8 | ========== 9 | Disclaimer 10 | ========== 11 | 12 | Cuckoo is distributed as it is, in the hope that it will be useful, but without 13 | any warranty neither the implied merchantability or fitness for a particular 14 | purpose. 15 | 16 | Whatever you do with this tool is uniquely your own responsibility. 17 | 18 | ================= 19 | Cuckoo Foundation 20 | ================= 21 | 22 | The `Cuckoo Foundation`_ is a non-profit organization incorporated as a 23 | Stichting in the Netherlands and it's mainly dedicated to support of the 24 | development and growth of Cuckoo Sandbox, an open source malware analysis 25 | system, and the surrounding projects and initiatives. 26 | 27 | The Foundation operates to secure financial and infrastructure support to our 28 | software projects and coordinates the development and contributions from the 29 | community. 30 | 31 | .. _`Cuckoo Foundation`: http://www.cuckoofoundation.org 32 | -------------------------------------------------------------------------------- /docs/book/src/usage/clean.rst: -------------------------------------------------------------------------------- 1 | .. _cuckoo-clean: 2 | 3 | =========================== 4 | Clean all Tasks and Samples 5 | =========================== 6 | 7 | Since Cuckoo 1.2 a built-in **--clean** feature has been added, it 8 | drops all associated information of the tasks and samples in the 9 | database. If you submit a task after running 10 | **--clean** then you'll start with ``Task #1`` again. 11 | 12 | To clean your setup, run:: 13 | 14 | $ ./cuckoo.py --clean 15 | 16 | To sum up, this command does the following: 17 | 18 | * Delete analysis results. 19 | * Delete submitted binaries. 20 | * Delete all associated information of the tasks and samples in the configured database. 21 | * Delete all data in the configured MongoDB (if configured and enabled in reporting.conf). 22 | 23 | .. warning:: 24 | If you use this command you will delete permanently all data stored by Cuckoo in all 25 | storages: file system, SQL database and MongoDB database. Use it only if you are sure 26 | you would clean up all the data. 27 | -------------------------------------------------------------------------------- /docs/book/src/usage/index.rst: -------------------------------------------------------------------------------- 1 | .. Usage chapter frontpage 2 | 3 | Usage 4 | ===== 5 | 6 | This chapter explains how to use Cuckoo. 7 | 8 | .. toctree:: 9 | 10 | start 11 | submit 12 | web 13 | api 14 | dist 15 | packages 16 | results 17 | clean 18 | utilities 19 | -------------------------------------------------------------------------------- /install/conf/virtualbox.conf: -------------------------------------------------------------------------------- 1 | [virtualbox] 2 | # Specify which VirtualBox mode you want to run your machines on. 3 | # Can be "gui", "sdl" or "headless". Refer to VirtualBox's official 4 | # documentation to understand the differences. 5 | mode = headless 6 | 7 | # Path to the local installation of the VBoxManage utility. 8 | path = /usr/bin/VBoxManage 9 | # If you are running Cuckoo on Mac OS X you have to change the path as follows: 10 | # path = /Applications/VirtualBox.app/Contents/MacOS/VBoxManage 11 | 12 | # Default network interface. 13 | interface = vboxnet0 14 | 15 | # Specify a comma-separated list of available machines to be used. For each 16 | # specified ID you have to define a dedicated section containing the details 17 | # on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3) 18 | machines = VBOX_MACHINES 19 | #machines = win7-x64-0,win7-x86-0 20 | -------------------------------------------------------------------------------- /install/crontab/crontab.template: -------------------------------------------------------------------------------- 1 | #CUCKOOCRONS 2 | #* * * * * CUCKOODIR/utils/crontab/cuckoo/clean_mem.sh 3 | * * * * * CUCKOODIR/utils/mongo_stats.sh DOCKER_ELASTIC_IP:9200 DOCKER_MONGO_IP 4 | #* * * * * CUCKOODIR/utils/crontab/cuckoo/del_memdump_from_reported.sh 5 | #ENDCUCKOOCRONS -------------------------------------------------------------------------------- /install/crontab/crontab_root.template: -------------------------------------------------------------------------------- 1 | #CUCKOOCRONS 2 | */5 * * * * CUCKOODIR/utils/crontab/root/cuckoo_monitor.sh 3 | #0 1 * * * CUCKOODIR/utils/crontab/cuckoo/cuckoo_full_restart.sh >> /var/log/cuckoo/cuckoo_restart.log 2>&1 4 | 0 1 * * * CUCKOODIR/utils/crontab/cuckoo/optimize.sh >> /var/log/cuckoo/optimize.log 5 | #ENDCUCKOOCRONS -------------------------------------------------------------------------------- /install/crontab/scripts/cuckoo/clean_mem.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | find CUCKOODIR/storage/analyses/*/memory.dmp -mmin +359|while read line; do rm -f "$line"; done 3 | MEMDUMPDIR=$(grep '^memdump_tmp' CUCKOODIR/conf/memory.conf |awk -F '=' '{print $2}'|sed 's/^ //g') 4 | if [ -n "$MEMDUMPDIR" ]; then 5 | find $MEMDUMPDIR/*.dmp -amin +3|while read line; do rm -f $line;done 6 | fi 7 | #find /tmp/cuckoo-tmp/ -amin +5|while read line; do rm -f $line;done -------------------------------------------------------------------------------- /install/crontab/scripts/cuckoo/del_memdump_from_reported.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | MARKER="/opt/phoenix/utils/mem_prep" 3 | #STORAGE="/opt/phoenix/storage/analyses" 4 | #STORAGE="/ssd/cuckoo_tmp/" 5 | STORAGE="/dev/shm" 6 | mysql -B -h 172.18.1.252 --user="CUCKOO_USER" --password="DOCKER_MYSQL_PASSWORD" --database="DOCKER_MYSQL_DATABASE" --execute="select id from tasks where status in ('reported', 'failed_processing', 'failed_analysis', 'failed_reporting') order by id desc limit 1000;" 2>/dev/null|grep -v 'id' |while read id; do 7 | CHECK=$(grep "^$id$" "$MARKER") 8 | if [ -z "$CHECK" ]; then 9 | echo "`date` deleting memory dump for $id" 10 | rm -f "$STORAGE/$id.dmp" 11 | echo "$id" >> "$MARKER" 12 | 13 | fi 14 | done 15 | find /tmp/tmp* -type f -mmin +5|while read file; do rm -f $file ;done -------------------------------------------------------------------------------- /install/crontab/scripts/cuckoo/openvpn_keepalive.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | CUCKOO_HOME="CUCKOODIR" 3 | grep dev $CUCKOO_HOME/install/openvpn/*.conf|awk '{print $NF}'|sort -u|while read INT; do 4 | /sbin/ifconfig "$INT" |grep 'inet addr'|awk -F 'addr:' '{print $2}'|awk '{print $1}'|sed -r 's/[0-9]+$/1/g'|while read ip ; do 5 | ping -I $INT -nn -W 5 -i 120 -s 20 -p 4b6565702d416c697665 $ip >> "/var/log/cuckoo/ping.log" 2>&1 & 6 | done 7 | done 8 | -------------------------------------------------------------------------------- /install/crontab/scripts/cuckoo/optimize.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ESHOST="DOCKER_ELASTIC_IP:9200" 3 | curl "$ESHOST/_cat/shards" 2>/dev/null |awk '{print $1}'|sort -u|while read index; do 4 | echo "";echo -n "Optimizing index: $index - "; curl -XPOST DOCKER_ELASTIC_IP:9200/$index/_forcemerge?max_num_segments=1 2>/dev/null 5 | done -------------------------------------------------------------------------------- /install/crontab/scripts/root/cuckoo_full_restart.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | SCRIPTSDIR="CUCKOODIR/utils/crontab/" 3 | CUCKOO_UTILS="CUCKOODIR/utils" 4 | 5 | pkill cuckoo_monitor.sh 6 | touch /var/run/cuckoo_monitor 7 | for i in cuckoo_all openvpn; do 8 | /etc/init.d/$i stop 9 | done 10 | pkill ping 11 | service netfilter-persistent restart 12 | service docker restart 13 | /etc/init.d/fail2ban restart 14 | /etc/init.d/openvpn start 15 | sleep 10 16 | /etc/init.d/cuckoo_all start 17 | sleep 10 18 | ${SCRIPTSDIR}/root/openvpn_route.sh >/dev/null 2>&1 19 | su - CUCKOO_USER -c "${SCRIPTSDIR}/cuckoo/openvpn_keepalive.sh" 20 | rm -f /var/run/cuckoo_monitor 21 | # Shouldn't need this, in fact it will probably stomp on the command run as cuckoo 22 | # vboxmanage hostonlyif ipconfig SANDINT --ip SANDIP --netmask 255.255.255.0 23 | su - cuckoo -c "vboxmanage hostonlyif ipconfig SANDINT --ip SANDIP --netmask 255.255.255.0" 24 | ## Is this here twice? So maybe... 25 | ${SCRIPTSDIR}/root/openvpn_route.sh >/dev/null 2>&1 26 | -------------------------------------------------------------------------------- /install/crontab/scripts/root/cuckoo_monitor.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | if [ ! -f /var/run/cuckoo_monitor ]; then 3 | /etc/init.d/cuckoo_all status|grep NOT|awk '{print $1}' |while read line; do 4 | echo "Restarting $line - `date`" >> /var/log/cuckoo/debug/monitor.`date +%Y%m%d`.log 5 | echo "Restarted $line - `date`" | mail -s "Phoenix.beastmode.tools $line restart" jborland@sparkits.ca 6 | /etc/init.d/$line restart 7 | done 8 | fi 9 | -------------------------------------------------------------------------------- /install/crontab/scripts/root/nord_route.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #/etc/init.d/openvpn start 3 | #VPNS="tun1 tun2 tun3 tun4 tun5 tun6 tun7 tun8 tun9 tun10" 4 | VPNS="tun10" 5 | for i in $VPNS; do 6 | GW=$(ip route list dev $i|awk '{print $NF}') 7 | #ip route list dev $i|while read rule; do 8 | # ip route add $rule dev $i table $i 9 | #done 10 | #GW=`ip route show dev $i|grep kernel|awk '{print $1}'` 11 | ip route add 0.0.0.0/1 via $GW dev $i table $i 12 | ip route add 128.0.0.0/1 via $GW dev $i table $i 13 | done 14 | -------------------------------------------------------------------------------- /install/crontab/scripts/root/openvpn_route.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | VPNS=REPLACEVPNS 3 | for i in $VPNS; do 4 | ip route list dev $i|while read rule; do 5 | ip route add $rule dev $i table $i 6 | done 7 | GW=`ip route show dev $i|grep kernel|awk '{print $1}'` 8 | ip route add 0.0.0.0/1 via $GW dev $i table $i 9 | ip route add 128.0.0.0/1 via $GW dev $i table $i 10 | done 11 | -------------------------------------------------------------------------------- /install/docker-misp/container/supervisord.conf: -------------------------------------------------------------------------------- 1 | [supervisord] 2 | nodaemon=true 3 | 4 | [program:cron] 5 | command=/usr/sbin/cron -f 6 | 7 | [program:syslog-ng] 8 | command=/usr/sbin/syslog-ng -F -p /var/run/syslog-ng.pid --no-caps 9 | 10 | [program:postfix] 11 | process_name = master 12 | directory = /etc/postfix 13 | command=/usr/lib/postfix/sbin/master -c /etc/postfix -d 14 | 15 | [program:mysql] 16 | process_name = mysqld_safe 17 | directory = /var/lib/mysql 18 | command=/usr/bin/mysqld_safe 19 | 20 | [program:redis-server] 21 | process_name = redis-server 22 | directory = /var/lib/redis 23 | command=/usr/bin/redis-server /etc/redis/redis.conf 24 | user=redis 25 | 26 | [program:apache2] 27 | command=/bin/bash -c "source /etc/apache2/envvars && exec /usr/sbin/apache2 -DFOREGROUND" 28 | 29 | [program:misp-modules] 30 | command=/bin/bash -c "/usr/local/bin/misp-modules -l '0.0.0.0' -s" 31 | user = www-data 32 | startsecs = 0 33 | 34 | [program:workers] 35 | command=/bin/bash /var/www/MISP/app/Console/worker/start.sh 36 | user=www-data 37 | -------------------------------------------------------------------------------- /install/docker/crits/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:latest 2 | 3 | MAINTAINER crits 4 | 5 | RUN apt-get -qq update 6 | # git command 7 | RUN apt-get install -y git 8 | # pip command 9 | RUN apt-get install -y python-pip 10 | # lsb_release command 11 | RUN apt-get install -y lsb-release 12 | # sudo command 13 | RUN apt-get install -y sudo 14 | # add-apt-repository command 15 | RUN apt-get install -y software-properties-common 16 | 17 | # Clone the repo 18 | RUN git clone --depth 1 https://github.com/crits/crits.git 19 | 20 | WORKDIR crits 21 | # Install the dependencies 22 | RUN TERM=xterm sh ./script/bootstrap < docker_inputs 23 | 24 | # Create a new admin. Username: "admin" , Password: "pass1PASS123!" 