diff --git a/SKILLS.md b/SKILLS.md index 917316c680a..523a68de4ce 100644 --- a/SKILLS.md +++ b/SKILLS.md @@ -68,7 +68,7 @@ CAPE (Config And Payload Extraction) is a malware analysis sandbox derived from ### Coding Standards (PEP 8+) * **Imports:** Explicit imports only (`from lib import a, b`). No `from lib import *`. Group standard library, 3rd party, and local imports. -* **Strings:** Use double quotes (`"`) for strings. (This line was corrected from the original prompt to reflect the actual change needed for the example.) +* **Strings:** Use double quotes (`"`) for strings. * **Logging:** Use `import logging; log = logging.getLogger(__name__)`. Do not use `print()`. * **Exceptions:** Use custom exceptions from `lib/cuckoo/common/exceptions.py` (e.g., `CuckooOperationalError`). diff --git a/conf/default/auxiliary.conf.default b/conf/default/auxiliary.conf.default index 21018cdb1db..306cb2b226e 100644 --- a/conf/default/auxiliary.conf.default +++ b/conf/default/auxiliary.conf.default @@ -10,6 +10,9 @@ windows_static_route_gateway = 192.168.1.1 evtx = no human_windows = yes human_linux = no +# If enabling procmon: +# You must download Procmon.exe from https://learn.microsoft.com/en-us/sysinternals/downloads/procmon +# And place it to: analyzer/windows/bin/Procmon.exe procmon = no recentfiles = no screenshots_windows = yes diff --git a/conf/default/cuckoo.conf.default b/conf/default/cuckoo.conf.default index 539dacf009c..9eea7a3e188 100644 --- a/conf/default/cuckoo.conf.default +++ b/conf/default/cuckoo.conf.default @@ -246,6 +246,8 @@ analysis = 0 mongo = no # Clean orphan files in mongodb unused_files_in_mongodb = no +# Deduplicated files +files = no [central_mode] # Central control-plane mode (off = current single-node behavior; analyses stay on the local diff --git a/installer/cape2.sh b/installer/cape2.sh index 11d3f2cea30..7cbde057b98 100755 --- a/installer/cape2.sh +++ b/installer/cape2.sh @@ -561,17 +561,17 @@ server { } # SSL configuration listen 443 ssl http2; - //listen [::]:443 ssl http2; - //listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3 - ssl on; - //ssl_protocols TLSv1.3; # QUIC requires TLS 1.3 + #listen [::]:443 ssl http2; + listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3 + #ssl on; # Obsolete in Nginx > 1.25.1 + ssl_protocols TLSv1.2 TLSv1.3; # QUIC requires TLS 1.3 ssl_certificate /etc/letsencrypt/live/$1/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/$1/privkey.pem; ssl_client_certificate /etc/ssl/certs/cloudflare.crt; ssl_verify_client on; - //add_header Alt-Svc 'quic=":443"'; # Advertise that QUIC is available - //add_header QUIC-Status $quic; # Sent when QUIC was used + add_header Alt-Svc 'h3=":443"; ma=86400'; # Advertise that QUIC is available + add_header QUIC-Status $quic; # Sent when QUIC was used server_name $1 www.$1; location / { diff --git a/web/analysis/views.py b/web/analysis/views.py index 18ba39da562..a0b29ac94c4 100644 --- a/web/analysis/views.py +++ b/web/analysis/views.py @@ -45,7 +45,7 @@ from lib.cuckoo.common.config import Config from lib.cuckoo.common.constants import ANALYSIS_BASE_PATH, CUCKOO_ROOT from lib.cuckoo.common.path_utils import path_exists, path_get_size, path_mkdir, path_read_file, path_safe -from lib.cuckoo.common.utils import delete_folder, yara_detected +from lib.cuckoo.common.utils import delete_folder, get_files_storage_path, yara_detected from lib.cuckoo.common.web_utils import category_all_files, my_rate_minutes, my_rate_seconds, perform_search, rateblock, statistics from lib.cuckoo.core.database import Database, TasksMixIn from lib.cuckoo.core.data.task import TASK_PENDING, Task @@ -3582,6 +3582,10 @@ def file(request, category, task_id, dlfile): # Self Extracted support folder if not path_exists(path): path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name) + + if not path_exists(path) and len(file_name) == 