Skip to content

This is a Ansible script for building a ready to go Cuckoo Sandbox server.

License

Notifications You must be signed in to change notification settings

netcrawlr/Ansible-Cuckoo

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

62 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Synopsis

This is a fully functional updated standalone Ansible Playbook for building a Cuckoo Sandbox server out of box. It is successfully tested on a Ubuntu 18.04(bionic)AMD64 with the following capabilities are included:

  • Cuckoo Sandbox v2.0.6 inside virtual environment
  • Yara v3.9
  • Volatility v2.6
  • Suricata IDS v4.1
  • Java v8 and Elasticsearch v5.6
  • Moloch v1.8
  • Support for vSphere(should work for ESXi as well)
  • Django-based Web Interface and MongoDB
  • PostgreSQL for simultanous analyzes on multiple sandboxes
  • SSDeep
  • Tcpdump
  • M2Crypto
  • Tor
  • INetSim

Prerequisites

The playbook automatically integrates Cuckoo to systemd. It creates the following services: cuckoo.service, cuckoo_api.service, cuckoo_web.service and cuckoo_rooter.service. If you dont have a vpn to route traffic through, disable the Openvpn role in cuckoo-playbook/site.yml and remove openvpnclient.service from cuckoo-playbook/roles/start_up_cuckoo/files/cuckoo_rooter.service at the top of the file, otherwise Cuckoo will fail to start.

It is very important that you change the config files before you start the playbook.

  • cuckoo-playbook/inventories/production/hosts (for remote installation) or cuckoo-playbook/inventories/staging/hosts (for local installation)

  • cuckoo-playbook/inventories/production/hosts

  • cuckoo-playbook/roles/cuckoo/files/cuckoo.conf

  • cuckoo-playbook/roles/cuckoo/files/vsphere.conf

  • cuckoo-playbook/roles/cuckoo/files/routing.conf

  • cuckoo-playbook/roles/elasticsearch/files/elasticsearch.yml

  • cuckoo-playbook/roles/suricata/files/suricata

  • cuckoo-playbook/roles/tor/files/torrc

  • Change variables in cuckoo-playbook/inventories/production/group_vars/all or cuckoo-playbook/inventories/staging/group_vars/all depending on your setup(remote/local) to reflect correct distribution and NIC names.

  • Change IP-address in cuckoo-playbook/roles/start_up_cuckoo/files/cuckoo_api.service and cuckoo-playbook/roles/start_up_cuckoo/files/cuckoo_web.service to reflect your setup.

Installation

The playbook aims to succesfully install to a fresh install of Ubuntu 18.04 Server(amd64) with the following package options:

  • openssh-server
  • python 2.7

After the base OS install a dist-upgrade was conducted:

apt update & apt dist-upgrade

Installation of the Cuckoo environment is done with the following steps:

  1. Clone this repository;

  2. Refer to prerequisites for files to edit before running the playbook.

  3. Replace the placeholders in cuckoo-playbook/inventories/production/hosts with the correct ones for your installation, where:

    • HOST is the IP address of the server to install Cuckoo to
    • ADMIN is a user with sudo privileges on the server
    • PASSWORD is the user ADMIN password
  4. Run the following command inside cuckoo-playbook folder:

ansible-playbook -i inventories/production site.yml

By default, Cuckoo will be installed to /opt/cuckoo inside a virtual environment and a cuckoo user and group will be created. These values can be modified at group_vars file:

cuckoo_user: 'cuckoo'
cuckoo_dir: '/opt/cuckoo'

Usage

Once the installation has completed, Suricata, Moloch, Cuckoo Rooter alongside API, Web interface and Cuckoo itself will start up automatically.

Disclaimer

This Playbook is created for use as a part of a Bachelor Thesis. It's environment has been successfully run on a ESXi host connected to a vCenter(vSphere).

About

This is a Ansible script for building a ready to go Cuckoo Sandbox server.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 61.9%
  • Shell 38.1%