25 | RUN sh contrib/mongo/mongod_start.sh && python manage.py users -u admin -p "pass1PASS123!" -s -i -a -A -e admin@crits.crits -f "first" -l "last" -o "no-org" 26 | 27 | EXPOSE 8080 28 | 29 | CMD sh contrib/mongo/mongod_start.sh && python manage.py runserver 0.0.0.0:8080 -------------------------------------------------------------------------------- /install/docker/elastic/docker.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "docker-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | 7 | "_all": { 8 | "enabled": false 9 | }, 10 | "properties" : { 11 | "@timestamp" : { 12 | "type" : "date" 13 | }}, 14 | "dynamic_templates": [ 15 | { 16 | "strings": { 17 | "match_mapping_type": "string", 18 | "mapping": { 19 | "type": "text", 20 | "fields": { 21 | "raw": { 22 | "type": "keyword", 23 | "ignore_above": 256 24 | } 25 | } 26 | } 27 | } 28 | } 29 | ] 30 | } 31 | } 32 | } 33 | 34 | -------------------------------------------------------------------------------- /install/docker/elastic/elastic.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "hunt-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | "_all": { 7 | "enabled": false 8 | }, 9 | "dynamic_templates": [ 10 | { 11 | "strings": { 12 | "match_mapping_type": "string", 13 | "mapping": { 14 | "type": "text", 15 | "fields": { 16 | "raw": { 17 | "type": "keyword", 18 | "ignore_above": 8192 19 | } 20 | } 21 | } 22 | } 23 | } 24 | ] 25 | },"yara":{"properties":{"meta.date":{"type":"string"},"run_date":{"type":"date","format":"yyyy-MM-dd HH:mm:ss"}}}, 26 | "suricata":{"properties":{"run_date":{"type":"date","format":"yyyy-MM-dd HH:mm:ss"}}} 27 | } 28 | } -------------------------------------------------------------------------------- /install/docker/elastic/fail2ban.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "fail2ban-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | "_all": { 7 | "enabled": false 8 | }, 9 | "dynamic_templates": [ 10 | { 11 | "strings": { 12 | "match_mapping_type": "string", 13 | "mapping": { 14 | "type": "text", 15 | "fields": { 16 | "raw": { 17 | "type": "keyword", 18 | "ignore_above": 256 19 | } 20 | } 21 | } 22 | } 23 | } 24 | ] 25 | } 26 | } 27 | } 28 | 29 | -------------------------------------------------------------------------------- /install/docker/elastic/httpd.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "apache2-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | 7 | "_all": { 8 | "enabled": false 9 | }, 10 | "properties" : { 11 | "Timestamp" : { 12 | "type" : "date", 13 | "format" : "yyyyMMdd'_'HHmmss" 14 | }}, 15 | "dynamic_templates": [ 16 | { 17 | "strings": { 18 | "match_mapping_type": "string", 19 | "mapping": { 20 | "type": "text", 21 | "fields": { 22 | "raw": { 23 | "type": "keyword", 24 | "ignore_above": 256 25 | } 26 | } 27 | } 28 | } 29 | } 30 | ] 31 | } 32 | } 33 | } 34 | 35 | -------------------------------------------------------------------------------- /install/docker/elastic/hunt.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "hunt-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | "_all": { 7 | "enabled": false 8 | }, 9 | "dynamic_templates": [ 10 | { 11 | "strings": { 12 | "match_mapping_type": "string", 13 | "mapping": { 14 | "type": "text", 15 | "fields": { 16 | "raw": { 17 | "type": "keyword", 18 | "ignore_above": 8192 19 | } 20 | } 21 | } 22 | } 23 | } 24 | ] 25 | },"yara":{"properties":{"meta.date":{"type":"string"},"run_date":{"type":"date","format":"yyyy-MM-dd HH:mm:ss"}}}, 26 | "suricata":{"properties":{"run_date":{"type":"date","format":"yyyy-MM-dd HH:mm:ss"}}} 27 | } 28 | } -------------------------------------------------------------------------------- /install/docker/elastic/linux.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "linux-*", 3 | "settings": { "number_of_shards": 1 , "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | 7 | "_all": { 8 | "enabled": false 9 | }, 10 | "properties" : { 11 | "@timestamp" : { 12 | "type" : "date" 13 | }}, 14 | "dynamic_templates": [ 15 | { 16 | "strings": { 17 | "match_mapping_type": "string", 18 | "mapping": { 19 | "type": "text", 20 | "fields": { 21 | "raw": { 22 | "type": "keyword", 23 | "ignore_above": 256 24 | } 25 | } 26 | } 27 | } 28 | } 29 | ] 30 | } 31 | } 32 | } 33 | 34 | -------------------------------------------------------------------------------- /install/docker/elastic/mongostats.template: -------------------------------------------------------------------------------- 1 | { 2 | "template": "mongostats-*", 3 | "settings": { "number_of_shards": 1 , "index.mapping.total_fields.limit": 2000, "number_of_replicas":0}, 4 | "mappings": { 5 | "_default_": { 6 | 7 | "_all": { 8 | "enabled": false 9 | }, 10 | "properties" : { 11 | "@timestamp" : { 12 | "type" : "date" 13 | }}, 14 | "dynamic_templates": [ 15 | { 16 | "strings": { 17 | "match_mapping_type": "string", 18 | "mapping": { 19 | "type": "text", 20 | "fields": { 21 | "raw": { 22 | "type": "keyword", 23 | "ignore_above": 256 24 | } 25 | } 26 | } 27 | } 28 | } 29 | ] 30 | } 31 | } 32 | } 33 | 34 | -------------------------------------------------------------------------------- /install/docker/grafana/es-monitoring.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "ES-monitoring", 3 | "database": "elasticsearch_metrics-*", 4 | "url": "http://172.18.1.253:9200", 5 | "basicAuth": false, 6 | "jsonData": { 7 | "timeField": "@timestamp", 8 | "esVersion": 56, 9 | "tlsSkipVerify": true, 10 | "keepCookies": [], 11 | "maxConcurrentShardRequests": 256 12 | }, 13 | "access": "proxy", 14 | "readOnly": false, 15 | "typeLogoUrl": "public/app/plugins/datasource/elasticsearch/img/elasticsearch.svg", 16 | "orgId": 1, 17 | "user": "", 18 | "password": "", 19 | "type": "elasticsearch", 20 | "id": 2, 21 | "isDefault": false 22 | } -------------------------------------------------------------------------------- /install/docker/grafana/mongo-stats.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "Mongo stats", 3 | "database": "mongostats-*", 4 | "url": "http://172.18.1.253:9200", 5 | "basicAuth": false, 6 | "jsonData": { 7 | "timeField": "localTime", 8 | "esVersion": 56, 9 | "tlsSkipVerify": true, 10 | "keepCookies": [], 11 | "maxConcurrentShardRequests": 256 12 | }, 13 | "access": "proxy", 14 | "readOnly": false, 15 | "typeLogoUrl": "public/app/plugins/datasource/elasticsearch/img/elasticsearch.svg", 16 | "orgId": 1, 17 | "user": "", 18 | "password": "", 19 | "type": "elasticsearch", 20 | "id": 3, 21 | "isDefault": false 22 | } -------------------------------------------------------------------------------- /install/openvpn/readme: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/openvpn/readme -------------------------------------------------------------------------------- /install/openvpn/readme.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/openvpn/readme.md -------------------------------------------------------------------------------- /install/rc.local_template: -------------------------------------------------------------------------------- 1 | #CUCKOOLOCALS 2 | su - CUCKOO_USER -c "vboxmanage hostonlyif ipconfig SANDINT --ip SANDIP --netmask 255.255.255.0" 3 | su - CUCKOO_USER -c "vboxmanage dhcpserver modify --netname HostInterfaceNetworking-vboxnet0 --disable" 4 | /bin/echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag 5 | /bin/echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled 6 | su - CUCKOO_USER -c "python2.7 CUCKOODIR/utils/elasticsearch2elastic.py > /dev/null &" 7 | #ENDCUCKOOLOCALS -------------------------------------------------------------------------------- /install/rsyslog/fail2ban.rules: -------------------------------------------------------------------------------- 1 | rule=: %sev:char-sep: % [%failrule:char-sep:]%] %action:char-sep: % %ip:ipv4% 2 | rule=: %sev:char-sep: % [%failrule:char-sep:]%] %ip:ipv4% %action:rest% 3 | rule=: %sev:char-sep: % [%failrule:char-sep:]%] %action:char-sep: % %ip:ipv4% by ip -------------------------------------------------------------------------------- /install/screencaps/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/1.png -------------------------------------------------------------------------------- /install/screencaps/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/2.png -------------------------------------------------------------------------------- /install/screencaps/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/3.png -------------------------------------------------------------------------------- /install/screencaps/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/4.png -------------------------------------------------------------------------------- /install/screencaps/5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/5.png -------------------------------------------------------------------------------- /install/screencaps/6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/6.png -------------------------------------------------------------------------------- /install/screencaps/SharingGroups1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/SharingGroups1.png -------------------------------------------------------------------------------- /install/screencaps/SharingGroups2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/SharingGroups2.png -------------------------------------------------------------------------------- /install/screencaps/SharingGroups3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/SharingGroups3.png -------------------------------------------------------------------------------- /install/screencaps/SharingGroups4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/SharingGroups4.png -------------------------------------------------------------------------------- /install/screencaps/Tags1.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/Tags1.PNG -------------------------------------------------------------------------------- /install/screencaps/Tags2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/Tags2.png -------------------------------------------------------------------------------- /install/screencaps/Tags3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/Tags3.png -------------------------------------------------------------------------------- /install/screencaps/analysis_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/analysis_1.png -------------------------------------------------------------------------------- /install/screencaps/analysis_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/analysis_2.png -------------------------------------------------------------------------------- /install/screencaps/correlation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/correlation.png -------------------------------------------------------------------------------- /install/screencaps/cuckoo_complete.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/cuckoo_complete.png -------------------------------------------------------------------------------- /install/screencaps/full_restart.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/full_restart.png -------------------------------------------------------------------------------- /install/screencaps/grafana_es.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/grafana_es.png -------------------------------------------------------------------------------- /install/screencaps/grafana_mongo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/grafana_mongo.png -------------------------------------------------------------------------------- /install/screencaps/iptables4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/iptables4.png -------------------------------------------------------------------------------- /install/screencaps/iptables6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/iptables6.png -------------------------------------------------------------------------------- /install/screencaps/kibana_iptables.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/kibana_iptables.png -------------------------------------------------------------------------------- /install/screencaps/kibana_web_all.