├── kvm-configs ├── cuckoo_net.xml └── cuckooboot ├── virtualbox-configs └── cuckooboot ├── README.md ├── win-scripts ├── stealth.bat ├── ZombiesXP.reg ├── Office2010.reg ├── Office2013.reg └── Zombieswin7.reg ├── gen-configs ├── nginx_config ├── vsftpd.conf ├── torrc ├── inetsim.conf └── suricata-cuckoo.yaml ├── test-scripts └── kvm-qemu-patching.sh └── cuckoo.sh /kvm-configs/cuckoo_net.xml: -------------------------------------------------------------------------------- 1 | 2 | cuckoo 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /kvm-configs/cuckooboot: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | CUCKOO_USER="cuckoo" 3 | CUCKOO_PATH="/opt/cuckoo" 4 | VIRBR_IP="192.168.100.1" 5 | INETSIM_DNS_PORT="5342" 6 | VIRBR_DEV="virbr0" 7 | 8 | su $CUCKOO_USER -c "pkill gunicorn" >/dev/null 2>&1 9 | su $CUCKOO_USER -c "pkill python" > /dev/null 2>&1 10 | 11 | /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null 12 | 13 | # Wait for the virtual bridge to become active before (re)starting services 14 | while [ $? -ne 0 ] 15 | do 16 | sleep 5 17 | /usr/sbin/service nginx restart 18 | /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null 19 | done 20 | 21 | # Restart services that bind to the bridge 22 | /usr/sbin/service tor restart 23 | /usr/sbin/service inetsim restart 24 | /usr/sbin/service vsftpd restart 25 | 26 | # Start Cuckoo 27 | cd $CUCKOO_PATH 28 | su $CUCKOO_USER -c "./cuckoo.py &" 29 | 30 | # Start the Cuckoo web UI 31 | cd web 32 | su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8000 web.wsgi" 33 | 34 | # Start the legacy upstream API 35 | cd ../utils 36 | su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8001 api" 37 | 38 | # Redirect libvirt VM DNS quires to inetsim's DNS port 39 | /sbin/iptables -t nat -C PREROUTING -d $VIRBR_IP -p udp --dport 53 -j REDIRECT --to-ports $INETSIM_DNS_PORT >/dev/null 2>&1 40 | if [ $? -ne 0 ]; then 41 | /sbin/iptables -t nat -I PREROUTING -d $VIRBR_IP -p udp --dport 53 -j REDIRECT --to-ports $INETSIM_DNS_PORT 42 | fi 43 | 44 | # Allow inetsim to accept traffic for any IP address 45 | /sbin/iptables -t nat -C PREROUTING -i $VIRBR_DEV -j REDIRECT >/dev/null 2>&1 46 | if [ $? -ne 0 ]; then 47 | /sbin/iptables -t nat -A PREROUTING -i $VIRBR_DEV -j REDIRECT 48 | fi -------------------------------------------------------------------------------- /virtualbox-configs/cuckooboot: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | CUCKOO_USER="cuckoo" 3 | CUCKOO_PATH="/opt/cuckoo" 4 | VIRBR_IP="192.168.100.1" 5 | INETSIM_DNS_PORT="5342" 6 | VIRBR_DEV="vboxnet0" 7 | 8 | su $CUCKOO_USER -c "pkill gunicorn" >/dev/null 2>&1 9 | su $CUCKOO_USER -c "pkill python" > /dev/null 2>&1 10 | 11 | /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null 12 | 13 | # Wait for the virtual bridge to become active before (re)starting services 14 | while [ $? -ne 0 ] 15 | do 16 | sleep 5 17 | /usr/sbin/service nginx restart 18 | /usr/bin/curl -s http://$VIRBR_IP:8080/ > /dev/null 19 | done 20 | 21 | # Restart services that bind to the bridge 22 | /usr/sbin/service tor restart 23 | /usr/sbin/service inetsim restart 24 | /usr/sbin/service vsftpd restart 25 | 26 | # Start Cuckoo 27 | cd $CUCKOO_PATH 28 | su $CUCKOO_USER -c "./cuckoo.py &" 29 | 30 | # Start the Cuckoo web UI 31 | cd web 32 | su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8000 web.wsgi" 33 | 34 | # Start the legacy upstream API 35 | cd ../utils 36 | su $CUCKOO_USER -c "gunicorn --reload -D -w 4 -b 127.0.0.1:8001 api" 37 | 38 | # Redirect libvirt VM DNS quires to inetsim's DNS port 39 | /sbin/iptables -t nat -C PREROUTING -d $VIRBR_IP -p udp --dport 53 -j REDIRECT --to-ports $INETSIM_DNS_PORT >/dev/null 2>&1 40 | if [ $? -ne 0 ]; then 41 | /sbin/iptables -t nat -I PREROUTING -d $VIRBR_IP -p udp --dport 53 -j REDIRECT --to-ports $INETSIM_DNS_PORT 42 | fi 43 | 44 | # Allow inetsim to accept traffic for any IP address 45 | /sbin/iptables -t nat -C PREROUTING -i $VIRBR_DEV -j REDIRECT >/dev/null 2>&1 46 | if [ $? -ne 0 ]; then 47 | /sbin/iptables -t nat -A PREROUTING -i $VIRBR_DEV -j REDIRECT 48 | fi -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # cuckoo-autoinstall 2 | The script "cuckoo.sh" intends to perform a full base install of the modified Cuckoo sandbox on Ubuntu 16.04 following the steps listed here: https://infosecspeakeasy.org/t/howto-build-a-cuckoo-sandbox/27 3 | 4 | This script is nearly complete, but still may have some bugs. I built it out of necessity after I re-installed Cuckoo a few times trying to get the setup correct. Each install used to take a few hours, whereas this script should complete in under 15 minutes on a reasonably powered machine. 5 | 6 | One important thing to be aware of is that this script will generate a secure password for the database, but also will use that generated password for the "cuckoo" user account. The account should be reasonably secure, but be aware that the password will exist in a plaintext file. Please make sure to change that password if you want the account fully secured. 7 | 8 | -Usage- 9 | ``` 10 | sudo ./cuckoo 11 | ``` 12 | **NOTE: Alternate install options have not been completed. For now, run without arguments.** 13 | 14 | If no arguments are provided, it will default to the following and auto-generated values will be displayed at runtime: 15 | 16 | Cuckoo Path: /opt 17 | 18 | DB Password: Pseudo-random generated by hashing date and then base64 encoding 19 | 20 | Public IP: Attempts to discover public IP and use it during install 21 | 22 | Machinery: kvm 23 | 24 | **Steps that need to take place after running script:** 25 | 26 | -Build sandbox VMs in KVM 27 | 28 | -Modify Cuckoo conf files for new sandbox VMs 29 | 30 | -Create user/pass for web portal 31 | 32 | ``` 33 | sudo htpasswd -c /etc/nginx/htpasswd $USER 34 | sudo chown root:www-data /etc/nginx/htpasswd 35 | sudo chmod u=rw,g=r,o= /etc/nginx/htpasswd 36 | sudo service nginx restart 37 | ``` 38 | **To Do List** 39 | 40 | -Finish alternate install option of Virtualbox 41 | 42 | -Test alternate install of mainstream version of Cuckoo 43 | 44 | Tested on Ubuntu Server 16.04.1 LTS 45 | -------------------------------------------------------------------------------- /win-scripts/stealth.bat: -------------------------------------------------------------------------------- 1 | REM HELP 2 | REM http://www.windows-commandline.com/start-stop-service-command-line/ 3 | REM disable UAC 4 | reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 5 | REM disable Windows defender 6 | sc config WinDefend start=disabled 7 | REM disable windows update 8 | reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 1 /f 9 | REM disable aero 10 | net stop uxsms 11 | REM disable the firewall 12 | netsh firewall set opmode mode=DISABLE 13 | REM disable IPv6 14 | netsh interface teredo set state disabled 15 | netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled 16 | netsh interface ipv6 isatap set state state=disabled 17 | REM disable active probing 18 | reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v EnableActiveProbing /t REG_DWORD /d 0 /f 19 | REM disable SSDP 20 | sc config SSDPSRV start= disabled 21 | net stop SSDPSRV 22 | REM disable computer browsing 23 | sc stop Browser 24 | sc config Browser start= disabled 25 | REM disable WinHTTP Web Proxy Auto-Discovery 26 | reg add "HKLM\SYSTEM\CurrentControlSet\services\WinHttpAutoProxySvc" /v Start /t REG_DWORD /d 4 /f 27 | REM disable Function Discovery Resource Publication service 28 | reg add "HKLM\SYSTEM\CurrentControlSet\services\FDResPud" /v Start /t REG_DWORD /d 4 /f 29 | REM IE blank page 30 | reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /V "Start Page" /D "" /F 31 | REM disable IExplorer Proxy 32 | reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 00000000 /f 33 | REM disable netbios in TCP/IP 34 | wmic nicconfig where index=8 call SetTcpipNetbios 2 35 | REM disable netbios service 36 | reg add "HKLM\SYSTEM\CurrentControlSet\services\Imhosts" /v Start /t REG_DWORD /d 4 /f 37 | REM disable LLMNR 38 | reg add "HKLM\Software\policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f 39 | REMdisable SQM 40 | reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FlexGo\FGNotify\Prechecks" /v Sqm /t REG_DWORD /d 00000002 /f 41 | REM Disable cert check 42 | reg add "HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo" /v DefaultSslCertCheckMode /t REG_DWORD /d 1 /f -------------------------------------------------------------------------------- /win-scripts/ZombiesXP.reg: -------------------------------------------------------------------------------- 1 | Windows Registry Editor Version 5.00 2 | 3 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer] 4 | 5 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery] 6 | 7 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions] 8 | "NoSearchBox"=dword:00000001 9 | "NoUpdateCheck"=dword:00000001 10 | 11 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter] 12 | "Enabled"=dword:00000000 13 | "EnabledV8"=dword:00000000 14 | 15 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Privacy] 16 | "ClearBrowsingHistoryOnExit"=dword:00000001 17 | 18 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security] 19 | "DisableFixSecuritySettings"=dword:00000001 20 | "DisableSecuritySettingsCheck"=dword:00000001 21 | 22 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings] 23 | "CertificateRevocation"=dword:00000000 24 | 25 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache] 26 | 27 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones] 28 | 29 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 30 | "1001"=dword:00000000 31 | "1004"=dword:00000000 32 | "1609"=dword:00000000 33 | "1809"=dword:00000003 34 | "1803"=dword:00000000 35 | "1800"=dword:00000000 36 | "1804"=dword:00000000 37 | "1200"=dword:00000000 38 | "2301"=dword:00000003 39 | "1806"=dword:00000000 40 | 41 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate] 42 | 43 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] 44 | "NoAutoUpdate"=dword:00000001 45 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] 46 | 47 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] 48 | "EnableFirewall"=dword:00000000 49 | 50 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] 51 | "EnableFirewall"=dword:00000000 52 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update] 53 | "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000 54 | 55 | [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Google\Update] 56 | "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000 57 | 58 | [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting] 59 | "Disabled"=dword:00000001 60 | 61 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc] 62 | "Start"=dword:00000004 63 | 64 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters] 65 | "Type"="NoSync" -------------------------------------------------------------------------------- /win-scripts/Office2010.reg: -------------------------------------------------------------------------------- 1 | Windows Registry Editor Version 5.00 2 | 3 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common] 4 | "UpdateReliabilityData"=dword:00000000 5 | "QMSessionCount"=dword:00000002 6 | 7 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\TrustCenter] 8 | "TrustBar"=dword:00000001 9 | 10 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet] 11 | "UseOnlineContent"=dword:00000000 12 | "IDN_AlertOff"=dword:00000001 13 | "UseOnlineAppDetect"=dword:00000000 14 | 15 | 16 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Research\Options] 17 | "DiscoveryNeedOptIn"=dword:00000001 18 | 19 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security] 20 | "AccessVBOM"=dword:00000001 21 | "VBAWarnings"=dword:00000001 22 | "EnableDEP"=dword:00000000 23 | 24 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\FileBlock] 25 | "Word95Files"=dword:00000000 26 | "Word60Files"=dword:00000000 27 | "Word2Files"=dword:00000000 28 | "OpenInProtectedView"=dword:00000002 29 | 30 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\ProtectedView] 31 | "DisableInternetFilesInPV"=dword:00000001 32 | "DisableAttachmentsInPV"=dword:00000001 33 | "DisableUnsafeLocationsInPV"=dword:00000001 34 | 35 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations] 36 | "AllowNetworkLocations"=dword:00000001 37 | 38 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security] 39 | "AccessVBOM"=dword:00000001 40 | "VBAWarnings"=dword:00000001 41 | "EnableDEP"=dword:00000000 42 | "DataConnectionWarnings"=dword:00000000 43 | "WorkbookLinkWarnings"=dword:00000002 44 | "ExtensionHardening"=dword:00000000 45 | 46 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\FileBlock] 47 | "XL4Workbooks"=dword:00000000 48 | "XL4Worksheets"=dword:00000000 49 | "XL3Worksheets"=dword:00000000 50 | "XL2Worksheets"=dword:00000000 51 | "XL4Macros"=dword:00000000 52 | "XL3Macros"=dword:00000000 53 | "XL2Macros"=dword:00000000 54 | "OpenInProtectedView"=dword:00000002 55 | 56 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView] 57 | "DisableInternetFilesInPV"=dword:00000001 58 | "DisableAttachmentsInPV"=dword:00000001 59 | "DisableUnsafeLocationsInPV"=dword:00000001 60 | 61 | 62 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Security] 63 | "AccessVBOM"=dword:00000001 64 | "VBAWarnings"=dword:00000001 65 | "EnableDEP"=dword:00000000 66 | 67 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView] 68 | "DisableInternetFilesInPV"=dword:00000001 69 | "DisableAttachmentsInPV"=dword:00000001 70 | "DisableUnsafeLocationsInPV"=dword:00000001 71 | 72 | [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Publisher\Security] 73 | "VBAWarnings"=dword:00000001 74 | "EnableDEP"=dword:00000000 75 | -------------------------------------------------------------------------------- /gen-configs/nginx_config: -------------------------------------------------------------------------------- 1 | server { 2 | listen IP_Address:443 ssl http2; 3 | ssl_certificate /etc/nginx/ssl/cuckoo.crt; 4 | ssl_certificate_key /etc/nginx/ssl/cuckoo.key; 5 | ssl_dhparam /etc/nginx/ssl/dhparam.pem; 6 | ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 7 | ssl_prefer_server_ciphers on; 8 | ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 9 | ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 10 | ssl_session_cache shared:SSL:10m; 11 | ssl_session_tickets off; # Requires nginx >= 1.5.9 12 | # Uncomment this next line if you are using a signed, trusted cert 13 | #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; 14 | add_header X-Frame-Options SAMEORIGIN; 15 | add_header X-Content-Type-Options nosniff; 16 | root /usr/share/nginx/html; 17 | index index.html index.htm; 18 | client_max_body_size 101M; 19 | auth_basic "Login required"; 20 | auth_basic_user_file /etc/nginx/htpasswd; 21 | 22 | location / { 23 | proxy_pass http://127.0.0.1:8000; 24 | proxy_set_header Host $host; 25 | proxy_set_header X-Real-IP $remote_addr; 26 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 27 | } 28 | 29 | location /storage/analysis { 30 | alias /opt/cuckoo/storage/analyses/; 31 | autoindex on; 32 | autoindex_exact_size off; 33 | autoindex_localtime on; 34 | } 35 | 36 | location /static { 37 | alias /opt/cuckoo/web/static/; 38 | } 39 | } 40 | 41 | server { 42 | listen IP_Address:80 http2; 43 | return 301 https://$server_name$request_uri; 44 | } 45 | 46 | 47 | server { 48 | listen 192.168.100.1:8080; 49 | 50 | root /home/cuckoo/vmshared; 51 | 52 | location / { 53 | try_files $uri $uri/ =404; 54 | autoindex on; 55 | autoindex_exact_size off; 56 | autoindex_localtime on; 57 | } 58 | } 59 | 60 | # Host the upstream legacy API 61 | server { 62 | listen IP_Address:4343 ssl http2; 63 | ssl_certificate /etc/nginx/ssl/cuckoo.crt; 64 | ssl_certificate_key /etc/nginx/ssl/cuckoo.key; 65 | ssl_dhparam /etc/nginx/ssl/dhparam.pem; 66 | ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 67 | ssl_prefer_server_ciphers on; 68 | ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 69 | ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 70 | ssl_session_cache shared:SSL:10m; 71 | ssl_session_tickets off; # Requires nginx >= 1.5.9 72 | # Uncomment this next line if you are using a signed, trusted cert 73 | #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; 74 | add_header X-Frame-Options SAMEORIGIN; 75 | add_header X-Content-Type-Options nosniff; 76 | root /usr/share/nginx/html; 77 | index index.html index.htm; 78 | client_max_body_size 101M; 79 | 80 | location / { 81 | proxy_pass http://127.0.0.1:8001; 82 | proxy_set_header Host $host; 83 | proxy_set_header X-Real-IP $remote_addr; 84 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 85 | 86 | # Restrict access 87 | allow IP_Address; 88 | #allow 192.168.1.0/24; 89 | deny all; 90 | } 91 | } -------------------------------------------------------------------------------- /win-scripts/Office2013.reg: -------------------------------------------------------------------------------- 1 | Windows Registry Editor Version 5.00 2 | 3 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common] 4 | "OverridePointerMode"=dword:00000001 5 | "QMEnable"=dword:00000000 6 | "UpdateReliabilityData"=dword:00000000 7 | "QMNFN"=dword:00000002 8 | "QMSessionCount"=dword:00000003 9 | 10 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Feedback] 11 | "Enabled"=dword:00000000 12 | 13 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Internet] 14 | "IDN_AlertOff"=dword:00000001 15 | "UseOnlineContent"=dword:00000002 16 | 17 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\PTWatson] 18 | "PTWOptIn"=dword:00000000 19 | "PTWReadyToSend"=dword:00000000 20 | "PTWNextUpload"=dword:00000000 21 | "PTWCount"=dword:00000000 22 | "PTWExpire"=dword:00000000 23 | 24 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Research\Options] 25 | "DiscoveryNeedOptIn"=dword:00000001 26 | 27 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Research\Translation] 28 | "UseOnline"=dword:00000000 29 | 30 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Security\FileValidation] 31 | "DisableReporting"=dword:00000001 32 | 33 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\TrustCenter] 34 | "TrustBar"=dword:00000001 35 | 36 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Security] 37 | "AccessVBOM"=dword:00000001 38 | "VBAWarnings"=dword:00000001 39 | 40 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Security\FileBlock] 41 | "Word95Files"=dword:00000000 42 | "Word60Files"=dword:00000000 43 | "Word2Files"=dword:00000000 44 | 45 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Security\ProtectedView] 46 | "DisableInternetFilesInPV"=dword:00000001 47 | "DisableAttachmentsInPV"=dword:00000001 48 | "DisableUnsafeLocationsInPV"=dword:00000001 49 | 50 | [HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Security] 51 | "UFIControls"=dword:00000001 52 | 53 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Excel\Security] 54 | "AccessVBOM"=dword:00000001 55 | "VBAWarnings"=dword:00000001 56 | "DataConnectionWarnings"=dword:00000000 57 | "WorkbookLinkWarnings"=dword:00000002 58 | "ExtensionHardening"=dword:00000000 59 | 60 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Excel\Security\FileBlock] 61 | "XL4Workbooks"=dword:00000000 62 | "XL4Worksheets"=dword:00000000 63 | "XL3Worksheets"=dword:00000000 64 | "XL2Worksheets"=dword:00000000 65 | "XL4Macros"=dword:00000000 66 | "XL3Macros"=dword:00000000 67 | "XL2Macros"=dword:00000000 68 | "OpenInProtectedView"=dword:00000002 69 | 70 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView] 71 | "DisableInternetFilesInPV"=dword:00000001 72 | "DisableAttachmentsInPV"=dword:00000001 73 | "DisableUnsafeLocationsInPV"=dword:00000001 74 | 75 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Excel\Security\Trusted Locations] 76 | "AllowNetworkLocations"=dword:00000001 77 | 78 | 79 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Internet] 80 | "IDN_AlertOff"=dword:00000001 81 | "UseOnlineContent"=dword:00000000 82 | 83 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\PowerPoint\Security] 84 | "AccessVBOM"=dword:00000001 85 | "VBAWarnings"=dword:00000001 86 | 87 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\PowerPoint\Security\FileBlock] 88 | "OpenInProtectedView"=dword:00000002 89 | 90 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView] 91 | "DisableInternetFilesInPV"=dword:00000001 92 | "DisableAttachmentsInPV"=dword:00000001 93 | "DisableUnsafeLocationsInPV"=dword:00000001 94 | 95 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Access\Security] 96 | "VBAWarnings"=dword:00000001 97 | 98 | [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Publisher\Security] 99 | "VBAWarnings"=dword:00000001 100 | -------------------------------------------------------------------------------- /win-scripts/Zombieswin7.reg: -------------------------------------------------------------------------------- 1 | Windows Registry Editor Version 5.00 2 | 3 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer] 4 | 5 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery] 6 | 7 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions] 8 | "NoSearchBox"=dword:00000001 9 | "NoUpdateCheck"=dword:00000001 10 | 11 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter] 12 | "Enabled"=dword:00000000 13 | "EnabledV8"=dword:00000000 14 | 15 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Privacy] 16 | "ClearBrowsingHistoryOnExit"=dword:00000001 17 | 18 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security] 19 | "DisableFixSecuritySettings"=dword:00000001 20 | "DisableSecuritySettingsCheck"=dword:00000001 21 | 22 | [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 23 | "WarnOnBadCertRecving"=dword:00000000 24 | "WarnOnBadCert"=dword:00000000 25 | 26 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria] 27 | "CertificateRevocation"=dword:00000000 28 | 29 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache] 30 | 31 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones] 32 | 33 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 34 | "1001"=dword:00000000 35 | "1004"=dword:00000000 36 | "1609"=dword:00000000 37 | "1809"=dword:00000003 38 | "1803"=dword:00000000 39 | "1800"=dword:00000000 40 | "1804"=dword:00000000 41 | "1200"=dword:00000000 42 | "2301"=dword:00000003 43 | "1806"=dword:00000000 44 | 45 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient] 46 | "EnableMulticast"=dword:00000000 47 | 48 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet] 49 | "PassivePollPeriod"=dword:00000005 50 | "StaleThreshold"=dword:0000001e 51 | "WebTimeout"=dword:00000023 52 | "EnableActiveProbing"=dword:00000000 53 | "ActiveWebProbeHost"="www.msftncsi.com" 54 | "ActiveWebProbePath"="ncsi.txt" 55 | "ActiveWebProbeContent"="Microsoft NCSI" 56 | "ActiveDnsProbeHost"="dns.msftncsi.com" 57 | "ActiveDnsProbeContent"="131.107.255.255" 58 | 59 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies] 60 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TCPIP] 61 | 62 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TCPIP\v6Transition] 63 | "Teredo_State"="Disabled" 64 | 65 | [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] 66 | "EnableLUA"=dword:00000000 67 | 68 | [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext] 69 | "DisableAddonLoadTimePerformanceNotifications"=dword:00000001 70 | "IgnoreFrameApprovalCheck"=dword:00000001 71 | "NoFirsttimeprompt"=dword:00000001 72 | 73 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate] 74 | 75 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] 76 | "NoAutoUpdate"=dword:00000001 77 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] 78 | 79 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] 80 | "EnableFirewall"=dword:00000000 81 | 82 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] 83 | "EnableFirewall"=dword:00000000 84 | 85 | [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows] 86 | CEIPEnable=dword:00000000 87 | 88 | [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update] 89 | "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000 90 | 91 | [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Google\Update] 92 | "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"=dword:00000000 93 | 94 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff] 95 | 96 | [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting] 97 | "Disabled"=dword:00000001 98 | 99 | ; Disable action center icon 100 | [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 101 | "HideSCAHealth"=dword:00000001 102 | 103 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend] 104 | "Start"=dword:00000004 105 | 106 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc] 107 | "Start"=dword:00000004 108 | 109 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters] 110 | "Type"="NoSync" -------------------------------------------------------------------------------- /test-scripts/kvm-qemu-patching.