64: + path = get_files_storage_path(file_name) + elif category in ("droppedzipall", "procdumpzipall", "CAPEzipall"): if web_cfg.zipped_download.download_all: sub_cat = category.replace("zipall", "") @@ -3601,6 +3605,10 @@ def file(request, category, task_id, dlfile): path = buf if not path_exists(path): path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name) + + if not path_exists(path) and len(file_name) == 64: + path = get_files_storage_path(file_name) + elif category == "networkzip": buf = os.path.join(CUCKOO_ROOT, "storage", "analyses", task_id, "network", file_name) path = buf diff --git a/web/static/css/style.css b/web/static/css/style.css index aadb771bd2f..fc8b123ecdb 100644 --- a/web/static/css/style.css +++ b/web/static/css/style.css @@ -563,8 +563,8 @@ pre { .table tbody tr.system > th, .table tbody tr.windows > td, .table tbody tr.windows > th { - background-color: inherit; /* inherit the TR background-color */ - color: inherit; /* inherit the TR text color */ + background-color: inherit; /* inherit the TR background-color */ + color: inherit; /* inherit the TR text color */ } /* Hover/focus states */ diff --git a/web/static/js/hexdump.js b/web/static/js/hexdump.js deleted file mode 100644 index 6d2ac9f077b..00000000000 --- a/web/static/js/hexdump.js +++ /dev/null @@ -1,239 +0,0 @@ - -/* - * hexy js - https://github.com/a2800276/hexy.js - * modified for cuckoo/web -*/ - -var hexy = function (buffer, config) { - var h = new Hexy(buffer, config) - return h.toString() -} - -var Hexy = function (buffer, config) { - var self = this - - config = config || {} - - self.buffer = buffer // magic string conversion here? - self.width = config.width || 16 - self.numbering = config.numbering == "none" ? "none" : "hex_bytes" - - switch (config.format) { - case "none": - case "twos": - self.format = config.format - break - default: - self.format = "fours" - } - - self.caps = config.caps == "upper" ? "upper" : "lower" - self.annotate = config.annotate == "none" ? "none" : "ascii" - self.prefix = config.prefix || "" - self.indent = config.indent || 0 - self.html = config.html || false - self.offset = config.offset || 0 - self.length = config.length || -1 - - self.display_offset = config.display_offset || 0 - - if (self.offset) { - if (self.offset < self.buffer.length) { - self.buffer = self.buffer.slice(self.offset) - } - } - - if (self.length !== -1) { - if (self.length <= self.buffer.length) { - self.buffer = self.buffer.slice(0,self.length) - } - } - - for (var i = 0; i!=self.indent; ++i) { - self.prefix = " "+self.prefix - } - - var pos = 0 - - this.toString = function () { - var str = "" - - if (self.html) { str += "
\n"} - //split up into line of max `self.width` - var line_arr = lines() - - //lines().forEach(function(hex_raw, i) - for (var i = 0; i!= line_arr.length; ++i) { - var hex_raw = line_arr[i], - hex = hex_raw[0], - raw = hex_raw[1] - //insert spaces every `self.format.twos` or fours - var howMany = hex.length - if (self.format === "fours") { - howMany = 4 - } else if (self.format === "twos") { - howMany = 2 - } - - var hex_formatted = "" - - - for (var j =0; j< hex.length; j+=howMany) { - var s = hex.substr(j, howMany) - hex_formatted += s + " " - } - - var addr = (i*self.width)+self.offset+self.display_offset; - if (self.html) { - odd = i%2 == 0 ? " even" : " odd" - str += "
" - } - str += self.prefix - - if (self.numbering === "hex_bytes") { - str += pad(addr, 8) // padding... - str += ": " - } - - var padlen = 0 - switch(self.format) { - case "fours": - padlen = self.width*2 + self.width/2 - break - case "twos": - padlen = self.width*3 + 2 - break - default: - padlen = self.width * 2 + 1 - } - - str += rpad(hex_formatted, padlen) - if (self.annotate === "ascii") { - str+=" " - var ascii = raw.replace(/[\000-\040\177-\377]/g, ".") - str += escape(ascii) - } - if (self.html) { - str += "