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/kibana_web_all.png -------------------------------------------------------------------------------- /install/screencaps/kibana_web_errors.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/kibana_web_errors.png -------------------------------------------------------------------------------- /install/screencaps/kibana_web_normal.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/kibana_web_normal.png -------------------------------------------------------------------------------- /install/screencaps/misp1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp1.png -------------------------------------------------------------------------------- /install/screencaps/misp2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp2.png -------------------------------------------------------------------------------- /install/screencaps/misp3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp3.png -------------------------------------------------------------------------------- /install/screencaps/misp4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp4.png -------------------------------------------------------------------------------- /install/screencaps/misp5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp5.png -------------------------------------------------------------------------------- /install/screencaps/misp6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp6.png -------------------------------------------------------------------------------- /install/screencaps/misp7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp7.png -------------------------------------------------------------------------------- /install/screencaps/misp_viz.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/misp_viz.png -------------------------------------------------------------------------------- /install/screencaps/moloch.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/moloch.png -------------------------------------------------------------------------------- /install/screencaps/netdata.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/netdata.png -------------------------------------------------------------------------------- /install/screencaps/recents.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/recents.png -------------------------------------------------------------------------------- /install/screencaps/submit.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/submit.png -------------------------------------------------------------------------------- /install/screencaps/vboxlic.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/vboxlic.png -------------------------------------------------------------------------------- /install/screencaps/vpnconf.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/screencaps/vpnconf.PNG -------------------------------------------------------------------------------- /install/virtualbox/limits.conf_template: -------------------------------------------------------------------------------- 1 | #BEGINCUCKOOLIMITS 2 | * hard nofile 500000 3 | * soft nofile 500000 4 | root hard nofile 500000 5 | root soft nofile 500000 6 | #ENDCUCKOOLIMITS -------------------------------------------------------------------------------- /install/virtualbox/readme: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/virtualbox/readme -------------------------------------------------------------------------------- /install/virtualbox/readme.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/install/virtualbox/readme.md -------------------------------------------------------------------------------- /lib/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /lib/api_fingerprint/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/lib/api_fingerprint/__init__.py -------------------------------------------------------------------------------- /lib/bluecoat_sitereview/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/lib/bluecoat_sitereview/__init__.py -------------------------------------------------------------------------------- /lib/cuckoo/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /lib/cuckoo/common/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /lib/cuckoo/common/constants.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import os 7 | 8 | _current_dir = os.path.abspath(os.path.dirname(__file__)) 9 | CUCKOO_ROOT = os.path.normpath(os.path.join(_current_dir, "..", "..", "..")) 10 | 11 | CUCKOO_VERSION = "2.0-dev" 12 | CUCKOO_GUEST_PORT = 8739 13 | CUCKOO_GUEST_INIT = 0x001 14 | CUCKOO_GUEST_RUNNING = 0x002 15 | CUCKOO_GUEST_COMPLETED = 0x003 16 | CUCKOO_GUEST_FAILED = 0x004 17 | GITHUB_URL = "https://github.com/cuckoosandbox/cuckoo" 18 | ISSUES_PAGE_URL = "https://github.com/cuckoosandbox/cuckoo/issues" 19 | 20 | LATEST_HTTPREPLAY = "0.1.17" 21 | -------------------------------------------------------------------------------- /lib/cuckoo/common/defines.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | REG_NONE = 0 7 | REG_SZ = 1 8 | REG_EXPAND_SZ = 2 9 | REG_BINARY = 3 10 | REG_DWORD_LITTLE_ENDIAN = 4 11 | REG_DWORD = 4 12 | REG_DWORD_BIG_ENDIAN = 5 13 | -------------------------------------------------------------------------------- /lib/cuckoo/core/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /lib/phoenix/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/lib/phoenix/__init__.py -------------------------------------------------------------------------------- /lib/phoenix/constants.py: -------------------------------------------------------------------------------- 1 | PUBLISHERS_GROUP = "Publishers" -------------------------------------------------------------------------------- /lib/phoenix/rule_reader.py: -------------------------------------------------------------------------------- 1 | import os 2 | from idstools import rule 3 | from django.conf import settings 4 | 5 | 6 | def get_suricata_rules(path="/etc/suricata/rules"): 7 | ruledict = {} 8 | for filename in os.listdir(path): 9 | if filename.endswith('.rules'): 10 | part_dict = {(rule_obj.sid, rule_obj.msg): rule_obj.raw for rule_obj in 11 | rule.parse_file(os.path.join(path, filename))} 12 | ruledict.update(part_dict) 13 | return ruledict 14 | 15 | 16 | def get_hunting_suri_rules(hunt_id): 17 | analyses_prefix = settings.ANALYSES_PREFIX 18 | hunt_path = os.path.join(analyses_prefix, ".hunting", hunt_id,"0") 19 | return get_suricata_rules(hunt_path) -------------------------------------------------------------------------------- /lib/tldr/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/lib/tldr/__init__.py -------------------------------------------------------------------------------- /lib/tldr/cli: -------------------------------------------------------------------------------- 1 | C:\\Windows\\system32\\lsass.exe 2 | -------------------------------------------------------------------------------- /lib/tldr/prefix: -------------------------------------------------------------------------------- 1 | crl.microsoft.com 2 | gn.symcd.com 3 | ocsp.digicert.com 4 | sv.symcd.com 5 | crl.verisign.com 6 | www.bing.com 7 | www.msftncsi.com 8 | ss.symcb.com 9 | s2.symcb.com 10 | s1.symcb.com 11 | ss.symcd.com 12 | crl3.digicert.com 13 | ocsp.verisign.com 14 | checkip.dyndns.org 15 | -------------------------------------------------------------------------------- /modules/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/machinery/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/machinery/kvm.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.cuckoo.common.abstracts import LibVirtMachinery 7 | 8 | class KVM(LibVirtMachinery): 9 | """Virtualization layer for KVM based on python-libvirt.""" 10 | 11 | # Set KVM connection string. 12 | dsn = "qemu:///system" 13 | -------------------------------------------------------------------------------- /modules/processing/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/processing/buffer.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import os 7 | 8 | from lib.cuckoo.common.abstracts import Processing 9 | from lib.cuckoo.common.objects import File 10 | 11 | class DroppedBuffer(Processing): 12 | """Dropped buffer analysis.""" 13 | 14 | def run(self): 15 | """Run analysis. 16 | @return: list of dropped files with related information. 17 | """ 18 | self.key = "buffer" 19 | dropped_files = [] 20 | 21 | for dir_name, dir_names, file_names in os.walk(self.buffer_path): 22 | for file_name in file_names: 23 | file_path = os.path.join(dir_name, file_name) 24 | file_info = File(file_path=file_path).get_all() 25 | dropped_files.append(file_info) 26 | 27 | return dropped_files 28 | -------------------------------------------------------------------------------- /modules/processing/platform/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/reporting/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | -------------------------------------------------------------------------------- /modules/signatures/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2017 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from . import android, cross, darwin, network, windows 6 | -------------------------------------------------------------------------------- /modules/signatures/creates_exe.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from lib.cuckoo.common.abstracts import Signature 7 | 8 | class CreatesExe(Signature): 9 | name = "creates_exe" 10 | description = "Creates a Windows executable on the filesystem" 11 | severity = 2 12 | categories = ["generic"] 13 | authors = ["Cuckoo Developers"] 14 | minimum = "2.0" 15 | 16 | # This is a signature template. It should be used as a skeleton for 17 | # creating custom signatures, therefore is disabled by default. 18 | # It doesn't verify whether a .exe is actually being created, but 19 | # it matches files being opened with any access type, including 20 | # read and attributes lookup. 21 | enabled = False 22 | 23 | def on_complete(self): 24 | match = self.check_file(pattern=".*\\.exe$", regex=True) 25 | if match: 26 | self.mark_ioc("file", match) 27 | return True 28 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | pyinotify==0.9.6 2 | alembic==0.8.0 3 | beautifulsoup4==4.4.1 4 | cffi==1.13.2 5 | chardet==2.3.0 6 | cryptography==2.8 7 | Django==1.8.4 8 | django.js==0.8.1 9 | dpkt==1.8.7 10 | docker==3.0.0 11 | ecdsa==0.13 12 | elasticsearch==2.2.0 13 | enum34==1.0.4 14 | Flask==0.10.1 15 | grafana-api-client==0.2.0 16 | gunicorn==19.9.0 17 | HTTPReplay==0.1.18 18 | idna==2.0 19 | idstools==0.6.3 20 | ipaddress==1.0.16 21 | itsdangerous==0.24 22 | Jinja2==2.8 23 | jsbeautifier==1.6.2 24 | jsonschema==2.6.0 25 | lxml==3.6.0 26 | Mako==1.0.1 27 | MarkupSafe==0.23 28 | MySQL-python==1.2.5 29 | ndg-httpsclient==0.4.0 30 | oletools==0.42 31 | pandas==0.23.4 32 | pathos==0.2.1 33 | peepdf==0.3.2 34 | pefile2==1.2.11 35 | pyasn1==0.1.8 36 | pycparser==2.14 37 | pydeep==0.2 38 | pymisp==2.4.92.1 39 | pymongo==3.7.2 40 | pyOpenSSL==19.1.0 41 | python-dateutil==2.7.5 42 | python-editor==0.3 43 | python-magic==0.4.6 44 | requests==2.14.2 45 | six==1.9.0 46 | SQLAlchemy==1.2.17 47 | tlslite-ng==0.6.0-alpha3 48 | wakeonlan==0.2.2 49 | Werkzeug==0.10.4 50 | yara-python==3.5.0 51 | pydeep==0.2 -------------------------------------------------------------------------------- /tests/assets/test_apicalls_basic.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char *argv[]) 4 | { 5 | system("whoami"); 6 | return 0; 7 | } 8 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_errno.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char const *argv[]) 6 | { 7 | errno = 0; 8 | fopen("doesn't matter", "invalid mode"); 9 | // errno = EINVAL = 22 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_errno_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char const *argv[]) 6 | { 7 | errno = 0; 8 | fopen("doesn't matter", "r"); 9 | // errno = EINVAL = 22 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_from_dynamic_library.