Staging webgui

SKILLS.md

@@ -68,7 +68,7 @@ CAPE (Config And Payload Extraction) is a malware analysis sandbox derived from
 
 ### Coding Standards (PEP 8+)
 *   **Imports:** Explicit imports only (`from lib import a, b`). No `from lib import *`. Group standard library, 3rd party, and local imports.
-*   **Strings:** Use double quotes (`"`) for strings. (This line was corrected from the original prompt to reflect the actual change needed for the example.)
+*   **Strings:** Use double quotes (`"`) for strings.
 *   **Logging:** Use `import logging; log = logging.getLogger(__name__)`. Do not use `print()`.
 *   **Exceptions:** Use custom exceptions from `lib/cuckoo/common/exceptions.py` (e.g., `CuckooOperationalError`).
 

conf/default/auxiliary.conf.default

@@ -10,6 +10,9 @@ windows_static_route_gateway = 192.168.1.1
 evtx = no
 human_windows = yes
 human_linux = no
+# If enabling procmon:
+# You must download Procmon.exe from https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
+# And place it to: analyzer/windows/bin/Procmon.exe
 procmon = no
 recentfiles = no
 screenshots_windows = yes

conf/default/cuckoo.conf.default

@@ -246,6 +246,8 @@ analysis = 0
 mongo = no
 # Clean orphan files in mongodb
 unused_files_in_mongodb = no
+# Deduplicated files
+files = no
 
 [central_mode]
 # Central control-plane mode (off = current single-node behavior; analyses stay on the local

installer/cape2.sh

@@ -561,17 +561,17 @@ server {
     }
     # SSL configuration
     listen 443 ssl http2;
-    //listen [::]:443 ssl http2;
-    //listen 443 http3 reuseport;  # UDP listener for QUIC+HTTP/3
-    ssl        on;
-    //ssl_protocols       TLSv1.3; # QUIC requires TLS 1.3
+    #listen [::]:443 ssl http2;
+    listen 443 http3 reuseport;  # UDP listener for QUIC+HTTP/3
+    #ssl        on; # Obsolete in Nginx > 1.25.1
+    ssl_protocols       TLSv1.2 TLSv1.3; # QUIC requires TLS 1.3
     ssl_certificate         /etc/letsencrypt/live/$1/fullchain.pem;
     ssl_certificate_key     /etc/letsencrypt/live/$1/privkey.pem;
     ssl_client_certificate /etc/ssl/certs/cloudflare.crt;
     ssl_verify_client on;
 
-    //add_header Alt-Svc 'quic=":443"'; # Advertise that QUIC is available
-    //add_header QUIC-Status $quic;     # Sent when QUIC was used
+    add_header Alt-Svc 'h3=":443"; ma=86400'; # Advertise that QUIC is available
+    add_header QUIC-Status $quic;     # Sent when QUIC was used
 
     server_name $1 www.$1;
     location / {

web/analysis/views.py

@@ -45,7 +45,7 @@
 from lib.cuckoo.common.config import Config
 from lib.cuckoo.common.constants import ANALYSIS_BASE_PATH, CUCKOO_ROOT
 from lib.cuckoo.common.path_utils import path_exists, path_get_size, path_mkdir, path_read_file, path_safe
-from lib.cuckoo.common.utils import delete_folder, yara_detected
+from lib.cuckoo.common.utils import delete_folder, get_files_storage_path, yara_detected
 from lib.cuckoo.common.web_utils import category_all_files, my_rate_minutes, my_rate_seconds, perform_search, rateblock, statistics
 from lib.cuckoo.core.database import Database, TasksMixIn
 from lib.cuckoo.core.data.task import TASK_PENDING, Task
@@ -3582,6 +3582,10 @@ def file(request, category, task_id, dlfile):
         # Self Extracted support folder
         if not path_exists(path):
             path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name)
+
+        if not path_exists(path) and len(file_name) == 64:
+            path = get_files_storage_path(file_name)
+
     elif category in ("droppedzipall", "procdumpzipall", "CAPEzipall"):
         if web_cfg.zipped_download.download_all:
             sub_cat = category.replace("zipall", "")
@@ -3601,6 +3605,10 @@ def file(request, category, task_id, dlfile):
             path = buf
             if not path_exists(path):
                 path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name)
+
+            if not path_exists(path) and len(file_name) == 64:
+                path = get_files_storage_path(file_name)
+
     elif category == "networkzip":
         buf = os.path.join(CUCKOO_ROOT, "storage", "analyses", task_id, "network", file_name)
         path = buf

web/static/css/style.css

@@ -563,8 +563,8 @@ pre {
 .table tbody tr.system > th,
 .table tbody tr.windows > td,
 .table tbody tr.windows > th {
-    background-color: inherit; /* inherit the TR background-color */
-    color: inherit; /* inherit the TR text color */
+  background-color: inherit; /* inherit the TR background-color */
+  color: inherit;            /* inherit the TR text color */
 }
 
 /* Hover/focus states */

web/templates/analysis/generic/_file_info.html

@@ -407,7 +407,7 @@ <h5 class="mb-0 text-white"><i class="fas fa-file-alt me-2 text-info"></i> File
                 <div class="card bg-dark border-secondary text-white">
                     <div class="card-header"><h6 class="mb-0 text-white-50">Strings</h6></div>
                     <div class="card-body" style="max-height: 400px; overflow-y: auto;">
-                        <pre class="mb-0 text-light small">{% for string in file.strings %}{{string}}<br>{% endfor %}</pre>
+                        <pre class="mb-0 small">{% for string in file.strings %}{{string}}<br>{% endfor %}</pre>
                     </div>
                 </div>
             </div>
@@ -418,7 +418,7 @@ <h5 class="mb-0 text-white"><i class="fas fa-file-alt me-2 text-info"></i> File
                 <div class="card bg-dark text-white">
                     <div class="card-header"><h6 class="mb-0">.NET Strings</h6></div>
                     <div class="card-body" style="max-height: 400px; overflow-y: auto;">
-                        <pre class="mb-0 text-light small">{% for string in file.dotnet_strings %}{{string}}<br>{% endfor %}</pre>
+                        <pre class="mb-0 small">{% for string in file.dotnet_strings %}{{string}}<br>{% endfor %}</pre>
                     </div>
                 </div>
             </div>
@@ -429,7 +429,7 @@ <h5 class="mb-0 text-white"><i class="fas fa-file-alt me-2 text-info"></i> File
                 <div class="card bg-dark text-white">
                     <div class="card-header"><h6 class="mb-0">Extracted Text</h6></div>
                     <div class="card-body">
-                        <pre class="mb-0 text-light small">{{file.data|escape}}</pre>
+                        <pre class="mb-0 small">{{file.data|escape}}</pre>
                     </div>
                 </div>
             </div>
@@ -440,7 +440,7 @@ <h5 class="mb-0 text-white"><i class="fas fa-file-alt me-2 text-info"></i> File
                 <div class="card bg-dark text-white">
                     <div class="card-header"><h6 class="mb-0">Decoded File Content</h6></div>
                     <div class="card-body">
-                        <pre class="mb-0 text-light small">{{file.decoded_files|escape}}</pre>
+                        <pre class="mb-0 small">{{file.decoded_files|escape}}</pre>
                     </div>
                 </div>
             </div>