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # https://doomedraven.github.io/2016/01/23/KVM-QEMU.html 3 | 4 | function usage() 5 | { 6 | echo 'Usage: $0 ' 7 | echo 8 | echo 'Func:' 9 | echo ' All' 10 | echo ' KVM' 11 | echo ' QEMU' 12 | echo ' SeaBios' 13 | exit 14 | } 15 | 16 | function install_kvm() 17 | { 18 | apt-get install build-essential gcc pkg-config glib-2.0 libglib2.0-dev libsdl1.2-dev libaio-dev libcap-dev libattr1-dev libpixman-1-dev -y 19 | apt-get build-dep qemu 20 | apt-get install lvm2 ubuntu-virt-server python-vm-builder qemu-kvm qemu-system libvirt-bin ubuntu-vm-builder kvm-ipxe bridge-utils -y 21 | apt-get install virtinst python-libvirt virt-viewer virt-manager -y # Virtual Machine Manager 22 | kvm-ok 23 | } 24 | 25 | function qemu_func() 26 | { 27 | #Download code 28 | echo '[+] Downloading QEMU source code' 29 | apt-get source qemu > /dev/null 2>&1 30 | if [ $? -eq 0 ]; then 31 | echo '[+] Patching QEMU clues' 32 | sed -i 's/QEMU HARDDISK/WDC WD20EARS/g' qemu*/hw/ide/core.c 33 | if [ $? -ne 0 ]; then 34 | echo 'QEMU HARDDISK was not replaced in core.c' 35 | fi 36 | sed -i 's/QEMU HARDDISK/WDC WD20EARS/g' qemu*/hw/scsi/scsi-disk.c > /dev/null 2>&1 37 | if [ $? -eq 0 ]; then 38 | echo 'QEMU HARDDISK was not replaced in scsi-disk.c' 39 | fi 40 | sed -i 's/QEMU DVD-ROM/DVD-ROM/g' qemu*/hw/ide/core.c > /dev/null 2>&1 41 | if [ $? -eq 0 ]; then 42 | echo 'QEMU DVD-ROM was not replaced in core.c' 43 | fi 44 | sed -i 's/QEMU DVD-ROM/DVD-ROM/g' qemu*/hw/ide/atapi.c > /dev/null 2>&1 45 | if [ $? -eq 0 ]; then 46 | echo 'QEMU DVD-ROM was not replaced in atapi.c' 47 | fi 48 | sed -i 's/s->vendor = g_strdup("QEMU");/s->vendor = g_strdup("DELL");/g' qemu*/hw/scsi/scsi-disk.c 49 | if [ $? -eq 0 ]; then 50 | echo 'Vendor string was not replaced in scsi-disk.c' 51 | fi 52 | sed -i 's/QEMU CD-ROM/CD-ROM/g' qemu*/hw/scsi/scsi-disk.c > /dev/null 2>&1 53 | if [ $? -eq 0 ]; then 54 | echo 'QEMU CD-ROM was not patched in scsi-disk.c' 55 | fi 56 | sed -i 's/padstr8(buf + 8, 8, "QEMU");/padstr8(buf + 8, 8, "DELL");/g' qemu*/hw/ide/atapi.c > /dev/null 2>&1 57 | if [ $? -eq 0 ]; then 58 | echo 'padstr was not replaced in atapi.c' 59 | fi 60 | sed -i 's/QEMU MICRODRIVE/DELL MICRODRIVE/g' qemu*/hw/ide/core.c > /dev/null 2>&1 61 | if [ $? -eq 0 ]; then 62 | echo 'QEMU MICRODRIVE was not replaced in core.c' 63 | fi 64 | 65 | echo '[+] Starting to compile code' 66 | # not make sense compile if was not patched 67 | apt-get source --compile qemu > /dev/null 2>&1 68 | if [ $? -eq 0 ]; then 69 | dpkg -i qemu*.deb 70 | if [ $? -eq 0 ]; then 71 | echo '[+] Patched, compiled and installed' 72 | else 73 | echo '[-] Install failed' 74 | fi 75 | else 76 | echo '[-] Compilling failed' 77 | fi 78 | echo '[+] Starting Installation' 79 | dpkg -i qemu*.deb 80 | 81 | else 82 | echo '[-] Download of QEMU source was not possible' 83 | fi 84 | } 85 | 86 | function seabios_func 87 | { 88 | echo '[+] Installing SeaBios dependencies' 89 | apt-get install git iasl > /dev/null 2>&1 90 | git clone git://git.seabios.org/seabios.git > /dev/null 2>&1 91 | if [ $? -eq 0 ]; then 92 | cd seabios 93 | sed -i 's/Bochs/DELL/g' src/config.h > /dev/null 2>&1 94 | sed -i 's/BOCHSCPU/DELLCPU/g' src/config.h > /dev/null 2>&1 95 | sed -i 's/BOCHS/DELL/g' src/config.h > /dev/null 2>&1 96 | sed -i 's/BXPC/DELLS/g' src/config.h > /dev/null 2>&1 97 | make 98 | if [ $? -eq 0 ]; then 99 | echo '[+] Compiled SeaBios, bios file located in -> out/bios.bin' 100 | echo '[+] Replacing old bios.bin to new one, with backup' 101 | cp /usr/share/qemu/bios.bin /usr/share/qemu/bios.bin_back 102 | if [ $? == 0 ]; then 103 | echo '[+] Original bios.bin file backuped to /usr/share/qemu/bios.bin_back' 104 | cp out/bios.bin /usr/share/qemu/bios.bin 105 | if [ $? -eq 0 ]; then 106 | echo '[+] Patched bios.bin placed correctly' 107 | else: 108 | echo '[-] Bios patching failed' 109 | fi 110 | else: 111 | echo '[-] Bios backup failed' 112 | fi 113 | 114 | fi 115 | else 116 | echo '[-] Check if git installed or network connection is OK' 117 | fi 118 | } 119 | 120 | #check if start with root 121 | if [ $EUID -ne 0 ]; then 122 | echo 'This script must be run as root' 123 | exit 1 124 | fi 125 | 126 | if [ $# -eq 0 ]; then 127 | usage 128 | fi 129 | 130 | if [ "$1" = '-h' ]; then 131 | usage 132 | fi 133 | 134 | 135 | if [ "$1" = 'All' ]; then 136 | install_kvm 137 | qemu_func 138 | seabios_func 139 | fi 140 | 141 | if [ "$1" = 'QEMU' ]; then 142 | qemu_func 143 | fi 144 | 145 | if [ "$1" = 'SeaBios' ]; then 146 | seabios_func 147 | fi 148 | 149 | if [ "$1" = 'KVM' ]; then 150 | install_kvm 151 | fi 152 | -------------------------------------------------------------------------------- /gen-configs/vsftpd.conf: -------------------------------------------------------------------------------- 1 | # Example config file /etc/vsftpd.conf 2 | # 3 | # The default compiled in settings are fairly paranoid. This sample file 4 | # loosens things up a bit, to make the ftp daemon more usable. 5 | # Please see vsftpd.conf.5 for all compiled in defaults. 6 | # 7 | # READ THIS: This example file is NOT an exhaustive list of vsftpd options. 8 | # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's 9 | # capabilities. 10 | # 11 | # 12 | # Run standalone? vsftpd can run either from an inetd or as a standalone 13 | # daemon started from an initscript. 14 | listen=YES 15 | # 16 | # This directive enables listening on IPv6 sockets. By default, listening 17 | # on the IPv6 "any" address (::) will accept connections from both IPv6 18 | # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 19 | # sockets. If you want that (perhaps because you want to listen on specific 20 | # addresses) then you must run two copies of vsftpd with two configuration 21 | # files. 22 | listen_ipv6=NO 23 | # 24 | # Allow anonymous FTP? (Disabled by default). 25 | anonymous_enable=YES 26 | # 27 | # Uncomment this to allow local users to log in. 28 | local_enable=NO 29 | # 30 | # Uncomment this to enable any form of FTP write command. 31 | write_enable=YES 32 | # 33 | # Default umask for local users is 077. You may wish to change this to 022, 34 | # if your users expect that (022 is used by most other ftpd's) 35 | #local_umask=022 36 | # 37 | # Uncomment this to allow the anonymous FTP user to upload files. This only 38 | # has an effect if the above global write enable is activated. Also, you will 39 | # obviously need to create a directory writable by the FTP user. 40 | anon_upload_enable=YES 41 | # 42 | # Uncomment this if you want the anonymous FTP user to be able to create 43 | # new directories. 44 | anon_mkdir_write_enable=YES 45 | # 46 | # Activate directory messages - messages given to remote users when they 47 | # go into a certain directory. 48 | dirmessage_enable=YES 49 | # 50 | # If enabled, vsftpd will display directory listings with the time 51 | # in your local time zone. The default is to display GMT. The 52 | # times returned by the MDTM FTP command are also affected by this 53 | # option. 54 | use_localtime=YES 55 | # 56 | # Activate logging of uploads/downloads. 57 | xferlog_enable=YES 58 | # 59 | # Make sure PORT transfer connections originate from port 20 (ftp-data). 60 | connect_from_port_20=YES 61 | # 62 | # If you want, you can arrange for uploaded anonymous files to be owned by 63 | # a different user. Note! Using "root" for uploaded files is not 64 | # recommended! 65 | #chown_uploads=YES 66 | #chown_username=whoever 67 | # 68 | # You may override where the log file goes if you like. The default is shown 69 | # below. 70 | #xferlog_file=/var/log/vsftpd.log 71 | # 72 | # If you want, you can have your log file in standard ftpd xferlog format. 73 | # Note that the default log file location is /var/log/xferlog in this case. 74 | #xferlog_std_format=YES 75 | # 76 | # You may change the default value for timing out an idle session. 77 | #idle_session_timeout=600 78 | # 79 | # You may change the default value for timing out a data connection. 80 | #data_connection_timeout=120 81 | # 82 | # It is recommended that you define on your system a unique user which the 83 | # ftp server can use as a totally isolated and unprivileged user. 84 | #nopriv_user=ftpsecure 85 | # 86 | # Enable this and the server will recognise asynchronous ABOR requests. Not 87 | # recommended for security (the code is non-trivial). Not enabling it, 88 | # however, may confuse older FTP clients. 89 | #async_abor_enable=YES 90 | # 91 | # By default the server will pretend to allow ASCII mode but in fact ignore 92 | # the request. Turn on the below options to have the server actually do ASCII 93 | # mangling on files when in ASCII mode. 94 | # Beware that on some FTP servers, ASCII support allows a denial of service 95 | # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd 96 | # predicted this attack and has always been safe, reporting the size of the 97 | # raw file. 98 | # ASCII mangling is a horrible feature of the protocol. 99 | #ascii_upload_enable=YES 100 | #ascii_download_enable=YES 101 | # 102 | # You may fully customise the login banner string: 103 | #ftpd_banner=Welcome to blah FTP service. 104 | # 105 | # You may specify a file of disallowed anonymous e-mail addresses. Apparently 106 | # useful for combatting certain DoS attacks. 107 | #deny_email_enable=YES 108 | # (default follows) 109 | #banned_email_file=/etc/vsftpd.banned_emails 110 | # 111 | # You may restrict local users to their home directories. See the FAQ for 112 | # the possible risks in this before using chroot_local_user or 113 | # chroot_list_enable below. 114 | #chroot_local_user=YES 115 | # 116 | # You may specify an explicit list of local users to chroot() to their home 117 | # directory. If chroot_local_user is YES, then this list becomes a list of 118 | # users to NOT chroot(). 119 | # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that 120 | # the user does not have write access to the top level directory within the 121 | # chroot) 122 | #chroot_local_user=YES 123 | #chroot_list_enable=YES 124 | # (default follows) 125 | #chroot_list_file=/etc/vsftpd.chroot_list 126 | # 127 | # You may activate the "-R" option to the builtin ls. This is disabled by 128 | # default to avoid remote users being able to cause excessive I/O on large 129 | # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume 130 | # the presence of the "-R" option, so there is a strong case for enabling it. 131 | #ls_recurse_enable=YES 132 | # 133 | # Customization 134 | # 135 | # Some of vsftpd's settings don't fit the filesystem layout by 136 | # default. 137 | # 138 | # This option should be the name of a directory which is empty. Also, the 139 | # directory should not be writable by the ftp user. This directory is used 140 | # as a secure chroot() jail at times vsftpd does not require filesystem 141 | # access. 142 | secure_chroot_dir=/var/run/vsftpd/empty 143 | # 144 | # This string is the name of the PAM service vsftpd will use. 145 | pam_service_name=vsftpd 146 | # 147 | # This option specifies the location of the RSA certificate to use for SSL 148 | # encrypted connections. 149 | rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem 150 | rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key 151 | ssl_enable=NO 152 | 153 | # 154 | # Uncomment this to indicate that vsftpd use a utf8 filesystem. 