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char const *argv[]) 6 | { 7 | void *h = dlopen("libruby.dylib", RTLD_LAZY); 8 | if (h == NULL) { 9 | return EXIT_FAILURE; 10 | } else { 11 | int (*rb_isalpha)(int) = dlsym(h, "rb_isalpha"); 12 | int char_a = 0x61; 13 | return rb_isalpha(char_a) ? EXIT_SUCCESS : EXIT_FAILURE; 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_from_dynamic_library_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char const *argv[]) 6 | { 7 | void *h = dlopen("libruby.dylib", RTLD_LAZY); 8 | if (h == NULL) { 9 | return EXIT_FAILURE; 10 | } else { 11 | int (*rb_isalpha)(int) = dlsym(h, "rb_isalpha"); 12 | int char_a = 0x61; 13 | return rb_isalpha(char_a) ? EXIT_SUCCESS : EXIT_FAILURE; 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char *argv[]) 8 | { 9 | struct passwd *pw = getpwuid(geteuid()); 10 | assert(pw != NULL); 11 | if (strcmp("root", pw->pw_name) == 0) { 12 | printf("I'm root!\n"); 13 | } else { 14 | printf("I'm user!\n"); 15 | } 16 | 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_timeout.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int argc, char *argv[]) 5 | { 6 | system("whoami"); 7 | sleep(10); 8 | system("whoami"); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_timeout_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int argc, char *argv[]) 5 | { 6 | system("whoami"); 7 | sleep(10); 8 | system("whoami"); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_with_args.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int argc, char *argv[]) 5 | { 6 | printf("%d\n", atoi(argv[1])); 7 | } 8 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_with_args_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int argc, char *argv[]) 5 | { 6 | printf("%d\n", atoi(argv[1])); 7 | } 8 | -------------------------------------------------------------------------------- /tests/assets/test_apicalls_without_target.c: -------------------------------------------------------------------------------- 1 | int main(int argc, char *argv[]) 2 | { 3 | } 4 | -------------------------------------------------------------------------------- /tests/assets/test_cuckoo_dropped_files: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/tests/assets/test_cuckoo_dropped_files -------------------------------------------------------------------------------- /tests/assets/test_cuckoo_dropped_files.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char const *argv[]) 6 | { 7 | FILE *f = fopen("something.txt", "w"); 8 | if (f == NULL) { 9 | return EXIT_FAILURE; 10 | } 11 | fprintf(f, "HERE YOU ARE\n"); 12 | fclose(f); 13 | return EXIT_SUCCESS; 14 | } 15 | -------------------------------------------------------------------------------- /tests/assets/test_cuckoo_parents_and_children: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/tests/assets/test_cuckoo_parents_and_children -------------------------------------------------------------------------------- /tests/assets/test_dtruss_children.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | int main(int argc, char *argv[]) 10 | { 11 | write(1, "Hello, I'm parent!", 18); 12 | 13 | pid_t child = fork(); 14 | assert(child >= 0); 15 | 16 | if (child == 0) { 17 | // child 18 | write(1, "Hello from child!", 17); 19 | } else { 20 | // parent 21 | printf("Hello again from the parent! My child is %d\n", child); 22 | int status; 23 | wait(&status); 24 | } 25 | 26 | 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_helloworld.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char *argv[]) 4 | { 5 | printf("Hello, world!\n"); 6 | } 7 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_non_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char *argv[]) 8 | { 9 | struct passwd *pw = getpwuid(geteuid()); 10 | assert(pw != NULL); 11 | if (strcmp("root", pw->pw_name) == 0) { 12 | printf("Hello, r00t!\n"); 13 | } else { 14 | printf("Hello, user!\n"); 15 | } 16 | 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_root.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char *argv[]) 8 | { 9 | struct passwd *pw = getpwuid(geteuid()); 10 | assert(pw != NULL); 11 | if (strcmp("root", pw->pw_name) == 0) { 12 | printf("Hello, r00t!\n"); 13 | } else { 14 | printf("Hello, user!\n"); 15 | } 16 | 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_specific_syscall.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char *argv[]) 4 | { 5 | fprintf(stdout, "Hello, dtruss!\n"); 6 | } 7 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_timeout.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int argc, char *argv[]) 5 | { 6 | write(1, "Hello, world!\n", 0xE); 7 | sleep(5); 8 | write(1, "Hello, world!\n", 0xE); 9 | } 10 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_with_args.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char *argv[]) 4 | { 5 | printf("Hello, %s!\n", argv[1]); 6 | } 7 | -------------------------------------------------------------------------------- /tests/assets/test_dtruss_without_target.c: -------------------------------------------------------------------------------- 1 | int main(int argc, char *argv[]) 2 | { 3 | } 4 | -------------------------------------------------------------------------------- /tests/assets/test_ipconnections_empty.c: -------------------------------------------------------------------------------- 1 | int main(int argc, char **argv) 2 | { 3 | return 0; 4 | } 5 | -------------------------------------------------------------------------------- /tests/assets/test_ipconnections_target_with_args.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | void send_tcp(const char *remote, const int port) 8 | { 9 | int sd = socket(AF_INET, SOCK_STREAM, 0); 10 | assert(sd > 0); 11 | 12 | struct sockaddr_in addr; 13 | memset(&addr, 0, sizeof(addr)); 14 | addr.sin_family = AF_INET; 15 | addr.sin_addr.s_addr = inet_addr(remote); 16 | addr.sin_port = htons(port); 17 | 18 | connect(sd, (struct sockaddr *)&addr , sizeof(addr)); 19 | close(sd); 20 | } 21 | 22 | int main(int argc, char *argv[]) 23 | { 24 | send_tcp(argv[1], 80); 25 | return 0; 26 | } 27 | -------------------------------------------------------------------------------- /tests/assets/test_ipconnections_tcp.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char *argv[]) 8 | { 9 | int sd = socket(AF_INET, SOCK_STREAM, 0); 10 | assert(sd > 0); 11 | 12 | struct sockaddr_in addr; 13 | memset(&addr, 0, sizeof(addr)); 14 | addr.sin_family = AF_INET; 15 | addr.sin_addr.s_addr = inet_addr("127.0.0.1"); 16 | addr.sin_port = htons(80); 17 | 18 | int ret = connect(sd, (struct sockaddr *)&addr , sizeof(addr)); 19 | 20 | return close(sd) && ret == 0; 21 | } 22 | -------------------------------------------------------------------------------- /tests/assets/test_ipconnections_tcp_with_timeout.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | void send_tcp(const char *remote, const int port) 8 | { 9 | int sd = socket(AF_INET, SOCK_STREAM, 0); 10 | assert(sd > 0); 11 | 12 | struct sockaddr_in addr; 13 | memset(&addr, 0, sizeof(addr)); 14 | addr.sin_family = AF_INET; 15 | addr.sin_addr.s_addr = inet_addr(remote); 16 | addr.sin_port = htons(port); 17 | 18 | connect(sd, (struct sockaddr *)&addr , sizeof(addr)); 19 | close(sd); 20 | } 21 | 22 | int main(int argc, char *argv[]) 23 | { 24 | send_tcp("127.0.0.1", 80); 25 | sleep(5); 26 | send_tcp("127.0.0.1", 80); 27 | 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /tests/assets/test_ipconnections_udp.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | int main(int argc, char *argv[]) 11 | { 12 | int sd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); 13 | assert(sd > 0); 14 | 15 | struct sockaddr_in addr; 16 | memset(&addr, 0, sizeof(addr)); 17 | addr.sin_family = AF_INET; 18 | inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr); 19 | addr.sin_port = htons(53); 20 | 21 | char *request = "hi, i like you"; 22 | int ret = sendto(sd, request, strlen(request), 0, (struct sockaddr*)&addr, sizeof(addr)); 23 | assert(ret >= 0); 24 | 25 | close(sd); 26 | 27 | return EXIT_SUCCESS; 28 | } 29 | -------------------------------------------------------------------------------- /tests/colors_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from nose.tools import assert_equals 7 | 8 | from lib.cuckoo.common.colors import color 9 | 10 | 11 | def test_return_text(): 12 | """Test colorized text contains the input string.""" 13 | assert "foo" in color("foo", 11) -------------------------------------------------------------------------------- /tests/reporter_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import os 7 | import tempfile 8 | from nose.tools import assert_equals 9 | 10 | from lib.cuckoo.common.abstracts import Report 11 | from lib.cuckoo.common.config import Config 12 | 13 | 14 | class ReportMock(Report): 15 | def run(self, data): 16 | return 17 | 18 | class ReportAlterMock(Report): 19 | """Corrupts results dict.""" 20 | def run(self, data): 21 | data['foo'] = 'notbar' 22 | return 23 | -------------------------------------------------------------------------------- /tests/sniffer_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from nose.tools import assert_equals 7 | -------------------------------------------------------------------------------- /tests/test_analyzer.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2015 Dmitry Rodionov 3 | # This software may be modified and distributed under the terms 4 | # of the MIT license. See the LICENSE file for details. 5 | 6 | import unittest 7 | from analyzer.darwin.lib.core.osx import set_wallclock 8 | 9 | class TestAnalyzer(unittest.TestCase): 10 | 11 | def test_set_wallclock(self): 12 | # given 13 | clock_str = "20151203T15:23:43" 14 | # when 15 | result = set_wallclock(clock_str, just_testing=True) 16 | # then 17 | self.assertEqual(result, "sudo date 1203152315.43") 18 | -------------------------------------------------------------------------------- /update_phoenix.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | SRC_HOME=$(mktemp -d) 3 | CUCKOO_HOME=$PWD 4 | LOCALDIR=$PWD 5 | NOW=$(date +%Y%m%d_%H%M%S) 6 | cp $CUCKOO_HOME/install/ubuntu_install.sh $CUCKOO_HOME/install/ubuntu_install.sh.$NOW 7 | git clone https://github.com/SparkITSolutions/phoenix.git $SRC_HOME 8 | 9 | rsync -ravhu --exclude 'conf' --exclude '.git*' --exclude '*settings.py' --exclude 'storage' --exclude 'install' $SRC_HOME/* $CUCKOO_HOME/ 10 | cd $CUCKOO_HOME/docker/yara 11 | docker build -t prodyara . 12 | cd $CUCKOO_HOME/docker/suricata 13 | docker build -t prodsuricata . 14 | chown -R cuckoo.cuckoo $CUCKOO_HOME 15 | rm -rf $SRC_HOME 16 | cd $CUCKOO_HOME/web 17 | pip install -r ../requirements.txt 18 | 19 | python manage.py makemigrations auth 20 | python manage.py migrate auth 21 | 22 | python manage.py makemigrations analysis 23 | python manage.py migrate 24 | 25 | cd $CUCKOO_HOME/utils/db_migration 26 | alembic upgrade head 27 | -------------------------------------------------------------------------------- /utils/api_wsgi.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | 3 | from api import app as application 4 | 5 | 6 | if __name__ == "__main__": 7 | application.run() 8 | -------------------------------------------------------------------------------- /utils/db_migration/script.py.mako: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """${message} 7 | 8 | Revision ID: ${up_revision} 9 | Revises: ${down_revision} 10 | Create Date: ${create_date} 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = ${repr(up_revision)} 16 | down_revision = ${repr(down_revision)} 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | ${imports if imports else ""} 21 | 22 | def upgrade(): 23 | ${upgrades if upgrades else "pass"} 24 | 25 | 26 | def downgrade(): 27 | ${downgrades if downgrades else "pass"} 28 | -------------------------------------------------------------------------------- /utils/db_migration/versions/create_filepath_table.