\n" - } else { - str += "\n" - } - } - if (self.html) { str += "
\n"} - return str - } - - var lines = function() { - var hex_raw = [] - for (var i = 0; i= self.buffer.length ? self.buffer.length : i+self.width, - slice = self.buffer.slice(begin, end), - hex = self.caps === "upper" ? hexu(slice) : hexl(slice), - raw = slice.toString('ascii') - - hex_raw.push([hex,raw]) - } - return hex_raw - - } - - var hexl = function (buffer) { - var str = "" - for (var i=0; i!=buffer.length; ++i) { - if (buffer.constructor == String) { - str += pad(buffer.charCodeAt(i), 2) - } else { - str += pad(buffer[i], 2) - } - } - return str - } - var hexu = function (buffer) { - return hexl(buffer).toUpperCase() - } - - var pad = function(b, len) { - var s = b.toString(16) - - while (s.length < len) { - s = "0" + s - } - return s - } - var rpad = function(s, len) { - for (var n = len - s.length; n!=0; --n) { - if (self.html) { - s += " " - } else { - s += " " - } - - } - return s - } - - var escape = function (str) { - str = str.split("&").join("&") - str = str.split("<").join("<") - str = str.split(">").join(">") - return str - } - - -} - -/** - * the following code is hacked up from the jquery base64 codec plugin - * removed 80% of its guts though... - * jQuery Plugin - base64 codec - * @lisence MIT License https://github.com/yatt/jquery.base64/blob/master/license.txt - * @author yatt/brainfs http://d.hatena.ne.jp/yatt http://twitter.com/brainfs - * @version 0.0.1 - * @info - */ - -var base64 = new function() -// -{ - var utfLibName = "utf"; - var b64char = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; - var b64encTable = b64char.split(""); - var b64decTable = []; - for (var i=0; i>> 16; - dat[j+1] = (tmp >>> 8) & 0xff; - dat[j+2] = tmp & 0xff; - } - // 補完された 0x0 分削る - if (md) dat.length -= [0,0,2,1][md]; - - return dat; - } - -} diff --git a/web/templates/analysis/generic/_file_info.html b/web/templates/analysis/generic/_file_info.html index fdff27ff6d0..5dc25d1e7d9 100644 --- a/web/templates/analysis/generic/_file_info.html +++ b/web/templates/analysis/generic/_file_info.html @@ -407,7 +407,7 @@
File
Strings
-
{% for string in file.strings %}{{string}}
{% endfor %}
+
{% for string in file.strings %}{{string}}
{% endfor %}
@@ -418,7 +418,7 @@
File
.NET Strings
-
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
+
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
@@ -429,7 +429,7 @@
File
Extracted Text
-
{{file.data|escape}}
+
{{file.data|escape}}
@@ -440,7 +440,7 @@
File
Decoded File Content
-
{{file.decoded_files|escape}}
+
{{file.decoded_files|escape}}
diff --git a/web/templates/analysis/generic/_floss.html b/web/templates/analysis/generic/_floss.html index da479839592..074d8f13771 100644 --- a/web/templates/analysis/generic/_floss.html +++ b/web/templates/analysis/generic/_floss.html @@ -10,7 +10,7 @@
FL
Decoded Strings
-
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
@@ -21,7 +21,7 @@
Decoded Strings
Stack Strings
-
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
@@ -32,7 +32,7 @@
Stack Strings
Tight Strings
-
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
@@ -43,7 +43,7 @@
Tight Strings
Static Strings
-
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
diff --git a/web/templates/analysis/generic/_java.html b/web/templates/analysis/generic/_java.html index a5dd91f3f8e..e23a7d8c355 100644 --- a/web/templates/analysis/generic/_java.html +++ b/web/templates/analysis/generic/_java.html @@ -7,7 +7,7 @@
Java D {% if file.java and file.java.decompiled %}
-
{{file.java.decompiled}}
+
{{file.java.decompiled}}
{% else %} diff --git a/web/templates/analysis/generic/_office.html b/web/templates/analysis/generic/_office.html index e914afbe30d..0b99b388d0d 100644 --- a/web/templates/analysis/generic/_office.html +++ b/web/templates/analysis/generic/_office.html @@ -123,7 +123,7 @@