155 | #utf8_filesystem=YES 156 | 157 | listen_address=192.168.100.1 158 | listen_port=2121 159 | anon_root=/home/cuckoo/vmshared 160 | anon_umask=000 161 | chown_upload_mode=0666 162 | pasv_enable=Yes 163 | pasv_min_port=10090 164 | pasv_max_port=10100 -------------------------------------------------------------------------------- /gen-configs/torrc: -------------------------------------------------------------------------------- 1 | ## Configuration file for a typical Tor user 2 | ## Last updated 22 September 2015 for Tor 0.2.7.3-alpha. 3 | ## (may or may not work for much older or much newer versions of Tor.) 4 | ## 5 | ## Lines that begin with "## " try to explain what's going on. Lines 6 | ## that begin with just "#" are disabled commands: you can enable them 7 | ## by removing the "#" symbol. 8 | ## 9 | ## See 'man tor', or https://www.torproject.org/docs/tor-manual.html, 10 | ## for more options you can use in this file. 11 | ## 12 | ## Tor will look for this file in various places based on your platform: 13 | ## https://www.torproject.org/docs/faq#torrc 14 | 15 | ## Tor opens a SOCKS proxy on port 9050 by default -- even if you don't 16 | ## configure one below. Set "SOCKSPort 0" if you plan to run Tor only 17 | ## as a relay, and not make any local application connections yourself. 18 | #SOCKSPort 9050 # Default: Bind to localhost:9050 for local connections. 19 | #SOCKSPort 192.168.0.1:9100 # Bind to this address:port too. 20 | 21 | ## Entry policies to allow/deny SOCKS requests based on IP address. 22 | ## First entry that matches wins. If no SOCKSPolicy is set, we accept 23 | ## all (and only) requests that reach a SOCKSPort. Untrusted users who 24 | ## can access your SOCKSPort may be able to learn about the connections 25 | ## you make. 26 | #SOCKSPolicy accept 192.168.0.0/16 27 | #SOCKSPolicy accept6 FC00::/7 28 | #SOCKSPolicy reject * 29 | 30 | ## Logs go to stdout at level "notice" unless redirected by something 31 | ## else, like one of the below lines. You can have as many Log lines as 32 | ## you want. 33 | ## 34 | ## We advise using "notice" in most cases, since anything more verbose 35 | ## may provide sensitive information to an attacker who obtains the logs. 36 | ## 37 | ## Send all messages of level 'notice' or higher to /var/log/tor/notices.log 38 | #Log notice file /var/log/tor/notices.log 39 | ## Send every possible message to /var/log/tor/debug.log 40 | #Log debug file /var/log/tor/debug.log 41 | ## Use the system log instead of Tor's logfiles 42 | #Log notice syslog 43 | ## To send all messages to stderr: 44 | #Log debug stderr 45 | 46 | ## Uncomment this to start the process in the background... or use 47 | ## --runasdaemon 1 on the command line. This is ignored on Windows; 48 | ## see the FAQ entry if you want Tor to run as an NT service. 49 | #RunAsDaemon 1 50 | 51 | ## The directory for keeping all the keys/etc. By default, we store 52 | ## things in $HOME/.tor on Unix, and in Application Data\tor on Windows. 53 | #DataDirectory /var/lib/tor 54 | 55 | ## The port on which Tor will listen for local connections from Tor 56 | ## controller applications, as documented in control-spec.txt. 57 | #ControlPort 9051 58 | ## If you enable the controlport, be sure to enable one of these 59 | ## authentication methods, to prevent attackers from accessing it. 60 | #HashedControlPassword 16:872860B76453A77D60CA2BB8C1A7042072093276A3D701AD684053EC4C 61 | #CookieAuthentication 1 62 | 63 | ############### This section is just for location-hidden services ### 64 | 65 | ## Once you have configured a hidden service, you can look at the 66 | ## contents of the file ".../hidden_service/hostname" for the address 67 | ## to tell people. 68 | ## 69 | ## HiddenServicePort x y:z says to redirect requests on port x to the 70 | ## address y:z. 71 | 72 | #HiddenServiceDir /var/lib/tor/hidden_service/ 73 | #HiddenServicePort 80 127.0.0.1:80 74 | 75 | #HiddenServiceDir /var/lib/tor/other_hidden_service/ 76 | #HiddenServicePort 80 127.0.0.1:80 77 | #HiddenServicePort 22 127.0.0.1:22 78 | 79 | ################ This section is just for relays ##################### 80 | # 81 | ## See https://www.torproject.org/docs/tor-doc-relay for details. 82 | 83 | ## Required: what port to advertise for incoming Tor connections. 84 | #ORPort 9001 85 | ## If you want to listen on a port other than the one advertised in 86 | ## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as 87 | ## follows. You'll need to do ipchains or other port forwarding 88 | ## yourself to make this work. 89 | #ORPort 443 NoListen 90 | #ORPort 127.0.0.1:9090 NoAdvertise 91 | 92 | ## The IP address or full DNS name for incoming connections to your 93 | ## relay. Leave commented out and Tor will guess. 94 | #Address noname.example.com 95 | 96 | ## If you have multiple network interfaces, you can specify one for 97 | ## outgoing traffic to use. 98 | # OutboundBindAddress 10.0.0.5 99 | 100 | ## A handle for your relay, so people don't have to refer to it by key. 101 | #Nickname ididnteditheconfig 102 | 103 | ## Define these to limit how much relayed traffic you will allow. Your 104 | ## own traffic is still unthrottled. Note that RelayBandwidthRate must 105 | ## be at least 20 kilobytes per second. 106 | ## Note that units for these config options are bytes (per second), not 107 | ## bits (per second), and that prefixes are binary prefixes, i.e. 2^10, 108 | ## 2^20, etc. 109 | #RelayBandwidthRate 100 KBytes # Throttle traffic to 100KB/s (800Kbps) 110 | #RelayBandwidthBurst 200 KBytes # But allow bursts up to 200KB (1600Kb) 111 | 112 | ## Use these to restrict the maximum traffic per day, week, or month. 113 | ## Note that this threshold applies separately to sent and received bytes, 114 | ## not to their sum: setting "40 GB" may allow up to 80 GB total before 115 | ## hibernating. 116 | ## 117 | ## Set a maximum of 40 gigabytes each way per period. 118 | #AccountingMax 40 GBytes 119 | ## Each period starts daily at midnight (AccountingMax is per day) 120 | #AccountingStart day 00:00 121 | ## Each period starts on the 3rd of the month at 15:00 (AccountingMax 122 | ## is per month) 123 | #AccountingStart month 3 15:00 124 | 125 | ## Administrative contact information for this relay or bridge. This line 126 | ## can be used to contact you if your relay or bridge is misconfigured or 127 | ## something else goes wrong. Note that we archive and publish all 128 | ## descriptors containing these lines and that Google indexes them, so 129 | ## spammers might also collect them. You may want to obscure the fact that 130 | ## it's an email address and/or generate a new address for this purpose. 131 | #ContactInfo Random Person 132 | ## You might also include your PGP or GPG fingerprint if you have one: 133 | #ContactInfo 0xFFFFFFFF Random Person 134 | 135 | ## Uncomment this to mirror directory information for others. Please do 136 | ## if you have enough bandwidth. 137 | #DirPort 9030 # what port to advertise for directory connections 138 | ## If you want to listen on a port other than the one advertised in 139 | ## DirPort (e.g. to advertise 80 but bind to 9091), you can do it as 140 | ## follows. below too. You'll need to do ipchains or other port 141 | ## forwarding yourself to make this work. 142 | #DirPort 80 NoListen 143 | #DirPort 127.0.0.1:9091 NoAdvertise 144 | ## Uncomment to return an arbitrary blob of html on your DirPort. Now you 145 | ## can explain what Tor is if anybody wonders why your IP address is 146 | ## contacting them. See contrib/tor-exit-notice.html in Tor's source 147 | ## distribution for a sample. 148 | #DirPortFrontPage /etc/tor/tor-exit-notice.html 149 | 150 | ## Uncomment this if you run more than one Tor relay, and add the identity 151 | ## key fingerprint of each Tor relay you control, even if they're on 152 | ## different networks. You declare it here so Tor clients can avoid 153 | ## using more than one of your relays in a single circuit. See 154 | ## https://www.torproject.org/docs/faq#MultipleRelays 155 | ## However, you should never include a bridge's fingerprint here, as it would 156 | ## break its concealability and potentially reveal its IP/TCP address. 157 | #MyFamily $keyid,$keyid,... 158 | 159 | ## A comma-separated list of exit policies. They're considered first 160 | ## to last, and the first match wins. 161 | ## 162 | ## If you want to allow the same ports on IPv4 and IPv6, write your rules 163 | ## using accept/reject *. If you want to allow different ports on IPv4 and 164 | ## IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules 165 | ## using accept/reject *4. 166 | ## 167 | ## If you want to _replace_ the default exit policy, end this with either a 168 | ## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) 169 | ## the default exit policy. Leave commented to just use the default, which is 170 | ## described in the man page or at 171 | ## https://www.torproject.org/documentation.html 172 | ## 173 | ## Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses 174 | ## for issues you might encounter if you use the default exit policy. 175 | ## 176 | ## If certain IPs and ports are blocked externally, e.g. by your firewall, 177 | ## you should update your exit policy to reflect this -- otherwise Tor 178 | ## users will be told that those destinations are down. 179 | ## 180 | ## For security, by default Tor rejects connections to private (local) 181 | ## networks, including to the configured primary public IPv4 and IPv6 addresses, 182 | ## and any public IPv4 and IPv6 addresses on any interface on the relay. 183 | ## See the man page entry for ExitPolicyRejectPrivate if you want to allow 184 | ## "exit enclaving". 185 | ## 186 | #ExitPolicy accept *:6660-6667,reject *:* # allow irc ports on IPv4 and IPv6 but no more 187 | #ExitPolicy accept *:119 # accept nntp ports on IPv4 and IPv6 as well as default exit policy 188 | #ExitPolicy accept *4:119 # accept nntp ports on IPv4 only as well as default exit policy 189 | #ExitPolicy accept6 *6:119 # accept nntp ports on IPv6 only as well as default exit policy 190 | #ExitPolicy reject *:* # no exits allowed 191 | 192 | ## Bridge relays (or "bridges") are Tor relays that aren't listed in the 193 | ## main directory. Since there is no complete public list of them, even an 194 | ## ISP that filters connections to all the known Tor relays probably 195 | ## won't be able to block all the bridges. Also, websites won't treat you 196 | ## differently because they won't know you're running Tor. If you can 197 | ## be a real relay, please do; but if not, be a bridge! 198 | #BridgeRelay 1 199 | ## By default, Tor will advertise your bridge to users through various 200 | ## mechanisms like https://bridges.torproject.org/. If you want to run 201 | ## a private bridge, for example because you'll give out your bridge 202 | ## address manually to your friends, uncomment this line: 203 | #PublishServerDescriptor 0 204 | 205 | TransListenAddress 192.168.100.1 206 | TransPort 9040 207 | DNSListenAddress 192.168.100.1 208 | DNSPort 5353 -------------------------------------------------------------------------------- /cuckoo.