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """Create filepath table 7 | 8 | Revision ID: 25cb9090c7f9 9 | Revises: cd31654d187 10 | Create Date: 2019-02-24 02:28:43.734531 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = '25cb9090c7f9' 16 | down_revision = 'cd31654d187' 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | 21 | 22 | def upgrade(): 23 | op.create_table('filepaths', 24 | sa.Column('task_id',sa.Integer, primary_key=True), 25 | sa.Column('file_path', sa.String(255), primary_key=True)) 26 | 27 | 28 | def downgrade(): 29 | op.drop_table('filepaths') 30 | -------------------------------------------------------------------------------- /utils/db_migration/versions/from_1_2_to_1_3-add_task_owner.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2014 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | """Database migration from Cuckoo 1.2 to Cuckoo 1.3. 6 | Added task owner used by the Distributed API. 7 | 8 | Revision ID: 3aa42d870199 9 | Revises: 18eee46c6f81 10 | Create Date: 2014-12-04 11:19:49.388410 11 | """ 12 | 13 | # Revision identifiers, used by Alembic. 14 | revision = "3aa42d870199" 15 | down_revision = "495d5a6edef3" 16 | 17 | from alembic import op 18 | import sqlalchemy as sa 19 | 20 | 21 | def upgrade(): 22 | op.add_column("tasks", sa.Column("owner", sa.String(length=64), nullable=True)) 23 | 24 | 25 | def downgrade(): 26 | op.drop_column("tasks", "owner") 27 | -------------------------------------------------------------------------------- /utils/db_migration/versions/from_1_2_to_2_0-guest_status.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """guest status 7 | 8 | Revision ID: 1583656cb935 9 | Revises: 1070cd314621 10 | Create Date: 2015-12-15 14:25:27.379967 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = "1583656cb935" 16 | down_revision = "1070cd314621" 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | 21 | def upgrade(): 22 | op.add_column("guests", sa.Column("status", sa.String(length=16), nullable=False, server_default="stopped")) 23 | 24 | def downgrade(): 25 | op.drop_column("guests", "status") 26 | -------------------------------------------------------------------------------- /utils/db_migration/versions/from_1_2_to_2_0-machine_options.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """machine options 7 | 8 | Revision ID: cd31654d187 9 | Revises: 1583656cb935 10 | Create Date: 2015-12-16 11:07:59.948819 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = "cd31654d187" 16 | down_revision = "1583656cb935" 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | 21 | def upgrade(): 22 | op.add_column("machines", sa.Column("options", sa.String(length=255), nullable=True)) 23 | 24 | def downgrade(): 25 | op.drop_column("machines", "options") 26 | -------------------------------------------------------------------------------- /utils/db_migration/versions/from_1_2_to_2_0-processing-column.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """processing column 7 | 8 | Revision ID: 4a04f40d4ab4 9 | Revises: 3aa42d870199 10 | Create Date: 2015-11-15 00:57:32.068872 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = "4a04f40d4ab4" 16 | down_revision = "3aa42d870199" 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | 21 | def upgrade(): 22 | op.add_column("tasks", sa.Column("processing", sa.String(length=16), nullable=True)) 23 | 24 | def downgrade(): 25 | op.drop_column("tasks", "processing") 26 | -------------------------------------------------------------------------------- /utils/db_migration/versions/from_1_2_to_2_0-taken-route.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | """taken route 7 | 8 | Revision ID: 1070cd314621 9 | Revises: 4a04f40d4ab4 10 | Create Date: 2015-11-21 23:10:04.724813 11 | 12 | """ 13 | 14 | # revision identifiers, used by Alembic. 15 | revision = "1070cd314621" 16 | down_revision = "4a04f40d4ab4" 17 | 18 | from alembic import op 19 | import sqlalchemy as sa 20 | 21 | def upgrade(): 22 | op.add_column("tasks", sa.Column("route", sa.String(length=16), nullable=True)) 23 | 24 | def downgrade(): 25 | op.drop_column("tasks", "route") 26 | -------------------------------------------------------------------------------- /utils/fix_openvpn.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | for i in {0..35}; do 3 | ip route list dev tun$i|while read rule; do 4 | ip route add $rule dev tun$i table tun$i 5 | done 6 | GW=`ip route show dev tun$i|grep kernel|awk '{print $1}'` 7 | ip route add 0.0.0.0/1 via $GW dev tun$i table tun$i 8 | ip route add 128.0.0.0/1 via $GW dev tun$i table tun$i 9 | done 10 | -------------------------------------------------------------------------------- /utils/mongo_stats.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | MYDATE=$(date -u +%Y-%m-%dT%H:%M:%S.000'Z') 3 | UUID=$(uuidgen) 4 | UUID1=$(uuidgen) 5 | ES="$1" 6 | MONGOS="$2" 7 | TODAY=$(date +%Y%m%d) 8 | INDEX="mongostats-" 9 | MSTATS=$(mongo $MONGOS/cuckoo --eval 'JSON.stringify(db.serverStatus())' | tail -n +3 | sed 's/\(NumberLong([[:punct:]]\?\)\([[:digit:]]*\)\([[:punct:]]\?)\)/\2/' | sed 's/\(ISODate(\)\(.*\)\()\)/\2/'|sed -e 's/^MongoDB server version: 3.6.2//g') 10 | MSTATS1=$(mongo $MONGOS/cuckoo --eval 'JSON.stringify(db.stats())' | tail -n +3 | sed 's/\(NumberLong([[:punct:]]\?\)\([[:digit:]]*\)\([[:punct:]]\?)\)/\2/' | sed 's/\(ISODate(\)\(.*\)\()\)/\2/'|sed -e 's/^MongoDB server version: 3.6.2//g' -e "s/^{/{\"localTime\":\"$MYDATE\",/") 11 | #echo $MSTATS 12 | #echo $MSTATS1 13 | curl -H "Content-Type: application/json" -XPUT "${ES}/${INDEX}${TODAY}/stats/$UUID" -d "$MSTATS" >/dev/null 2>&1 14 | curl -H "Content-Type: application/json" -XPUT "${ES}/${INDEX}${TODAY}/stats/$UUID1" -d "$MSTATS1" >/dev/null 2>&1 15 | 16 | -------------------------------------------------------------------------------- /utils/nw.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | for i in {0..35}; do 3 | ifconfig tun$i|grep 'inet addr'|awk -F 'addr:' '{print $2}'|awk '{print $1}'|sed -r 's/[0-9]+$/1/g'|while read ip ; do 4 | ping -I tun$i -nn -W 5 -i 120 -s 20 -p 4b6565702d416c697665 $ip >> /var/log/ping.log 2>&1 & 5 | #C=`ping -c3 $ip |grep "100% packet loss"` 6 | #if [ -n "$C" ]; then 7 | # S=0 8 | #else 9 | # S=1 10 | #fi 11 | #echo "{ \"ts\" : \"`date`\", \"int\" : \"tun${i}\", \"ip\" : \"$ip\", \"status\" : $S }" 12 | done 13 | done 14 | -------------------------------------------------------------------------------- /utils/rawdb.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import IPython 7 | import os.path 8 | import sys 9 | 10 | sys.path.insert(0, os.path.join(os.path.abspath(os.path.dirname(__file__)), "..")) 11 | 12 | from lib.cuckoo.core.database import * 13 | 14 | if __name__ == "__main__": 15 | db = Database(echo=True) 16 | s = db.Session() 17 | 18 | IPython.start_ipython(user_ns=locals()) 19 | -------------------------------------------------------------------------------- /utils/so_watcher/rules/watcher_rules.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/utils/so_watcher/rules/watcher_rules.yar -------------------------------------------------------------------------------- /utils/start-distributed.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | DISTADDR="127.0.0.1" 4 | . /etc/default/cuckoo 5 | 6 | sudo service uwsgi start cuckoo-distributed 7 | sudo service nginx start 8 | 9 | sudo start cuckoo-distributed-instance INSTANCE=dist.status 10 | sudo start cuckoo-distributed-instance INSTANCE=dist.scheduler 11 | 12 | for worker in $(curl -s "$DISTADDR:9003/api/node?mode=workers"); do 13 | sudo start cuckoo-distributed-instance "INSTANCE=$worker" 14 | done 15 | -------------------------------------------------------------------------------- /utils/stop-distributed.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | DISTADDR="127.0.0.1" 4 | . /etc/default/cuckoo 5 | 6 | for worker in $(curl -s "$DISTADDR:9003/api/node?mode=workers"); do 7 | sudo stop cuckoo-distributed-instance "INSTANCE=$worker" 8 | done 9 | 10 | sudo stop cuckoo-distributed-instance INSTANCE=dist.status 11 | sudo stop cuckoo-distributed-instance INSTANCE=dist.scheduler 12 | 13 | sudo service uwsgi stop cuckoo-distributed 14 | sudo service nginx stop 15 | -------------------------------------------------------------------------------- /utils/submitters/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/utils/submitters/__init__.py -------------------------------------------------------------------------------- /utils/suricata.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # Install Suricata. 4 | # $ sudo apt-get install software-properties-common 5 | # $ sudo add-apt-repository ppa:oisf/suricata-stable 6 | # $ sudo apt-get update 7 | # $ sudo apt-get install suricata 8 | # 9 | # Setup Suricata configuration. 10 | # 11 | # In /etc/default/suricata, set RUN to "no". 12 | # 13 | # In /etc/suricata/suricata.yaml apply the following changes; 14 | # * Set "unix-command.enabled" to "yes". 15 | # * Set "unix-command.filename" to "cuckoo.socket". 16 | # * Set "outputs.eve-log.enabled" to "yes". 17 | # * Set "run-as.user to "your cuckoo user" 18 | # * Set "run-as.group to "your cuckoo user group" 19 | # * TODO More items. 20 | # 21 | # Add "@reboot /opt/cuckoo/utils/suricata.sh" to the root crontab. 22 | 23 | . /etc/default/cuckoo 24 | 25 | # Do we want to run Suricata in the background? 26 | if [ "$SURICATA" -eq 0 ]; then 27 | exit 28 | fi 29 | 30 | mkdir /var/run/suricata 31 | chown cuckoo:cuckoo /var/run/suricata 32 | 33 | suricata --unix-socket -D 34 | 35 | while [ ! -e /var/run/suricata/cuckoo.socket ]; do 36 | sleep 1 37 | done 38 | -------------------------------------------------------------------------------- /web/.gitignore: -------------------------------------------------------------------------------- 1 | tmp_uploads 2 | *.swp 3 | *.pyc 4 | -------------------------------------------------------------------------------- /web/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/__init__.py -------------------------------------------------------------------------------- /web/advanced_search/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/advanced_search/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file "docs/LICENSE" for copying permission. 5 | 6 | from . import views 7 | from django.conf.urls import url 8 | 9 | urlpatterns = [ 10 | url(r"^$", views.index) 11 | ] 12 | -------------------------------------------------------------------------------- /web/analysis/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/analysis/forms.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from django import forms 7 | 8 | from submission.models import Comment, Tag 9 | 10 | class CommentForm(forms.ModelForm): 11 | class Meta: 12 | model = Comment 13 | fields = ["message"] 14 | 15 | class TagForm(forms.ModelForm): 16 | class Meta: 17 | model = Tag 18 | fields = ["name"] 19 | -------------------------------------------------------------------------------- /web/analysis/migrations/0001_initial.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | from django.conf import settings 7 | 8 | 9 | class Migration(migrations.Migration): 10 | 11 | dependencies = [ 12 | migrations.swappable_dependency(settings.AUTH_USER_MODEL), 13 | ("auth","0006_require_contenttypes_0002") 14 | ] 15 | 16 | operations = [ 17 | migrations.CreateModel( 18 | name='UsageLimits', 19 | fields=[ 20 | ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), 21 | ('allowed_per_day', models.IntegerField(default=25)), 22 | ('used_today', models.IntegerField(default=0)), 23 | ('last_date_checked', models.DateField(auto_now=True)), 24 | ('user', models.OneToOneField(to=settings.AUTH_USER_MODEL)), 25 | ], 26 | ), 27 | ] 28 | -------------------------------------------------------------------------------- /web/analysis/migrations/0002_publishers.