-
{{code}}
+
{{code}}
diff --git a/web/templates/analysis/generic/_pdf.html b/web/templates/analysis/generic/_pdf.html index cecf97dc2fa..52d7ab1fd84 100644 --- a/web/templates/analysis/generic/_pdf.html +++ b/web/templates/analysis/generic/_pdf.html @@ -132,7 +132,7 @@

Size: {{obj.Size}} bytes

Offset: {{obj.Offset}}

-
{{obj.Data|linebreaksbr}}
+
{{obj.Data|linebreaksbr}}
diff --git a/web/templates/analysis/generic/_xlmmacro.html b/web/templates/analysis/generic/_xlmmacro.html index 0127e2b4144..96914e013a5 100644 --- a/web/templates/analysis/generic/_xlmmacro.html +++ b/web/templates/analysis/generic/_xlmmacro.html @@ -6,7 +6,7 @@

-
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
+
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
diff --git a/web/templates/analysis/network/_cif.html b/web/templates/analysis/network/_cif.html index 00e8f6f18c5..878e7889caf 100644 --- a/web/templates/analysis/network/_cif.html +++ b/web/templates/analysis/network/_cif.html @@ -30,10 +30,6 @@
CIF {% endfor %} - {% else %} -
-
No CIF Results
-
{% endif %} diff --git a/web/templates/analysis/network/_dns.html b/web/templates/analysis/network/_dns.html index 0a6b0521b68..9ae02d903b5 100644 --- a/web/templates/analysis/network/_dns.html +++ b/web/templates/analysis/network/_dns.html @@ -82,7 +82,9 @@
DNS Reque {% else %}
-
No domains contacted.
+
+ No DNS requests recorded. +
{% endif %} diff --git a/web/templates/analysis/network/_hosts.html b/web/templates/analysis/network/_hosts.html index 4326aca1a53..9c82abbf46e 100644 --- a/web/templates/analysis/network/_hosts.html +++ b/web/templates/analysis/network/_hosts.html @@ -70,7 +70,9 @@
Hosts {% else %}
-
No hosts contacted.
+
+ No host connections recorded. +
{% endif %} diff --git a/web/templates/analysis/network/_http.html b/web/templates/analysis/network/_http.html index af715355e64..898662ca1fd 100644 --- a/web/templates/analysis/network/_http.html +++ b/web/templates/analysis/network/_http.html @@ -22,6 +22,8 @@
HTTP Re {% else %} Request: {% endif %} + Hexdump + {% for value in http.request|network_rn %}
  • {{value}}
  • {% endfor %} @@ -34,6 +36,8 @@
    HTTP Re {% else %} Response: {% endif %} + Hexdump + {% for value in http.response|network_rn %}
  • {{value}}
  • {% endfor %} @@ -73,23 +77,46 @@
    HTTP Re {% for request in network.http %} {{request.uri}} {% if request.source == "behavior" %}behavior{% endif %} -
    {{request.data}}
    - {% if settings.NETWORK_PROC_MAP %} - - {% if request.process_name %} - {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %} - {% else %} - - - {% endif %} - - {% endif %} + + Hexdump +
    {{request.data}}
    + {% if settings.NETWORK_PROC_MAP %} + + {% if request.process_name %} + {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} + {% endfor %} -{% else %} -
    -
    No HTTP(s) requests performed.
    -
    {% endif %} + + diff --git a/web/templates/analysis/network/_icmp.html b/web/templates/analysis/network/_icmp.html index 526cf7db7af..dd1b54a7c72 100644 --- a/web/templates/analysis/network/_icmp.html +++ b/web/templates/analysis/network/_icmp.html @@ -33,7 +33,9 @@
    ICMP Tra {% else %}
    -
    No ICMP traffic performed.
    +
    + No ICMP Traffic recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/_irc.html b/web/templates/analysis/network/_irc.html index e6d2961f209..3bb52b5a3bc 100644 --- a/web/templates/analysis/network/_irc.html +++ b/web/templates/analysis/network/_irc.html @@ -31,7 +31,9 @@
    IRC Tr {% else %}
    -
    No IRC requests performed.
    +
    + No IRC Traffic recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/_smtp.html b/web/templates/analysis/network/_smtp.html index a0971a15ee4..c391f430e93 100644 --- a/web/templates/analysis/network/_smtp.html +++ b/web/templates/analysis/network/_smtp.html @@ -83,7 +83,9 @@
    SMTP T {% else %}
    -
    No SMTP traffic performed.
    +
    + No SMTP Traffic recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_alerts.html b/web/templates/analysis/network/_suricata_alerts.html index d1cf77ab04c..30bd9be0e31 100644 --- a/web/templates/analysis/network/_suricata_alerts.html +++ b/web/templates/analysis/network/_suricata_alerts.html @@ -84,7 +84,9 @@
    -
    No Suricata Alerts
    +
    + No Suricata Alerts recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_files.html b/web/templates/analysis/network/_suricata_files.html index 425160afbdb..10845e40516 100644 --- a/web/templates/analysis/network/_suricata_files.html +++ b/web/templates/analysis/network/_suricata_files.html @@ -135,5 +135,8 @@ {% endfor %} {% else %} -
    Sorry! No Suricata Extracted files.
    +
    + +