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Thanks to Sean Whalen for this amazing post: 4 | # https://infosecspeakeasy.org/t/howto-build-a-cuckoo-sandbox/27 5 | 6 | #-------------------------------------------# 7 | # Install Cuckoo Sandbox Version # 8 | # Tested on Ubuntu 16.04 # 9 | # -Daniel Gallagher # 10 | #-------------------------------------------# 11 | 12 | function usage 13 | { 14 | echo "Usage: $0 " 15 | echo '---Optional Arguments---' 16 | echo 'Cuckoo Install Path -> Example /opt' #option 1 17 | echo 'Database Password -> PostgreSQL password' #option 2 18 | echo 'Public IP -> For web console' #option 3 19 | echo 'Machinery -> kvm | virtualbox' #option 4 20 | exit 21 | } 22 | 23 | rand_passwd=$(date +%s | sha256sum | base64 | head -c 32 ; echo) 24 | auto_ip=$(ip route | grep src | awk '{print $9}') 25 | 26 | cuckoo_path=${1:-/opt} #Default path: /opt 27 | passwd=${2:-$rand_passwd} #Default password is randomish 28 | my_ip=${3:-$auto_ip} #Default IP is interface on install machine 29 | machine=${4:-kvm} #Default machinery: kvm 30 | 31 | cuckoo_passwd=$passwd 32 | db_passwd=\'$passwd\' 33 | 34 | function deps 35 | { 36 | 37 | echo -e "\e[96m[+] Cuckoo Path: $cuckoo_path \e[0m" 38 | echo -e "\e[96m[+] DB Password: $passwd \e[0m" 39 | echo -e "\e[96m[+] Web Portal IP: $my_ip \e[0m" 40 | 41 | echo -e '\e[35m[+] APT Update \e[0m' 42 | apt-get update -y >/dev/null 2>&1 43 | 44 | echo -e '\e[35m[+] APT Upgrade \e[0m' 45 | apt-get upgrade -y >/dev/null 2>&1 46 | 47 | echo -e '\e[35m[+] APT Dist-Upgrade and Autoremove \e[0m' 48 | apt-get dist-upgrade -y >/dev/null 2>&1 49 | apt-get autoremove -y >/dev/null 2>&1 50 | 51 | echo -e '\e[35m[+] Installing Dependencies \e[0m' 52 | 53 | #Basic dependencies 54 | echo -e '\e[93m [+] Round 1 of 3 \e[0m' 55 | apt-get install mongodb python python-dev python-pip python-m2crypto swig -y >/dev/null 2>&1 56 | echo -e '\e[93m [+] Round 2 of 3 \e[0m' 57 | apt-get install libvirt-dev upx-ucl libssl-dev unzip p7zip-full libgeoip-dev libjpeg-dev -y >/dev/null 2>&1 58 | echo -e '\e[93m [+] Round 3 of 3 \e[0m' 59 | apt-get install mono-utils ssdeep libfuzzy-dev libimage-exiftool-perl openjdk-8-jre-headless -y >/dev/null 2>&1 60 | 61 | #Additional dependencies for malheur 62 | apt-get install uthash-dev libtool libconfig-dev libarchive-dev autoconf automake checkinstall -y >/dev/null 2>&1 63 | 64 | #Upgrade pip 65 | pip install --upgrade pip >/dev/null 2>&1 66 | 67 | #To generate PDF reports 68 | apt-get install wkhtmltopdf xvfb xfonts-100dpi -y >/dev/null 2>&1 69 | 70 | #Copy default configs 71 | echo -e '\e[93m [+] Copy Configuration Files \e[0m' 72 | cp -r ./kvm-configs/ /tmp/ 73 | cp -r ./virtualbox-configs/ /tmp/ 74 | cp -r ./gen-configs/ /tmp/ 75 | 76 | echo -e '\e[35m[+] Installing Yara \e[0m' 77 | 78 | #Yara Dependencies 79 | echo -e '\e[93m [+] Dependencies \e[0m' 80 | apt-get install libjansson-dev libmagic-dev bison -y >/dev/null 2>&1 81 | 82 | #Configure Yara for Cuckoo and Magic and then install 83 | echo -e '\e[93m [+] Git Clone \e[0m' 84 | cd /opt 85 | git clone https://github.com/VirusTotal/yara.git >/dev/null 2>&1 86 | cd yara 87 | ./bootstrap.sh >/dev/null 2>&1 88 | echo -e '\e[93m [+] Configure with Cuckoo and Magic Enabled \e[0m' 89 | ./configure --enable-cuckoo --enable-magic >/dev/null 2>&1 90 | make >/dev/null 2>&1 91 | echo -e '\e[93m [+] Installing... \e[0m' 92 | make install >/dev/null 2>&1 93 | 94 | #Install yara-python 95 | echo -e '\e[93m [+] Yara-Python \e[0m' 96 | pip install yara-python >/dev/null 2>&1 97 | 98 | echo -e '\e[35m[+] Installing ClamAV \e[0m' 99 | 100 | #Install ClamAV 101 | apt-get install clamav clamav-daemon clamav-freshclam -y >/dev/null 2>&1 102 | 103 | echo -e '\e[35m[+] Installing Pydeep \e[0m' 104 | 105 | #Install Pydeep 106 | pip install git+https://github.com/kbandla/pydeep.git >/dev/null 2>&1 107 | 108 | echo -e '\e[35m[+] Installing Malheur \e[0m' 109 | 110 | #Install malheur 111 | echo -e '\e[93m [+] Git Clone \e[0m' 112 | cd /opt 113 | git clone https://github.com/rieck/malheur.git >/dev/null 2>&1 114 | cd malheur 115 | ./bootstrap >/dev/null 2>&1 116 | echo -e '\e[93m [+] Configure \e[0m' 117 | ./configure --prefix=/usr >/dev/null 2>&1 118 | make >/dev/null 2>&1 119 | echo -e '\e[93m [+] Installing... \e[0m' 120 | make install >/dev/null 2>&1 121 | 122 | echo -e '\e[35m[+] Installing Volatility \e[0m' 123 | 124 | #Install volatility 125 | echo -e '\e[93m [+] Dependencies \e[0m' 126 | apt-get install python-pil -y >/dev/null 2>&1 127 | pip install distorm3 pycrypto openpyxl >/dev/null 2>&1 128 | echo -e '\e[93m [+] Installing... \e[0m' 129 | apt-get install volatility -y >/dev/null 2>&1 130 | 131 | echo -e '\e[35m[+] Installing PyV8 Javascript Engine (this will take some time) \e[0m' 132 | 133 | #Additional dependencies for PyV8 134 | echo -e '\e[93m [+] Dependencies \e[0m' 135 | apt-get install libboost-all-dev -y >/dev/null 2>&1 136 | 137 | #Install PyV8 138 | echo -e '\e[93m [+] Git Clone \e[0m' 139 | cd /opt 140 | git clone https://github.com/buffer/pyv8.git >/dev/null 2>&1 141 | cd pyv8 142 | echo -e '\e[93m [+] Build (this is the long part...)\e[0m' 143 | python setup.py build >/dev/null 2>&1 144 | echo -e '\e[93m [+] Installing... \e[0m' 145 | python setup.py install >/dev/null 2>&1 146 | 147 | echo -e '\e[35m[+] Configuring TcpDump \e[0m' 148 | 149 | #Configure tcpdump 150 | chmod +s /usr/sbin/tcpdump 151 | 152 | echo -e '\e[35m[+] Installing Suricata \e[0m' 153 | 154 | #Install Suricata 155 | apt-get install suricata -y >/dev/null 2>&1 156 | echo "alert http any any -> any any (msg:\"FILE store all\"; filestore; noalert; sid:15; rev:1;)" | sudo tee /etc/suricata/rules/cuckoo.rules >/dev/null 2>&1 157 | 158 | echo -e '\e[35m[+] Installing ETUpdate \e[0m' 159 | 160 | #Install ETUpdate 161 | cd /opt 162 | git clone https://github.com/seanthegeek/etupdate.git >/dev/null 2>&1 163 | cp etupdate/etupdate /usr/sbin 164 | 165 | #Download rules 166 | /usr/sbin/etupdate -V >/dev/null 2>&1 167 | 168 | } 169 | 170 | function postgres 171 | { 172 | 173 | echo -e '\e[35m[+] Installing PostgreSQL \e[0m' 174 | 175 | #Install PostgreSQL 176 | apt-get install postgresql-9.5 postgresql-contrib-9.5 libpq-dev -y >/dev/null 2>&1 177 | pip install psycopg2 >/dev/null 2>&1 178 | 179 | echo -e '\e[35m[+] Configuring PostgreSQL DB \e[0m' 180 | 181 | su - postgres </dev/null 2>&1 183 | psql -c "CREATE DATABASE cuckoo;" >/dev/null 2>&1 184 | psql -c "GRANT ALL PRIVILEGES ON DATABASE cuckoo to cuckoo;" >/dev/null 2>&1 185 | EOF 186 | 187 | } 188 | 189 | function kvm 190 | { 191 | 192 | echo -e '\e[35m[+] Installing KVM \e[0m' 193 | 194 | #Install KVM and virt-manager 195 | apt-get install qemu-kvm libvirt-bin virt-manager libgl1-mesa-glx -y >/dev/null 2>&1 196 | 197 | #Add current user to kvm and libvirt groups for admin 198 | usermod -a -G kvm $USER 199 | usermod -a -G libvirtd $USER 200 | 201 | #Deactivate default network 202 | echo -e '\e[93m [+] Remove Default Virtual Network \e[0m' 203 | 204 | virsh net-destroy default >/dev/null 2>&1 205 | 206 | #Remove default network from libvirt configuration 207 | virsh net-undefine default >/dev/null 2>&1 208 | 209 | #Create cuckoo network configuration file 210 | echo -e '\e[93m [+] Create Cuckoo Virtual Network \e[0m' 211 | 212 | cat >/tmp/cuckoo_net.xml < 214 | cuckoo 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 223 | EOF 224 | 225 | #Create new cuckoo network from xml configuration 226 | virsh net-define --file /tmp/cuckoo_net.xml >/dev/null 2>&1 227 | 228 | #Set cuckoo network to autostart 229 | virsh net-autostart cuckoo >/dev/null 2>&1 230 | 231 | #Start cuckoo network 232 | virsh net-start cuckoo >/dev/null 2>&1 233 | 234 | } 235 | 236 | function virtualbox 237 | { 238 | 239 | #Add virtualbox repository 240 | apt-add-repository "deb http://download.virtualbox.org/virtualbox/debian xenial contrib" 241 | 242 | #Add repository key 243 | wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | apt-key add - 244 | wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | apt-key add - 245 | 246 | #Update apt packages 247 | apt-get update -y 248 | 249 | #Install virtualbox 250 | apt-get install virtualbox-5.1 -y 251 | 252 | #Install dkms package 253 | apt-get install dkms -y 254 | 255 | } 256 | 257 | function create_cuckoo_user 258 | { 259 | 260 | echo -e '\e[35m[+] Creating Cuckoo User \e[0m' 261 | 262 | #Creates cuckoo system user 263 | adduser --system cuckoo >/dev/null 2>&1 264 | usermod -L cuckoo 265 | usermod -a -G kvm cuckoo 266 | usermod -a -G libvirtd cuckoo 267 | usermod -a -G cuckoo $USER 268 | } 269 | 270 | function cuckoo_mod 271 | { 272 | 273 | echo -e '\e[35m[+] Installing Modified Version of Cuckoo \e[0m' 274 | 275 | #Option to install modified cuckoo version 276 | su - cuckoo </dev/null 2>&1 279 | git clone https://github.com/doomedraven/cuckoo-modified.git >/dev/null 2>&1 280 | mkdir vmshared 281 | cp cuckoo-modified/agent/agent.py vmshared/agent.pyw 282 | EOF 283 | 284 | chmod ug=rwX,o=rX /home/cuckoo/vmshared 285 | mv /home/cuckoo/cuckoo-modified $cuckoo_path/cuckoo 286 | pip install -r $cuckoo_path/cuckoo/requirements.txt >/dev/null 2>&1 287 | cp /tmp/gen-configs/suricata-cuckoo.yaml /etc/suricata/suricata-cuckoo.yaml 288 | 289 | echo -e '\e[93m [+] Installing Signatures \e[0m' 290 | 291 | su - cuckoo </dev/null 2>&1 294 | EOF 295 | 296 | echo -e '\e[93m [+] Modifying Config \e[0m' 297 | 298 | sed -i -e "s@connection =@connection = postgresql://cuckoo:$passwd\@localhost:5432/cuckoo@" $cuckoo_path/cuckoo/conf/cuckoo.conf 299 | 300 | chown -R cuckoo:cuckoo $cuckoo_path/cuckoo 301 | } 302 | 303 | function cuckoo_orig 304 | { 305 | 306 | echo -e '\e[35m[+] Installing Mainstream Version of Cuckoo \e[0m' 307 | 308 | #Option to install original cuckoo version 309 | su - cuckoo </dev/null 2>&1 343 | 344 | echo -e '\e[93m [+] Configuring \e[0m' 345 | 346 | #Remove default nginx configuration 347 | rm /etc/nginx/sites-enabled/default 348 | 349 | #Create cuckoo web server config 350 | cp /tmp/gen-configs/nginx_config /etc/nginx/sites-available/cuckoo 351 | 352 | #Modify nginx IP for web interface 353 | sed -i -e "s@listen IP_Address\:443@listen $my_ip\:443@" /etc/nginx/sites-available/cuckoo 354 | sed -i -e "s@listen IP_Address\:80@listen $my_ip\:80@" /etc/nginx/sites-available/cuckoo 355 | sed -i -e "s@listen IP_Address\:4343@listen $my_ip\:4343@" /etc/nginx/sites-available/cuckoo 356 | sed -i -e "s@allow IP_Address@allow $my_ip@" /etc/nginx/sites-available/cuckoo 357 | 358 | #Enable cuckoo nginx config 359 | ln -s /etc/nginx/sites-available/cuckoo /etc/nginx/sites-enabled/cuckoo 360 | 361 | } 362 | 363 | function self_ssl 364 | { 365 | 366 | echo -e '\e[93m [+] Creating Self-Signed SSL Certificate \e[0m' 367 | 368 | #Create ssl key folder 369 | mkdir /etc/nginx/ssl 370 | 371 | #Generate self-signed certificate 372 | openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/cuckoo.key -out /etc/nginx/ssl/cuckoo.crt -subj "/C=XX/ST=XX/L=XX/O=IT/CN=$my_ip" >/dev/null 2>&1 373 | 374 | echo -e '\e[93m [+] Generating Diffie-Hellman (DH) Parameters (this will take some time) \e[0m' 375 | 376 | #Generate Diffie-Hellman (DH) parameters. This takes a long time! 377 | openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048 >/dev/null 2>&1 378 | 379 | #Secure SSL keys 380 | chown -R root:www-data /etc/nginx/ssl 381 | chmod -R u=rX,g=rX,o= /etc/nginx/ssl 382 | 383 | #Restart nginx 384 | service nginx restart 385 | 386 | } 387 | 388 | function misc_apps 389 | { 390 | 391 | echo -e '\e[35m[+] Installing Inetsim \e[0m' 392 | 393 | #Install inetsim 394 | cd /tmp 395 | wget http://www.inetsim.org/debian/binary/inetsim_1.2.5-1_all.deb >/dev/null 2>&1 396 | 397 | #Install additional inetsim dependencies 398 | apt-get install libcgi-fast-perl libcgi-pm-perl libdigest-hmac-perl libfcgi-perl libio-multiplex-perl libio-socket-inet6-perl libipc-shareable-perl libnet-cidr-perl libnet-dns-perl libnet-ip-perl libnet-server-perl libsocket6-perl liblog-log4perl-perl -y >/dev/null 2>&1 399 | dpkg -i inetsim_1.2.5-1_all.deb >/dev/null 2>&1 400 | 401 | #Copy default inetsim config 402 | cp /tmp/gen-configs/inetsim.conf /etc/inetsim/inetsim.conf 403 | 404 | #Enable inetsim in default config 405 | sed -i -e 's@ENABLED=0@ENABLED=1@' /etc/default/inetsim 406 | 407 | #Restart inetsim 408 | service inetsim restart 409 | 410 | echo -e '\e[35m[+] Installing Tor Proxy \e[0m' 411 | 412 | #Install tor 413 | apt-get install tor -y >/dev/null 2>&1 414 | 415 | #Copy default tor config 416 | cp /tmp/gen-configs/torrc /etc/tor/torrc 417 | 418 | #Restart tor 419 | service tor restart 420 | 421 | echo -e '\e[35m[+] Installing Privoxy \e[0m' 422 | 423 | #Install Privoxy 424 | apt-get install privoxy -y >/dev/null 2>&1 425 | 426 | #Copy default privoxy config 427 | cp /tmp/gen-configs/privoxy_config /etc/privoxy/config 428 | 429 | #Restart privoxy 430 | service privoxy restart 431 | 432 | echo -e '\e[35m[+] Installing Routetor \e[0m' 433 | 434 | #Install cuckoo scripts to utilize tor 435 | cd /opt 436 | git clone https://github.com/seanthegeek/routetor.git >/dev/null 2>&1 437 | cd routetor 438 | cp *tor* /usr/sbin 439 | /usr/sbin/routetor & 440 | 