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.conf import settings 5 | from django.db import migrations 6 | 7 | from lib.phoenix import constants 8 | 9 | 10 | def forwards_func(apps, schema_editor): 11 | group = apps.get_model("auth","Group") 12 | db_alias = schema_editor.connection.alias 13 | group.objects.using(db_alias).get_or_create(name=constants.PUBLISHERS_GROUP) 14 | 15 | def reverse_func(apps, schema_editor): 16 | group = apps.get_model("auth", "Group") 17 | db_alias = schema_editor.connection.alias 18 | group.objects.using(db_alias).filter(name=constants.PUBLISHERS_GROUP).delete() 19 | 20 | class Migration(migrations.Migration): 21 | 22 | dependencies = [ 23 | migrations.swappable_dependency(settings.AUTH_USER_MODEL), 24 | ("auth","0006_require_contenttypes_0002") 25 | ] 26 | 27 | operations = [ 28 | migrations.RunPython(forwards_func, reverse_func) 29 | ] 30 | -------------------------------------------------------------------------------- /web/analysis/migrations/0003_merge.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import models, migrations 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ('analysis', '0002_publishers'), 11 | ('analysis', '0001_initial'), 12 | ] 13 | 14 | operations = [ 15 | ] -------------------------------------------------------------------------------- /web/analysis/migrations/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/analysis/migrations/__init__.py -------------------------------------------------------------------------------- /web/analysis/templatetags/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/compare/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file "docs/LICENSE" for copying permission. -------------------------------------------------------------------------------- /web/compare/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file "docs/LICENSE" for copying permission. 5 | 6 | from . import views 7 | from django.conf.urls import url 8 | 9 | urlpatterns = [ 10 | url(r"^(?P\d+)/$", views.left), 11 | url(r"^(?P\d+)/(?P\d+)/$", views.both), 12 | url(r"^(?P\d+)/(?P\w+)/$", views.hash), 13 | ] 14 | -------------------------------------------------------------------------------- /web/dashboard/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/dashboard/__init__.py -------------------------------------------------------------------------------- /web/dashboard/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file "docs/LICENSE" for copying permission. 5 | 6 | from . import views 7 | from django.conf.urls import url 8 | 9 | urlpatterns = [ 10 | url(r"^$", views.index), 11 | ] 12 | -------------------------------------------------------------------------------- /web/helpers.py: -------------------------------------------------------------------------------- 1 | from copy import deepcopy 2 | 3 | 4 | def convert_hit_to_template(hit1): 5 | almost_ready = hit1['_source'] 6 | almost_ready['pk'] = hit1['_id'] 7 | almost_ready['es_index'] = hit1['_index'] 8 | almost_ready['es_type'] = hit1['_type'] 9 | return almost_ready 10 | -------------------------------------------------------------------------------- /web/hunting/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/hunting/__init__.py -------------------------------------------------------------------------------- /web/hunting/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file "docs/LICENSE" for copying permission. 5 | 6 | from django.conf.urls import url 7 | 8 | from . import views 9 | 10 | urlpatterns = [ 11 | url(r"^$", views.index), 12 | url(r"^submit/$", views.submit), 13 | url(r"^pcap/(?P.+)/$", views.pcap, name="hunting_pcap"), 14 | url(r"^(?P[a-zA-Z0-9\-]+)/$", views.report, name="hunting_report"), 15 | url(r"^status/(?P.+)$", views.status), 16 | url(r"^yara_file/(?P.+)$", views.yara_file, name="hunting_yara_file"), 17 | url(r"^yara_download/(?P.+)/(?P.+)$", views.yara_download, name="hunting_yara_download"), 18 | url(r"^suri_file/(?P.+)$", views.suri_file, name="hunting_suri_file"), 19 | url(r"^ajax/hunt_data/(?P.+)$", views.get_hunt_data), 20 | url(r"^(?P[a-zA-Z0-9\-]+)/ajax/publish/$", views.publish) 21 | 22 | ] 23 | -------------------------------------------------------------------------------- /web/manage.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2010-2013 Claudio Guarnieri. 3 | # Copyright (C) 2014-2016 Cuckoo Foundation. 4 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 5 | # See the file 'docs/LICENSE' for copying permission. 6 | 7 | import os 8 | import sys 9 | 10 | if __name__ == "__main__": 11 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "web.settings") 12 | 13 | from django.core.management import execute_from_command_line 14 | 15 | execute_from_command_line(sys.argv) 16 | -------------------------------------------------------------------------------- /web/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | python2.7 manage.py runserver 0.0.0.0:8800 >> /tmp/greg.web 2>> /tmp/greg.web.error & 3 | -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/fonts/glyphicons-halflings-regular.eot -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/fonts/glyphicons-halflings-regular.ttf -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/fonts/glyphicons-halflings-regular.woff -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/fonts/glyphicons-halflings-regular.woff2 -------------------------------------------------------------------------------- /web/static/graphic/background.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/graphic/background.png -------------------------------------------------------------------------------- /web/static/graphic/cuckoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/graphic/cuckoo.png -------------------------------------------------------------------------------- /web/static/graphic/cuckoo_inverse.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/graphic/cuckoo_inverse.png -------------------------------------------------------------------------------- /web/static/images/SparkIT_grayscale.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/SparkIT_grayscale.png -------------------------------------------------------------------------------- /web/static/images/green_check.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/green_check.png -------------------------------------------------------------------------------- /web/static/images/intelligence-small.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/intelligence-small.png -------------------------------------------------------------------------------- /web/static/images/newtab.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/newtab.png -------------------------------------------------------------------------------- /web/static/images/newtab_32.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/newtab_32.png -------------------------------------------------------------------------------- /web/static/images/newtab_white.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/newtab_white.png -------------------------------------------------------------------------------- /web/static/images/red_cross.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/red_cross.png -------------------------------------------------------------------------------- /web/static/images/reversinglabs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/reversinglabs.png -------------------------------------------------------------------------------- /web/static/images/sort_asc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/sort_asc.png -------------------------------------------------------------------------------- /web/static/images/sort_asc_disabled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/sort_asc_disabled.png -------------------------------------------------------------------------------- /web/static/images/sort_both.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/sort_both.png -------------------------------------------------------------------------------- /web/static/images/sort_desc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/sort_desc.png -------------------------------------------------------------------------------- /web/static/images/sort_desc_disabled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/sort_desc_disabled.png -------------------------------------------------------------------------------- /web/static/images/virustotal.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/images/virustotal.png -------------------------------------------------------------------------------- /web/static/img/close.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/close.png -------------------------------------------------------------------------------- /web/static/img/loader_gifs/ball_loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loader_gifs/ball_loader.gif -------------------------------------------------------------------------------- /web/static/img/loader_gifs/gallery_loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loader_gifs/gallery_loader.gif -------------------------------------------------------------------------------- /web/static/img/loader_gifs/sausage_loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loader_gifs/sausage_loader.gif -------------------------------------------------------------------------------- /web/static/img/loader_gifs/spinning_head_loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loader_gifs/spinning_head_loader.gif -------------------------------------------------------------------------------- /web/static/img/loader_gifs/wave_loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loader_gifs/wave_loader.gif -------------------------------------------------------------------------------- /web/static/img/loading.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/loading.gif -------------------------------------------------------------------------------- /web/static/img/next.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/next.png -------------------------------------------------------------------------------- /web/static/img/prev.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/static/img/prev.png -------------------------------------------------------------------------------- /web/static/js/app.js: -------------------------------------------------------------------------------- 1 | $(document).ready(function() { 2 | $("[data-toggle=popover]").popover(); 3 | }); 4 | 5 | -------------------------------------------------------------------------------- /web/submission/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/submission/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | from . import views 7 | from django.conf.urls import url 8 | 9 | urlpatterns = [ 10 | url(r"^$", views.index), 11 | url(r"status/(?P\d+)/$", views.status), 12 | url(r"^(?P\d+)/$", views.resubmit), 13 | url(r"^(?P\d+)/dropped/(?P[a-f0-9]{40})/$", views.submit_dropped), 14 | ] 15 | -------------------------------------------------------------------------------- /web/templates/analysis/admin/index.html: -------------------------------------------------------------------------------- 1 | {% load analysis_tags %} 2 |
3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | {% if user.username == analysis.info.owner %} 17 | 18 | 19 | 20 | 21 | {% endif %} 22 |
Task ID{{analysis.info.id}}
Mongo ID{{analysis|mongo_id}}
Cuckoo release{{analysis.info.version}}
Delete
23 |
24 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_chunk.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for call in chunk.calls %} 14 | 15 | {% include "analysis/behavior/_api_call.html" %} 16 | 17 | {% endfor %} 18 | 19 |
Time & APIArgumentsStatusReturnRepeated
20 |
-------------------------------------------------------------------------------- /web/templates/analysis/behavior/_search.html: -------------------------------------------------------------------------------- 1 | 15 | 16 | 29 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_tree.html: -------------------------------------------------------------------------------- 1 |