    No Suricata extracted files found.

    +
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_http.html b/web/templates/analysis/network/_suricata_http.html index a90a4d91f1e..7b352c9f31f 100644 --- a/web/templates/analysis/network/_suricata_http.html +++ b/web/templates/analysis/network/_suricata_http.html @@ -97,7 +97,9 @@
    Suricata {% else %}
    -
    No Suricata HTTP
    +
    + No Suricata HTTP requests recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_tls.html b/web/templates/analysis/network/_suricata_tls.html index dbd0d2bf1f9..7ef1bd74981 100644 --- a/web/templates/analysis/network/_suricata_tls.html +++ b/web/templates/analysis/network/_suricata_tls.html @@ -73,7 +73,9 @@
    Suricata T {% else %}
    -
    No Suricata TLS
    +
    + No Suricata TLS records found. +
    {% endif %} diff --git a/web/templates/analysis/network/_tcp.html b/web/templates/analysis/network/_tcp.html index 54f03cf8832..356270bcc9a 100644 --- a/web/templates/analysis/network/_tcp.html +++ b/web/templates/analysis/network/_tcp.html @@ -1,14 +1,9 @@ -
    -
    -
    -
    TCP Connections
    -
    {% if network.tcp %} -
    +

    TCP

    - +
    @@ -41,13 +36,7 @@
    T
    - - {% else %} -
    -
    No TCP connections recorded.
    -
    {% endif %} -
    @@ -8,7 +7,7 @@
    U
    -
    Source Source Port
    +
    @@ -44,7 +43,9 @@
    U {% else %}
    -
    No UDP connections recorded.
    +
    + No UDP connections recorded. +
    {% endif %} diff --git a/web/templates/analysis/network/index.html b/web/templates/analysis/network/index.html index c8dd65abad5..f64b353534a 100644 --- a/web/templates/analysis/network/index.html +++ b/web/templates/analysis/network/index.html @@ -32,11 +32,7 @@ {% if network.tcp %} - + {% endif %} {% if network.udp %}
    Source Source Port