441 | echo -e '\e[35m[+] Installing Vsftpd \e[0m' 442 | 443 | #Create public accessible folder 444 | mkdir /home/cuckoo/vmshared/pub 445 | chown cuckoo:cuckoo /home/cuckoo/vmshared/pub 446 | chmod 777 /home/cuckoo/vmshared/pub 447 | 448 | #Install vsftpd 449 | apt-get install vsftpd -y >/dev/null 2>&1 450 | 451 | #Copy vsftpd config file 452 | cp /tmp/gen-configs/vsftpd.conf /etc/vsftpd.conf 453 | 454 | #Restart vsftpd 455 | service vsftpd restart 456 | 457 | } 458 | 459 | function startup_script 460 | { 461 | 462 | echo -e '\e[35m[+] Creating Startup Script for Cuckoo \e[0m' 463 | 464 | #Install gunicorn 465 | pip install gunicorn >/dev/null 2>&1 466 | 467 | #Copy default startup script 468 | if [ "$machine" = 'virtualbox' ]; then 469 | echo -e '\e[96m [+] Startup Script Set for VirtualBox \e[0m' 470 | cp /tmp/virtualbox-configs/cuckooboot /usr/sbin/cuckooboot 471 | else 472 | echo -e '\e[93m [+] Startup Script Set for KVM \e[0m' 473 | cp /tmp/kvm-configs/cuckooboot /usr/sbin/cuckooboot 474 | fi 475 | 476 | chmod +x /usr/sbin/cuckooboot 477 | 478 | #Modify startup script to fit cuckoo install location 479 | sed -i -e "s@CUCKOO_PATH="/opt/cuckoo"@CUCKOO_PATH="$cuckoo_path/cuckoo"@" /usr/sbin/cuckooboot 480 | 481 | #Add startup crontab entries 482 | (crontab -l -u cuckoo; echo "46 * * * * /usr/sbin/etupdate")| crontab -u cuckoo - 483 | (crontab -l -u cuckoo; echo "@reboot /usr/sbin/routetor")| crontab -u cuckoo - 484 | (crontab -l -u cuckoo; echo "@reboot /usr/sbin/cuckooboot")| crontab -u cuckoo - 485 | 486 | #Run cuckoo 487 | #/usr/sbin/cuckooboot 488 | 489 | echo -e '\e[35m[+] Installation Complete! \e[0m' 490 | 491 | } 492 | 493 | 494 | if [ "$1" = '-h' ]; then 495 | usage 496 | fi 497 | 498 | #Check if script was run as root 499 | if [ $EUID -ne 0 ]; then 500 | echo 'This script must be run as root' 501 | exit 1 502 | fi 503 | 504 | if [ "$4" = 'virtualbox' ]; then 505 | 506 | deps 507 | postgres 508 | virtualbox 509 | create_cuckoo_user 510 | cuckoo_mod 511 | nginx 512 | self_ssl 513 | misc_apps 514 | startup_script 515 | 516 | else 517 | 518 | deps 519 | postgres 520 | kvm 521 | create_cuckoo_user 522 | cuckoo_mod 523 | nginx 524 | self_ssl 525 | misc_apps 526 | startup_script 527 | fi 528 | 529 | exit 0 530 | -------------------------------------------------------------------------------- /gen-configs/inetsim.conf: -------------------------------------------------------------------------------- 1 | ############################################################# 2 | # 3 | # INetSim configuration file 4 | # 5 | ############################################################# 6 | 7 | 8 | ############################################################# 9 | # Main configuration 10 | ############################################################# 11 | 12 | ######################################### 13 | # start_service 14 | # 15 | # The services to start 16 | # 17 | # Syntax: start_service 18 | # 19 | # Default: none 20 | # 21 | # Available service names are: 22 | # dns, http, smtp, pop3, tftp, ftp, ntp, time_tcp, 23 | # time_udp, daytime_tcp, daytime_udp, echo_tcp, 24 | # echo_udp, discard_tcp, discard_udp, quotd_tcp, 25 | # quotd_udp, chargen_tcp, chargen_udp, finger, 26 | # ident, syslog, dummy_tcp, dummy_udp, smtps, pop3s, 27 | # ftps, irc, https 28 | # 29 | start_service dns 30 | start_service http 31 | start_service https 32 | start_service smtp 33 | start_service smtps 34 | start_service pop3 35 | start_service pop3s 36 | start_service ftp 37 | start_service ftps 38 | start_service tftp 39 | start_service irc 40 | start_service ntp 41 | start_service finger 42 | start_service ident 43 | start_service syslog 44 | start_service time_tcp 45 | start_service time_udp 46 | start_service daytime_tcp 47 | start_service daytime_udp 48 | start_service echo_tcp 49 | start_service echo_udp 50 | start_service discard_tcp 51 | start_service discard_udp 52 | start_service quotd_tcp 53 | start_service quotd_udp 54 | start_service chargen_tcp 55 | start_service chargen_udp 56 | start_service dummy_tcp 57 | start_service dummy_udp 58 | 59 | 60 | ######################################### 61 | # service_bind_address 62 | # 63 | # IP address to bind services to 64 | # 65 | # Syntax: service_bind_address 66 | # 67 | # Default: 127.0.0.1 68 | # 69 | service_bind_address 192.168.100.1 70 | 71 | 72 | ######################################### 73 | # service_run_as_user 74 | # 75 | # User to run services 76 | # 77 | # Syntax: service_run_as_user 78 | # 79 | # Default: inetsim 80 | # 81 | #service_run_as_user nobody 82 | 83 | 84 | ######################################### 85 | # service_max_childs 86 | # 87 | # Maximum number of child processes (parallel connections) 88 | # for each service 89 | # 90 | # Syntax: service_max_childs [1..30] 91 | # 92 | # Default: 10 93 | # 94 | #service_max_childs 15 95 | 96 | 97 | ######################################### 98 | # service_timeout 99 | # 100 | # If a client does not send any data for the number of seconds 101 | # given here, the corresponding connection will be closed. 102 | # 103 | # Syntax: service_timeout [1..600] 104 | # 105 | # Default: 120 106 | # 107 | #service_timeout 60 108 | 109 | 110 | ######################################### 111 | # create_reports 112 | # 113 | # Create report with a summary of connections 114 | # for the session on shutdown 115 | # 116 | # Syntax: create_reports [yes|no] 117 | # 118 | # Default: yes 119 | # 120 | #create_reports no 121 | 122 | 123 | ######################################### 124 | # report_language 125 | # 126 | # Set language for reports 127 | # Note: Currently only languages 'en' and 'de' are supported 128 | # 129 | # Syntax: report_language 130 | # 131 | # Default: en 132 | # 133 | #report_language de 134 | 135 | 136 | ############################################################# 137 | # Faketime 138 | ############################################################# 139 | 140 | ######################################### 141 | # faketime_init_delta 142 | # 143 | # Initial number of seconds (positive or negative) 144 | # relative to current date/time for fake time used by all services 145 | # 146 | # Syntax: faketime_init_delta 147 | # 148 | # Default: 0 (use current date/time) 149 | # 150 | #faketime_init_delta 1000 151 | 152 | 153 | ######################################### 154 | # faketime_auto_delay 155 | # 156 | # Number of seconds to wait before incrementing fake time 157 | # by value specified with 'faketime_auto_increment'. 158 | # Setting to '0' disables this option. 159 | # 160 | # Syntax: faketime_auto_delay [0..86400] 161 | # 162 | # Default: 0 (disabled) 163 | # 164 | #faketime_auto_delay 1000 165 | 166 | 167 | ######################################### 168 | # faketime_auto_increment 169 | # 170 | # Number of seconds by which fake time is incremented at 171 | # regular intervals specified by 'faketime_auto_delay'. 172 | # This option only takes effect if 'faketime_auto_delay' 173 | # is enabled (not set to '0'). 174 | # 175 | # Syntax: faketime_auto_increment [-31536000..31536000] 176 | # 177 | # Default: 3600 178 | # 179 | #faketime_auto_increment 86400 180 | 181 | 182 | ############################################################# 183 | # Service DNS 184 | ############################################################# 185 | 186 | ######################################### 187 | # dns_bind_port 188 | # 189 | # Port number to bind DNS service to 190 | # 191 | # Syntax: dns_bind_port 192 | # 193 | # Default: 53 194 | # 195 | dns_bind_port 5342 196 | 197 | 198 | ######################################### 199 | # dns_default_ip 200 | # 201 | # Default IP address to return with DNS replies 202 | # 203 | # Syntax: dns_default_ip 204 | # 205 | # Default: 127.0.0.1 206 | # 207 | dns_default_ip 192.168.100.1 208 | 209 | 210 | ######################################### 211 | # dns_default_hostname 212 | # 213 | # Default hostname to return with DNS replies 214 | # 215 | # Syntax: dns_default_hostname 216 | # 217 | # Default: www 218 | # 219 | #dns_default_hostname somehost 220 | 221 | 222 | ######################################### 223 | # dns_default_domainname 224 | # 225 | # Default domain name to return with DNS replies 226 | # 227 | # Syntax: dns_default_domainname 228 | # 229 | # Default: inetsim.org 230 | # 231 | #dns_default_domainname some.domain 232 | 233 | 234 | ######################################### 235 | # dns_static 236 | # 237 | # Static mappings for DNS 238 | # 239 | # Syntax: dns_static 240 | # 241 | # Default: none 242 | # 243 | #dns_static www.foo.com 10.10.10.10 244 | #dns_static ns1.foo.com 10.70.50.30 245 | #dns_static ftp.bar.net 10.10.20.30 246 | 247 | 248 | ######################################### 249 | # dns_version 250 | # 251 | # DNS version 252 | # 253 | # Syntax: dns_version 254 | # 255 | # Default: "INetSim DNS Server" 256 | # 257 | #dns_version "9.2.4" 258 | 259 | 260 | ############################################################# 261 | # Service HTTP 262 | ############################################################# 263 | 264 | ######################################### 265 | # http_bind_port 266 | # 267 | # Port number to bind HTTP service to 268 | # 269 | # Syntax: http_bind_port 270 | # 271 | # Default: 80 272 | # 273 | #http_bind_port 80 274 | 275 | 276 | ######################################### 277 | # http_version 278 | # 279 | # Version string to return in HTTP replies 280 | # 281 | # Syntax: http_version 282 | # 283 | # Default: "INetSim HTTP server" 284 | # 285 | #http_version "Microsoft-IIS/4.0" 286 | 287 | 288 | ######################################### 289 | # http_fakemode 290 | # 291 | # Turn HTTP fake mode on or off 292 | # 293 | # Syntax: http_fakemode [yes|no] 294 | # 295 | # Default: yes 296 | # 297 | #http_fakemode no 298 | 299 | 300 | ######################################### 301 | # http_fakefile 302 | # 303 | # Fake files returned in fake mode based on the file extension 304 | # in the HTTP request. 305 | # The fake files must be placed in /http/fakefiles 306 | # 307 | # Syntax: http_fakefile 308 | # 309 | # Default: none 310 | # 311 | http_fakefile txt sample.txt text/plain 312 | http_fakefile htm sample.html text/html 313 | http_fakefile html sample.html text/html 314 | http_fakefile php sample.html text/html 315 | http_fakefile gif sample.gif image/gif 316 | http_fakefile jpg sample.jpg image/jpeg 317 | http_fakefile jpeg sample.jpg image/jpeg 318 | http_fakefile png sample.png image/png 319 | http_fakefile bmp sample.bmp image/x-ms-bmp 320 | http_fakefile ico favicon.ico image/x-icon 321 | http_fakefile exe sample_gui.exe x-msdos-program 322 | http_fakefile com sample_gui.exe x-msdos-program 323 | 324 | 325 | ######################################### 326 | # http_default_fakefile 327 | # 328 | # The default fake file returned in fake mode if the file extension 329 | # in the HTTP request does not match any of the extensions 330 | # defined above. 331 | # 332 | # The default fake file must be placed in /http/fakefiles 333 | # 334 | # Syntax: http_default_fakefile 335 | # 336 | # Default: none 337 | # 338 | http_default_fakefile sample.html text/html 339 | 340 | 341 | ######################################### 342 | # http_static_fakefile 343 | # 344 | # Fake files returned in fake mode based on static path. 345 | # The fake files must be placed in /http/fakefiles 346 | # 347 | # Syntax: http_static_fakefile 348 | # 349 | # Default: none 350 | # 351 | #http_static_fakefile /path/ sample_gui.exe x-msdos-program 352 | #http_static_fakefile /path/to/file.exe sample_gui.exe x-msdos-program 353 | 354 | 355 | ############################################################# 356 | # Service HTTPS 357 | ############################################################# 358 | 359 | ######################################### 360 | # https_bind_port 361 | # 362 | # Port number to bind HTTPS service to 363 | # 364 | # Syntax: https_bind_port 365 | # 366 | # Default: 443 367 | # 368 | #https_bind_port 443 369 | 370 | 371 | ######################################### 372 | # https_version 373 | # 374 | # Version string to return in HTTPS replies 375 | # 376 | # Syntax: https_version 377 | # 378 | # Default: "INetSim HTTPs server" 379 | # 380 | #https_version "Microsoft-IIS/4.0" 381 | 382 | 383 | ######################################### 384 | # https_fakemode 385 | # 386 | # Turn HTTPS fake mode on or off 387 | # 388 | # Syntax: https_fakemode [yes|no] 389 | # 390 | # Default: yes 391 | # 392 | #https_fakemode no 393 | 394 | 395 | ######################################### 396 | # https_fakefile 397 | # 398 | # Fake files returned in fake mode based on the file extension 399 | # in the HTTPS request. 