Process Tree

2 |
    3 | {% for process in analysis.behavior.processtree|filter_key_if_has:"track" %} 4 | {% include "analysis/behavior/_tree_process.html" %} 5 | {% endfor %} 6 |
7 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_tree_process.html: -------------------------------------------------------------------------------- 1 |
  • 2 | {{process.process_name}} ({{process.pid}}) 3 | {{ process.command_line }} 4 | {% if process.children %} 5 |
      6 | {% for child in process.children %} 7 | {% with process=child template_name="analysis/behavior/_tree_process.html" %} 8 | {% include template_name %} 9 | {% endwith %} 10 | {% endfor %} 11 |
    12 | {% endif %} 13 |
    • 14 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/index.html: -------------------------------------------------------------------------------- 1 | {% include "analysis/behavior/_tree.html" %} 2 |
    3 | {% include "analysis/behavior/_processes.html" %} -------------------------------------------------------------------------------- /web/templates/analysis/memory/_apihooks.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | {% for row in analysis.memory.apihooks.data|volsort %} 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | {% endfor %} 21 | 22 |
    PIDProcess NameVictim FunctionHook TypeHooking Module
    {{row.process_id}}{{row.process_name}}{{row.victim_function}}{{row.hook_type}}{{row.hooking_module}}
    23 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_callbacks.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | {% for row in analysis.memory.callbacks.data|volsort %} 12 | 13 | 14 | 15 | 16 | 17 | 18 | {% endfor %} 19 | 20 |
    TypeCallbackModuleDetails
    {{row.type}}{{row.callback}}{{row.module}}{{row.details}}
    21 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_devicetree.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for row in analysis.memory.devicetree.data|volsort %} 11 | 12 | 13 | 14 | 21 | 22 | {% endfor %} 23 | 24 |
    Driver NameDriver OffsetDevices
    {{row.driver_name}}{{row.driver_offset}} 15 | {% for device in row.devices %} 16 | {% if device.device_name %} 17 | {{device.device_name}}, 18 | {% endif %} 19 | {% endfor %} 20 |
    25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_idt.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for row in analysis.memory.idt.data|volsort %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
    CPUIndexSelectorAddressModuleSection
    {{row.cpu_number}}{{row.index}}{{row.selector}}{{row.address}}{{row.module}}{{row.section}}
    25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_malfind.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | {% for row in analysis.memory.malfind.data|volsort %} 12 | 13 | 14 | 15 | 16 | 17 | 18 | {% endfor %} 19 | 20 |
    PIDProcess NameStartTag
    {{row.process_id}}{{row.process_name}}{{row.vad_start}}{{row.vad_tag}}
    21 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_modscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | {% for row in analysis.memory.modscan.data|volsort %} 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | {% endfor %} 21 | 22 |
    Base AddressOffsetNameFileSize
    {{row.kernel_module_base}}{{row.kernel_module_offset}}{{row.kernel_module_name}}{{row.kernel_module_file}}{{row.kernel_module_size}}
    23 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_netscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | {% for row in analysis.memory.netscan.data|volsort %} 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | {% endfor %} 25 | 26 |
    OffsetPIDLocal AddressLocal PortRemote AddressRemote PortProtocol
    {{row.offset}}{{row.process_id}}{{row.local_address}}{{row.local_port}}{{row.remote_address}}{{row.remote_port}}{{row.protocol}}
    27 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_sockscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for row in analysis.memory.sockscan.data|volsort %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
    OffsetPIDLocal AddressLocal PortProtocolCreation Time
    {{row.offset}}{{row.process_id}}{{row.address}}{{row.port}}{{row.protocol}}{{row.create_time}}
    25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_ssdt.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | {% for row in analysis.memory.ssdt.data|volsort %} 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | {% endfor %} 25 | 26 |
    IndexTableEntrySyscall NameSyscall AddrSyscall ModnameHook?
    {{row.index}}{{row.table}}{{row.entry}}{{row.syscall_name}}{{row.syscall_addr}}{{row.syscall_modname}}{{row.hook_dest_addr}}: {{row.hook_name}}
    27 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_timers.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for row in analysis.memory.timers.data|volsort %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
    OffsetDue TimePeriodSignaledRoutineModule
    {{row.offset}}{{row.due_time}}{{row.period}}{{row.signaled}}{{row.routine}}{{row.module}}
    25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_yarascan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for row in analysis.memory.yarascan.data|volsort %} 11 | 12 | 13 | 14 | 15 | 16 | {% endfor %} 17 | 18 |
    OwnerRuleHexdump
    {{row.owner}}{{row.rule}}
    {{row.hexdump}}
    19 | -------------------------------------------------------------------------------- /web/templates/analysis/network/_hosts.html: -------------------------------------------------------------------------------- 1 |
    2 |

    Hosts

    3 | {% if analysis.network.hosts %} 4 | 5 | 6 | 7 | 8 | {% for host in analysis.network.hosts %} 9 | 10 | {% if host|slice:":7" != "192.168" and ":" not in host %} 11 | 19 | {% endif %} 20 | 21 | {% endfor %} 22 |
    IP
    12 | 13 | {{ host }} 14 | {% if host|isdeadip:analysis %} 15 | (dead IP/port - was unable to connect during analysis) 16 | {% endif %} 17 | {% rl_link "ipv4" host%}{% vt_link "ip-address" host%} 18 |
    23 | {% else %} 24 |

    No hosts contacted.