400 | # The fake files must be placed in /http/fakefiles 401 | # 402 | # Syntax: https_fakefile 403 | # 404 | # Default: none 405 | # 406 | https_fakefile txt sample.txt text/plain 407 | https_fakefile htm sample.html text/html 408 | https_fakefile html sample.html text/html 409 | https_fakefile php sample.html text/html 410 | https_fakefile gif sample.gif image/gif 411 | https_fakefile jpg sample.jpg image/jpeg 412 | https_fakefile jpeg sample.jpg image/jpeg 413 | https_fakefile png sample.png image/png 414 | https_fakefile bmp sample.bmp image/x-ms-bmp 415 | https_fakefile ico favicon.ico image/x-icon 416 | https_fakefile exe sample_gui.exe x-msdos-program 417 | https_fakefile com sample_gui.exe x-msdos-program 418 | 419 | 420 | ######################################### 421 | # https_default_fakefile 422 | # 423 | # The default fake file returned in fake mode if the file extension 424 | # in the HTTPS request does not match any of the extensions 425 | # defined above. 426 | # 427 | # The default fake file must be placed in /http/fakefiles 428 | # 429 | # Syntax: https_default_fakefile 430 | # 431 | # Default: none 432 | # 433 | https_default_fakefile sample.html text/html 434 | 435 | 436 | ######################################### 437 | # https_static_fakefile 438 | # 439 | # Fake files returned in fake mode based on static path. 440 | # The fake files must be placed in /http/fakefiles 441 | # 442 | # Syntax: https_static_fakefile 443 | # 444 | # Default: none 445 | # 446 | #https_static_fakefile /path/ sample_gui.exe x-msdos-program 447 | #https_static_fakefile /path/to/file.exe sample_gui.exe x-msdos-program 448 | 449 | 450 | ######################################### 451 | # https_ssl_keyfile 452 | # 453 | # Name of the SSL private key PEM file. 454 | # The key MUST NOT be encrypted! 455 | # 456 | # The file must be placed in /certs/ 457 | # 458 | # Syntax: https_ssl_keyfile 459 | # 460 | # Default: default_key.pem 461 | # 462 | #https_ssl_keyfile https_key.pem 463 | 464 | 465 | ######################################### 466 | # https_ssl_certfile 467 | # 468 | # Name of the SSL certificate file. 469 | # 470 | # The file must be placed in /certs/ 471 | # 472 | # Syntax: https_ssl_certfile 473 | # 474 | # Default: default_cert.pem 475 | # 476 | #https_ssl_certfile https_cert.pem 477 | 478 | 479 | ######################################### 480 | # https_ssl_dhfile 481 | # 482 | # Name of the Diffie-Hellman parameter PEM file. 483 | # 484 | # The file must be placed in /certs/ 485 | # 486 | # Syntax: https_ssl_dhfile 487 | # 488 | # Default: none 489 | # 490 | #https_ssl_dhfile https_dh1024.pem 491 | 492 | 493 | ############################################################# 494 | # Service SMTP 495 | ############################################################# 496 | 497 | ######################################### 498 | # smtp_bind_port 499 | # 500 | # Port number to bind SMTP service to 501 | # 502 | # Syntax: smtp_bind_port 503 | # 504 | # Default: 25 505 | # 506 | #smtp_bind_port 25 507 | 508 | 509 | ######################################### 510 | # smtp_fqdn_hostname 511 | # 512 | # The FQDN hostname used for SMTP 513 | # 514 | # Syntax: smtp_fqdn_hostname 515 | # 516 | # Default: mail.inetsim.org 517 | # 518 | #smtp_fqdn_hostname foo.bar.org 519 | 520 | 521 | ######################################### 522 | # smtp_banner 523 | # 524 | # The banner string used in SMTP greeting message 525 | # 526 | # Syntax: smtp_banner 527 | # 528 | # Default: "INetSim Mail Service ready." 529 | # 530 | #smtp_banner "SMTP Mailer ready." 531 | 532 | 533 | ######################################### 534 | # smtp_helo_required 535 | # 536 | # Client has to send HELO/EHLO before any other command 537 | # 538 | # Syntax: smtp_helo_required [yes|no] 539 | # 540 | # Default: no 541 | # 542 | #smtp_helo_required yes 543 | 544 | 545 | ######################################### 546 | # smtp_extended_smtp 547 | # 548 | # Turn support for extended smtp (ESMTP) on or off 549 | # 550 | # Syntax: smtp_extended_smtp [yes|no] 551 | # 552 | # Default: yes 553 | # 554 | #smtp_extended_smtp no 555 | 556 | 557 | ######################################### 558 | # smtp_service_extension 559 | # 560 | # SMTP service extensions offered to client. 561 | # For more information, see 562 | # 563 | # 564 | # Syntax: smtp_service_extension 565 | # 566 | # Supported extensions and parameters: 567 | # VRFY 568 | # EXPN 569 | # HELP 570 | # 8BITMIME 571 | # SIZE # one optional parameter 572 | # ENHANCEDSTATUSCODES 573 | # AUTH # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1] 574 | # DSN 575 | # SEND 576 | # SAML 577 | # SOML 578 | # TURN 579 | # ETRN 580 | # ATRN 581 | # VERP 582 | # MTRK 583 | # CHUNKING 584 | # STARTTLS 585 | # DELIVERBY # one optional parameter 586 | # SUBMITTER 587 | # CHECKPOINT 588 | # BINARYMIME 589 | # NO-SOLICITING # one optional parameter 590 | # FUTURERELEASE # two required parameters 591 | # 592 | # Default: none 593 | # 594 | smtp_service_extension VRFY 595 | smtp_service_extension EXPN 596 | smtp_service_extension HELP 597 | smtp_service_extension 8BITMIME 598 | smtp_service_extension SIZE 102400000 599 | smtp_service_extension ENHANCEDSTATUSCODES 600 | smtp_service_extension AUTH PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1 601 | smtp_service_extension DSN 602 | smtp_service_extension ETRN 603 | smtp_service_extension STARTTLS 604 | # 605 | 606 | 607 | ######################################### 608 | # smtp_auth_reversibleonly 609 | # 610 | # Only offer authentication mechanisms which allow reversing 611 | # the authentication information sent by a client 612 | # to clear text username/password. 613 | # This option only takes effect if 'smtp_extended_smtp' is 614 | # enabled and 'smtp_service_extension AUTH' is configured. 615 | # 616 | # Syntax: smtp_auth_reversibleonly [yes|no] 617 | # 618 | # Default: no 619 | # 620 | #smtp_auth_reversibleonly yes 621 | 622 | 623 | ######################################### 624 | # smtp_auth_required 625 | # 626 | # Force the client to authenticate. 627 | # This option only takes effect if 'smtp_extended_smtp' is 628 | # enabled and 'smtp_service_extension AUTH' is configured. 629 | # 630 | # Syntax: smtp_auth_required [yes|no] 631 | # 632 | # Default: no 633 | # 634 | #smtp_auth_required yes 635 | 636 | 637 | ######################################### 638 | # smtp_ssl_keyfile 639 | # 640 | # Name of the SSL private key PEM file. 641 | # The key MUST NOT be encrypted! 642 | # 643 | # This option only takes effect if 'smtp_extended_smtp' is 644 | # enabled and 'smtp_service_extension STARTTLS' is configured. 645 | # 646 | # The file must be placed in /certs/ 647 | # 648 | # Note: If no key file is specified, the extension STARTTLS 649 | # will be disabled. 650 | # 651 | # Syntax: smtp_ssl_keyfile 652 | # 653 | # Default: default_key.pem 654 | # 655 | #smtp_ssl_keyfile smtp_key.pem 656 | 657 | 658 | ######################################### 659 | # smtp_ssl_certfile 660 | # 661 | # Name of the SSL certificate PEM file. 662 | # 663 | # This option only takes effect if 'smtp_extended_smtp' is 664 | # enabled and 'smtp_service_extension STARTTLS' is configured. 665 | # 666 | # The file must be placed in /certs/ 667 | # 668 | # Note: If no cert file is specified, the extension STARTTLS 669 | # will be disabled. 670 | # 671 | # Syntax: smtp_ssl_certfile 672 | # 673 | # Default: default_cert.pem 674 | # 675 | #smtp_ssl_certfile smtp_cert.pem 676 | 677 | 678 | ######################################### 679 | # smtp_ssl_dhfile 680 | # 681 | # Name of the Diffie-Hellman parameter PEM file. 682 | # 683 | # The file must be placed in /certs/ 684 | # 685 | # Syntax: smtp_ssl_dhfile 686 | # 687 | # Default: none 688 | # 689 | #smtp_ssl_dhfile smtp_dh1024.pem 690 | 691 | 692 | 693 | ############################################################# 694 | # Service SMTPS 695 | ############################################################# 696 | 697 | ######################################### 698 | # smtps_bind_port 699 | # 700 | # Port number to bind SMTPS service to 701 | # 702 | # Syntax: smtps_bind_port 703 | # 704 | # Default: 465 705 | # 706 | #smtps_bind_port 465 707 | 708 | 709 | ######################################### 710 | # smtps_fqdn_hostname 711 | # 712 | # The FQDN hostname used for SMTPS 713 | # 714 | # Syntax: smtps_fqdn_hostname 715 | # 716 | # Default: mail.inetsim.org 717 | # 718 | #smtps_fqdn_hostname foo.bar.org 719 | 720 | 721 | ######################################### 722 | # smtps_banner 723 | # 724 | # The banner string used in SMTPS greeting message 725 | # 726 | # Syntax: smtps_banner 727 | # 728 | # Default: "INetSim Mail Service ready." 729 | # 730 | #smtps_banner "SMTPS Mailer ready." 731 | 732 | 733 | ######################################### 734 | # smtps_helo_required 735 | # 736 | # Client has to send HELO/EHLO before any other command 737 | # 738 | # Syntax: smtps_helo_required [yes|no] 739 | # 740 | # Default: no 741 | # 742 | #smtps_helo_required yes 743 | 744 | 745 | ######################################### 746 | # smtps_extended_smtp 747 | # 748 | # Turn support for extended smtp (ESMTP) on or off 749 | # 750 | # Syntax: smtps_extended_smtp [yes|no] 751 | # 752 | # Default: yes 753 | # 754 | #smtps_extended_smtp no 755 | 756 | 757 | ######################################### 758 | # smtps_service_extension 759 | # 760 | # SMTP service extensions offered to client. 761 | # For more information, see 762 | # 763 | # 764 | # Syntax: smtp_service_extension 765 | # 766 | # Supported extensions and parameters: 767 | # VRFY 768 | # EXPN 769 | # HELP 770 | # 8BITMIME 771 | # SIZE # one optional parameter 772 | # ENHANCEDSTATUSCODES 773 | # AUTH # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1] 774 | # DSN 775 | # SEND 776 | # SAML 777 | # SOML 778 | # TURN 779 | # ETRN 780 | # ATRN 781 | # VERP 782 | # MTRK 783 | # CHUNKING 784 | # DELIVERBY # one optional parameter 785 | # SUBMITTER 786 | # CHECKPOINT 787 | # BINARYMIME 788 | # NO-SOLICITING # one optional parameter 789 | # FUTURERELEASE # two required parameters 790 | # 791 | # Default: none 792 | # 793 | smtps_service_extension VRFY 794 | smtps_service_extension EXPN 795 | smtps_service_extension HELP 796 | smtps_service_extension 8BITMIME 797 | smtps_service_extension SIZE 102400000 798 | smtps_service_extension ENHANCEDSTATUSCODES 799 | smtps_service_extension AUTH PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1 800 | smtps_service_extension DSN 801 | smtps_service_extension ETRN 802 | # 803 | 804 | 805 | ######################################### 806 | # smtps_auth_reversibleonly 807 | # 808 | # Only offer authentication mechanisms which allow reversing 809 | # the authentication information sent by a client 810 | # to clear text username/password. 811 | # This option only takes effect if 'smtps_extended_smtp' is 812 | # enabled and 'smtps_service_extension AUTH' is configured. 813 | # 814 | # Syntax: smtps_auth_reversibleonly [yes|no] 815 | # 816 | # Default: no 817 | # 818 | #smtps_auth_reversibleonly yes 819 | 820 | 821 | ######################################### 822 | # smtps_auth_required 823 | # 824 | # Force the client to authenticate. 825 | # This option only takes effect if 'smtps_extended_smtp' is 826 | # enabled and 'smtp_service_extension AUTH' is configured. 827 | # 828 | # Syntax: smtps_auth_required [yes|no] 829 | # 830 | # Default: no 831 | # 832 | #smtps_auth_required yes 833 | 834 | 835 | ######################################### 836 | # smtps_ssl_keyfile 837 | # 838 | # Name of the SSL private key PEM file. 839 | # The key MUST NOT be encrypted! 