    25 | {% endif %} 26 |
    27 | -------------------------------------------------------------------------------- /web/templates/analysis/network/_icmp.html: -------------------------------------------------------------------------------- 1 |

    ICMP traffic

    2 | {% if analysis.network.icmp %} 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for packet in analysis.network.icmp %} 11 | 12 | 13 | 14 | 15 | 16 | 17 | {% endfor %} 18 |
    SourceDestinationICMP TypeData
    {{packet.src}}{{packet.dst}}{{packet.type}}{{packet.data}}
    19 | {% else %} 20 |

    No ICMP traffic performed.

    21 | {% endif %} -------------------------------------------------------------------------------- /web/templates/analysis/network/_irc.html: -------------------------------------------------------------------------------- 1 |

    IRC traffic

    2 | {% if analysis.network.irc %} 3 | 4 | 5 | 6 | 7 | 8 | 9 | {% for irc in analysis.network.irc %} 10 | 11 | 12 | 13 | 14 | 15 | {% endfor %} 16 |
    CommandParamsType
    {{irc.command}}{{irc.params}}{{irc.type}}
    17 | {% else %} 18 |

    No IRC requests performed.

    19 | {% endif %} -------------------------------------------------------------------------------- /web/templates/analysis/network/_snort.html: -------------------------------------------------------------------------------- 1 |

    Snort Alerts

    2 | {% if analysis.snort.alerts %} 3 | 4 | 5 | 6 | 7 | 8 | 9 | {% for alert in analysis.snort.alerts %} 10 | 11 | 16 | 17 | 18 | 19 | {% endfor %} 20 |
    FlowSIDMessage
    12 | {{alert.protocol}} 13 | {{alert.src_ip}}{% if alert.src_port %}:{{alert.src_port}}{% endif %} -> 14 | {{alert.dst_ip}}{% if alert.dst_port %}:{{alert.dst_port}}{% endif %} 15 | {{alert.sid}}{{alert.message}}
    21 | {% else %} 22 |

    No Snort Alerts

    23 | {% endif %} 24 | -------------------------------------------------------------------------------- /web/templates/analysis/overview/_screenshots.html: -------------------------------------------------------------------------------- 1 |
    2 |

    Screenshots

    3 | {% if analysis.shots %} 4 |
    5 | {% for shot in analysis.shots %} 6 | 7 | 8 | 9 | {% endfor %} 10 |
    11 | {% else %} 12 | No screenshots available. 13 | {% endif %} 14 |
    15 | -------------------------------------------------------------------------------- /web/templates/analysis/overview/_url.html: -------------------------------------------------------------------------------- 1 |
    2 |

    URL Details

    3 |
    4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 24 | 25 | 26 |
    URL
    {{analysis.target.url}} 13 | 14 | 15 | 16 | Resubmit sample 17 | 18 | 19 | 20 | Moloch 21 | 22 | 23 |
    27 |
    28 |
    29 | -------------------------------------------------------------------------------- /web/templates/analysis/static/_irma.html: -------------------------------------------------------------------------------- 1 |
    2 | {% if analysis.irma and analysis.irma.status %} 3 | 4 | 5 | 6 | {% if analysis.info.category == "file" %} 7 | 8 | {% else %} 9 | 10 | {% endif %} 11 | 12 | {% for probe in analysis.irma.probe_results %} 13 | 14 | 15 | 24 | 25 | {% endfor %} 26 |
    AntivirusSignatureResult
    {{probe.name}} 16 | {% if analysis.info.category == "file" %} 17 | {% if not probe.results %} 18 | Clean 19 | {% else %} 20 | {{probe.results}} 21 | {% endif %} 22 | {% endif %} 23 |
    27 | {% else %} 28 | No antivirus signatures available. 29 | {% endif %} 30 |
    -------------------------------------------------------------------------------- /web/templates/analysis/static/_strings.html: -------------------------------------------------------------------------------- 1 |
    2 |
    3 | {% for string in analysis.strings %} 4 |
    {{string}}
    5 | {% endfor %} 6 |
    7 |
    -------------------------------------------------------------------------------- /web/templates/base.html: -------------------------------------------------------------------------------- 1 | {%include "header.html" %} 2 |
    3 | {% autoescape on %} 4 | {% block content %}{% endblock %} 5 | {% endautoescape %} 6 |
    7 | {%include "footer.html" %} 8 | -------------------------------------------------------------------------------- /web/templates/compare/_summary_table.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for record in records %} 14 | 15 | 16 | {% if record.target.category == "url" %} 17 | 18 | {% else %} 19 | 20 | {% endif %} 21 | 22 | 23 | 24 | 25 | 26 | {% endfor %} 27 | 28 |
    IDTargetMachineCompleted OnDurationSelect
    {{record.info.id}}{{record.target.url}}{{record.target.file.name}}{{record.info.machine.name}}{{record.info.ended}}{{record.info.duration}} secondsSelect
    -------------------------------------------------------------------------------- /web/templates/compare/hash.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 |

    5 | 6 |
    7 |
    8 |

    Analysis 1

    9 | 10 | {% include "compare/_info.html" with record=left %} 11 |
    12 |
    13 |

    Analysis 2

    14 | 15 |

    You need to select the second analysis.

    16 | {% if records.count > 0 %} 17 |

    Following are all the analyses of the file with provided MD5 or pattern {{hash}}:

    18 | {% include "compare/_summary_table.html" %} 19 | {% else %} 20 |

    There is no analysis for the specified file or you selected the same selected analysis.

    21 | {% endif %} 22 |
    23 |
    24 | {% endblock %} 25 | -------------------------------------------------------------------------------- /web/templates/error.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 |
    ERROR :-(
    {{error}}
    5 | {% endblock %} 6 | -------------------------------------------------------------------------------- /web/templates/footer.html: -------------------------------------------------------------------------------- 1 | {% load staticfiles %} 2 | 4 | 9 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /web/templates/hunting/output_templates/suricata.html: -------------------------------------------------------------------------------- 1 |
    2 |

    Matched Analysis {{ result.analysis_id }}

    3 | [Analysis - PCAP] 5 |
    6 | Signature Id: {{ result.alert.signature_id }} 7 |
    8 | Signature: {{ result.alert.signature }} 9 |
    -------------------------------------------------------------------------------- /web/templates/hunting/status.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 | 5 |
    6 |

    Hang on...

    7 |

    The hunt hasn't fully baked. That is to say, we're still working on something. This page will refresh every 5 8 | seconds. Instances left running: {{instance_count}}

    9 |
      10 | {% for file in progress_data %} 11 |
    • {{ file }}
      • 12 | {% endfor %} 13 |
    14 |
    15 |
    17 |
    18 |
    19 | {% endblock %} 20 | -------------------------------------------------------------------------------- /web/templates/registration/login.html: -------------------------------------------------------------------------------- 1 | {% extends 'base.html' %} 2 | 3 | {% block title %}Login{% endblock %} 4 | 5 | {% block content %} 6 |

    Login

    7 |
    8 | {% csrf_token %} 9 | {{ form.as_p }} 10 | 11 |
    12 | {% endblock %} -------------------------------------------------------------------------------- /web/templates/standalone_error.html: -------------------------------------------------------------------------------- 1 |
    ERROR :-(
    {{error}}
    2 | -------------------------------------------------------------------------------- /web/templates/submission/complete.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 |

    Submission complete!

    5 | You have {{ creditsleft }} submissions left for today.
    6 | The following tasks were added successfully: 7 | {% for task in tasks %} 8 | {{task}} 9 | {% endfor %}. 10 |

    11 | Click on the links to monitor the status of the submission:
    12 | {% for task in tasks %} 13 | {{ baseurl }}{% url "submission.views.status" task %}
    14 | {% endfor %} 15 |
    16 | {% endblock %} 17 | -------------------------------------------------------------------------------- /web/templates/submission/reboot.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 |

    Reboot analysis successful!

    5 | The following reboot analysis was added successfully: 6 | {{ baseurl }}{% url "submission.views.status" task_id %}
    7 |
    8 | {% endblock %} 9 | -------------------------------------------------------------------------------- /web/templates/submission/status.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 | 5 |
    6 |

    Hang on...

    7 |

    The analysis hasn't fully baked. That is to say, we're still working on something. Status = {{status}}. This page will refresh every 5 seconds.

    8 |
    9 |
    10 |
    11 |
    12 | {% endblock %} 13 | -------------------------------------------------------------------------------- /web/templates/success.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load staticfiles %} 3 | {% block content %} 4 |

    5 |
    Great! :-)
    {{message}}
    6 | {% endblock %} 7 | -------------------------------------------------------------------------------- /web/web/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/web/admin.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SparkITSolutions/phoenix/e2f30d9cc3b40fa3e1924c75cfddfccbe4f78945/web/web/admin.py -------------------------------------------------------------------------------- /web/web/dev_settings.py: -------------------------------------------------------------------------------- 1 | from settings import * 2 | DATABASES = { 3 | 'default': { 4 | 'ENGINE': 'django.db.backends.sqlite3', 5 | 'NAME': 'cuckoo.sqlite', 6 | } 7 | } 8 | 9 | ANALYSES_PREFIX = '/home/greg/analyses/' 10 | SURICATA_PATH = os.path.join(CUCKOO_PATH, 'docker','suricata','suricata.yaml') 11 | YARA_DOCKER_IMAGE = 'devyara' 12 | SURICATA_DOCKER_IMAGE = 'devsuricata' -------------------------------------------------------------------------------- /web/web/headers.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2013 Claudio Guarnieri. 2 | # Copyright (C) 2014-2016 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import sys 7 | 8 | from django.conf import settings 9 | 10 | sys.path.insert(0, settings.CUCKOO_PATH) 11 | 12 | from lib.cuckoo.common.constants import CUCKOO_VERSION 13 | 14 | class CuckooHeaders(object): 15 | """Set Cuckoo custom response headers.""" 16 | 17 | def process_response(self, request, response): 18 | response["Server"] = "Machete Server" 19 | response["X-Cuckoo-Version"] = CUCKOO_VERSION 20 | response["X-Content-Type-Options"] = "nosniff" 21 | response["X-Frame-Options"] = "DENY" 22 | response["X-XSS-Protection"] = "1; mode=block" 23 | response["Pragma"] = "no-cache" 24 | response["Cache-Control"] = "no-cache" 25 | response["Expires"] = "0" 26 | return response 27 | --------------------------------------------------------------------------------