840 | # 841 | # The file must be placed in /certs/ 842 | # 843 | # Syntax: smtps_ssl_keyfile 844 | # 845 | # Default: default_key.pem 846 | # 847 | #smtps_ssl_keyfile smtps_key.pem 848 | 849 | 850 | ######################################### 851 | # smtps_ssl_certfile 852 | # 853 | # Name of the SSL certificate PEM file. 854 | # 855 | # The file must be placed in /certs/ 856 | # 857 | # Syntax: smtps_ssl_certfile 858 | # 859 | # Default: default_cert.pem 860 | # 861 | #smtps_ssl_certfile smtps_cert.pem 862 | 863 | 864 | ######################################### 865 | # smtps_ssl_dhfile 866 | # 867 | # Name of the Diffie-Hellman parameter PEM file. 868 | # 869 | # The file must be placed in /certs/ 870 | # 871 | # Syntax: smtps_ssl_dhfile 872 | # 873 | # Default: none 874 | # 875 | #smtps_ssl_dhfile smtps_dh1024.pem 876 | 877 | 878 | ############################################################# 879 | # Service POP3 880 | ############################################################# 881 | 882 | ######################################### 883 | # pop3_bind_port 884 | # 885 | # Port number to bind POP3 service to 886 | # 887 | # Syntax: pop3_bind_port 888 | # 889 | # Default: 110 890 | # 891 | #pop3_bind_port 110 892 | 893 | 894 | ######################################### 895 | # pop3_banner 896 | # 897 | # The banner string used in POP3 greeting message 898 | # 899 | # Syntax: pop3_banner 900 | # 901 | # Default: "INetSim POP3 Server ready" 902 | # 903 | #pop3_banner "POP3 Server ready" 904 | 905 | 906 | ######################################### 907 | # pop3_hostname 908 | # 909 | # The hostname used in POP3 greeting message 910 | # 911 | # Syntax: pop3_hostname 912 | # 913 | # Default: pop3host 914 | # 915 | #pop3_hostname pop3server 916 | 917 | 918 | ######################################### 919 | # pop3_mbox_maxmails 920 | # 921 | # Maximum number of e-mails to select from supplied mbox files 922 | # for creation of random POP3 mailbox 923 | # 924 | # Syntax: pop3_mbox_maxmails 925 | # 926 | # Default: 10 927 | # 928 | #pop3_mbox_maxmails 20 929 | 930 | 931 | ######################################### 932 | # pop3_mbox_reread 933 | # 934 | # Re-read supplied mbox files if POP3 service was inactive 935 | # for seconds 936 | # 937 | # Syntax: pop3_mbox_reread 938 | # 939 | # Default: 180 940 | # 941 | #pop3_mbox_reread 300 942 | 943 | 944 | ######################################### 945 | # pop3_mbox_rebuild 946 | # 947 | # Rebuild random POP3 mailbox if POP3 service was inactive 948 | # for seconds 949 | # 950 | # Syntax: pop3_mbox_rebuild 951 | # 952 | # Default: 60 953 | # 954 | #pop3_mbox_rebuild 120 955 | 956 | 957 | ######################################### 958 | # pop3_enable_apop 959 | # 960 | # Turn APOP on or off 961 | # 962 | # Syntax: pop3_enable_apop [yes|no] 963 | # 964 | # Default: yes 965 | # 966 | #pop3_enable_apop no 967 | 968 | 969 | ######################################### 970 | # pop3_auth_reversibleonly 971 | # 972 | # Only offer authentication mechanisms which allow reversing 973 | # the authentication information sent by a client 974 | # to clear text username/password 975 | # 976 | # Syntax: pop3_auth_reversibleonly [yes|no] 977 | # 978 | # Default: no 979 | # 980 | #pop3_auth_reversibleonly yes 981 | 982 | 983 | ######################################### 984 | # pop3_enable_capabilities 985 | # 986 | # Turn support for pop3 capabilities on or off 987 | # 988 | # Syntax: pop3_enable_capabilities [yes|no] 989 | # 990 | # Default: yes 991 | # 992 | #pop3_enable_capabilities no 993 | 994 | 995 | ######################################### 996 | # pop3_capability 997 | # 998 | # POP3 capabilities offered to client. 999 | # For more information, see 1000 | # 1001 | # 1002 | # Syntax: pop3_capability 1003 | # 1004 | # Supported capabilities and parameters: 1005 | # TOP 1006 | # USER 1007 | # UIDL 1008 | # SASL # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1] 1009 | # RESP-CODES 1010 | # EXPIRE # one required parameter and one optional parameter 1011 | # LOGIN-DELAY # one required parameter and one optional parameter 1012 | # IMPLEMENTATION # one required parameter 1013 | # AUTH-RESP-CODE 1014 | # STLS 1015 | # 1016 | # Default: none 1017 | # 1018 | pop3_capability TOP 1019 | pop3_capability USER 1020 | pop3_capability SASL PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1 1021 | pop3_capability UIDL 1022 | pop3_capability IMPLEMENTATION "INetSim POP3 server" 1023 | pop3_capability STLS 1024 | # 1025 | 1026 | 1027 | ######################################### 1028 | # pop3_ssl_keyfile 1029 | # 1030 | # Name of the SSL private key PEM file. 1031 | # The key MUST NOT be encrypted! 1032 | # 1033 | # This option only takes effect if 'pop3_enable_capabilities' is 1034 | # true and 'pop3_capability STLS' is configured. 1035 | # 1036 | # The file must be placed in /certs/ 1037 | # 1038 | # Note: If no key file is specified, capability STLS will be disabled. 1039 | # 1040 | # Syntax: pop3_ssl_keyfile 1041 | # 1042 | # Default: default_key.pem 1043 | # 1044 | #pop3_ssl_keyfile pop3_key.pem 1045 | 1046 | 1047 | ######################################### 1048 | # pop3_ssl_certfile 1049 | # 1050 | # Name of the SSL certificate PEM file. 1051 | # 1052 | # This option only takes effect if 'pop3_enable_capabilities' is 1053 | # true and 'pop3_capability STLS' is configured. 1054 | # 1055 | # The file must be placed in /certs/ 1056 | # 1057 | # Note: If no cert file is specified, capability STLS will be disabled. 1058 | # 1059 | # Syntax: pop3_ssl_certfile 1060 | # 1061 | # Default: default_cert.pem 1062 | # 1063 | #pop3_ssl_certfile pop3_cert.pem 1064 | 1065 | 1066 | ######################################### 1067 | # pop3_ssl_dhfile 1068 | # 1069 | # Name of the Diffie-Hellman parameter PEM file. 1070 | # 1071 | # The file must be placed in /certs/ 1072 | # 1073 | # Syntax: pop3_ssl_dhfile 1074 | # 1075 | # Default: none 1076 | # 1077 | #pop3_ssl_dhfile pop3_dh1024.pem 1078 | 1079 | 1080 | ############################################################# 1081 | # Service POP3S 1082 | ############################################################# 1083 | 1084 | ######################################### 1085 | # pop3s_bind_port 1086 | # 1087 | # Port number to bind POP3S service to 1088 | # 1089 | # Syntax: pop3s_bind_port 1090 | # 1091 | # Default: 995 1092 | # 1093 | #pop3s_bind_port 995 1094 | 1095 | 1096 | ######################################### 1097 | # pop3s_banner 1098 | # 1099 | # The banner string used in POP3 greeting message 1100 | # 1101 | # Syntax: pop3s_banner 1102 | # 1103 | # Default: "INetSim POP3 Server ready" 1104 | # 1105 | #pop3s_banner "POP3 Server ready" 1106 | 1107 | 1108 | ######################################### 1109 | # pop3s_hostname 1110 | # 1111 | # The hostname used in POP3 greeting message 1112 | # 1113 | # Syntax: pop3s_hostname 1114 | # 1115 | # Default: pop3host 1116 | # 1117 | #pop3s_hostname pop3server 1118 | 1119 | 1120 | ######################################### 1121 | # pop3s_mbox_maxmails 1122 | # 1123 | # Maximum number of e-mails to select from supplied mbox files 1124 | # for creation of random POP3 mailbox 1125 | # 1126 | # Syntax: pop3s_mbox_maxmails 1127 | # 1128 | # Default: 10 1129 | # 1130 | #pop3s_mbox_maxmails 20 1131 | 1132 | 1133 | ######################################### 1134 | # pop3s_mbox_reread 1135 | # 1136 | # Re-read supplied mbox files if POP3S service was inactive 1137 | # for seconds 1138 | # 1139 | # Syntax: pop3s_mbox_reread 1140 | # 1141 | # Default: 180 1142 | # 1143 | #pop3s_mbox_reread 300 1144 | 1145 | 1146 | ######################################### 1147 | # pop3s_mbox_rebuild 1148 | # 1149 | # Rebuild random POP3 mailbox if POP3S service was inactive 1150 | # for seconds 1151 | # 1152 | # Syntax: pop3s_mbox_rebuild 1153 | # 1154 | # Default: 60 1155 | # 1156 | #pop3s_mbox_rebuild 120 1157 | 1158 | 1159 | ######################################### 1160 | # pop3s_enable_apop 1161 | # 1162 | # Turn APOP on or off 1163 | # 1164 | # Syntax: pop3s_enable_apop [yes|no] 1165 | # 1166 | # Default: yes 1167 | # 1168 | #pop3s_enable_apop no 1169 | 1170 | 1171 | ######################################### 1172 | # pop3s_auth_reversibleonly 1173 | # 1174 | # Only offer authentication mechanisms which allow reversing 1175 | # the authentication information sent by a client 1176 | # to clear text username/password 1177 | # 1178 | # Syntax: pop3s_auth_reversibleonly [yes|no] 1179 | # 1180 | # Default: no 1181 | # 1182 | #pop3s_auth_reversibleonly yes 1183 | 1184 | 1185 | ######################################### 1186 | # pop3s_enable_capabilities 1187 | # 1188 | # Turn support for pop3 capabilities on or off 1189 | # 1190 | # Syntax: pop3s_enable_capabilities [yes|no] 1191 | # 1192 | # Default: yes 1193 | # 1194 | #pop3s_enable_capabilities no 1195 | 1196 | 1197 | ######################################### 1198 | # pop3s_capability 1199 | # 1200 | # POP3 capabilities offered to client. 1201 | # For more information, see 1202 | # 1203 | # 1204 | # Syntax: pop3s_capability 1205 | # 1206 | # Supported capabilities and parameters: 1207 | # TOP 1208 | # USER 1209 | # UIDL 1210 | # SASL # one or more of [PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1] 1211 | # RESP-CODES 1212 | # EXPIRE # one required parameter and one optional parameter 1213 | # LOGIN-DELAY # one required parameter and one optional parameter 1214 | # IMPLEMENTATION # one required parameter 1215 | # AUTH-RESP-CODE 1216 | # 1217 | # Default: none 1218 | # 1219 | pop3s_capability TOP 1220 | pop3s_capability USER 1221 | pop3s_capability SASL PLAIN LOGIN ANONYMOUS CRAM-MD5 CRAM-SHA1 1222 | pop3s_capability UIDL 1223 | pop3s_capability IMPLEMENTATION "INetSim POP3s server" 1224 | # 1225 | 1226 | 1227 | ######################################### 1228 | # pop3s_ssl_keyfile 1229 | # 1230 | # Name of the SSL private key PEM file. 1231 | # The key MUST NOT be encrypted! 1232 | # 1233 | # The file must be placed in /certs/ 1234 | # 1235 | # Syntax: pop3s_ssl_keyfile 1236 | # 1237 | # Default: default_key.pem 1238 | # 1239 | #pop3s_ssl_keyfile pop3s_key.pem 1240 | 1241 | 1242 | ######################################### 1243 | # pop3s_ssl_certfile 1244 | # 1245 | # Name of the SSL certificate PEM file. 1246 | # 1247 | # The file must be placed in /certs/ 1248 | # 1249 | # Syntax: pop3s_ssl_certfile 1250 | # 1251 | # Default: default_cert.pem 1252 | # 1253 | #pop3s_ssl_certfile pop3s_cert.pem 1254 | 1255 | 1256 | ######################################### 1257 | # pop3s_ssl_dhfile 1258 | # 1259 | # Name of the Diffie-Hellman parameter PEM file. 1260 | # 1261 | # The file must be placed in /certs/ 1262 | # 1263 | # Syntax: pop3s_ssl_dhfile 1264 | # 1265 | # Default: none 1266 | # 1267 | #pop3s_ssl_dhfile pop3s_dh1024.pem 1268 | 1269 | 1270 | ############################################################# 1271 | # Service TFTP 1272 | ############################################################# 1273 | 1274 | ######################################### 1275 | # tftp_bind_port 1276 | # 1277 | # Port number to bind TFTP service to 1278 | # 1279 | # Syntax: tftp_bind_port 1280 | # 1281 | # Default: 69 1282 | # 1283 | #tftp_bind_port 69 1284 | 1285 | 1286 | ######################################### 1287 | # tftp_allow_overwrite 1288 | # 1289 | # Allow overwriting of existing files 1290 | # 1291 | # Syntax: tftp_allow_overwrite [yes|no] 1292 | # 1293 | # Default: no 1294 | # 1295 | #tftp_allow_overwrite yes 1296 | 1297 | 1298 | ######################################### 1299 | # tftp_enable_options 1300 | # 1301 | # Turn support for tftp options on or off 1302 | # 1303 | # Syntax: tftp_enable_options [yes|no] 1304 | # 1305 | # Default: yes 1306 | # 1307 | #tftp_enable_options no 1308 | 1309 | 1310 | ######################################### 1311 | # tftp_option 1312 | # 1313 | # TFTP extensions offered to client. 1314 | # For more information, see RFC 2347 1315 | # 1316 | # Syntax: tftp_option