cuckoo1.2 virtualbox and cuckoo error

[alialk]

i start getting this error after launching the cuckoo 1.2 i search around for it and most of the solutions
were about checking the configuration files and privilege issues
i checked the config files but i couldnt find any mistakes and for privilege issues i couldnt know what to do to the privilege since am new to this system

this is the error
[lib.cuckoo.core.scheduler] INFO: Using "virtualbox" machine manager
[root] CRITICAL: CuckooCriticalError: Please update your configuration. Unable to shut 'xp' down or find the machine in its proper state: Timeout hit while for machine xp to change status

my host ubuntu 14.4
ip = 192.168.56.1

my guest windows xp service pack 3 (on virtualbox)
ip = 192.168.56.101
gateway = 192.168.56.1

here are the config files

cuckoo.conf

[cuckoo]

Enable or disable startup version check. When enabled, Cuckoo will connect

to a remote location to verify whether the running version is the latest

one available.

version_check = off

If turned on, Cuckoo will delete the original file after its analysis

has been completed.

delete_original = off

If turned on, Cuckoo will delete the copy of the original file in the

local binaries repository after the analysis has finished. (On *nix this

will also invalidate the file called "binary" in each analysis directory,

as this is a symlink.)

delete_bin_copy = off

Specify the name of the machinery module to use, this module will

define the interaction between Cuckoo and your virtualization software

of choice.

machinery = virtualbox

Enable creation of memory dump of the analysis machine before shutting

down. Even if turned off, this functionality can also be enabled at

submission. Currently available for: VirtualBox and libvirt modules (KVM).

memory_dump = off

When the timeout of an analysis is hit, the VM is just killed by default.

For some long-running setups it might be interesting to terminate the

moinitored processes before killing the VM so that connections are closed.

terminate_processes = off

Enable automatically re-schedule of "broken" tasks each startup.

Each task found in status "processing" is re-queued for analysis.

reschedule = off

Enable processing of results within the main cuckoo process.

This is the default behavior but can be switched off for setups that

require high stability and process the results in a separate task.

process_results = on

Limit the amount of analysis jobs a Cuckoo process goes through.

This can be used together with a watchdog to mitigate risk of memory leaks.

max_analysis_count = 0

Limit the number of concurrently executing analysis machines.

This may be useful on systems with limited resources.

Set to 0 to disable any limits.

max_machines_count = 0

Minimum amount of free space (in MB) available before starting a new task.

This tries to avoid failing an analysis because the reports can't be written

due out-of-diskspace errors. Setting this value to 0 disables the check.

(Note: this feature is currently not supported under Windows.)

freespace = 64

Temporary directory containing the files uploaded through Cuckoo int$

(web.py, api.py, Django web interface).

tmppath = /tmp

[resultserver]

The Result Server is used to receive in real time the behavioral logs

produced by the analyzer.

Specify the IP address of the host. The analysis machines should be $

to contact the host through such address, so make sure it's valid.

NOTE: if you set resultserver IP to 0.0.0.0 you have to set the opti$

resultserver_ip for all your virtual machines in machinery configu$

ip = 192.168.56.1

Specify a port number to bind the result server on.

port = 2042

Should the server write the legacy CSV format?

(if you have any custom processing on those, switch this on)

store_csvs = off

Maximum size of uploaded files from VM (screenshots, dropped files, $

The value is expressed in bytes, by default 10Mb.

upload_max_size = 10485760

[processing]

Set the maximum size of analyses generated files to process. This is$

to avoid the processing of big files which may take a lot of process$

time. The value is expressed in bytes, by default 100Mb.

analysis_size_limit = 104857600

Enable or disable DNS lookups.

resolve_dns = on

Enable PCAP sorting, needed for the connection content view in the w$

sort_pcap = on

[database]

Specify the database connection string.

Examples, see documentation for more:

sqlite:///foo.db

postgresql://foo:bar@localhost:5432/mydatabase

mysql://foo:bar@localhost/mydatabase

If empty, default is a SQLite in db/cuckoo.db.

connection =

Database connection timeout in seconds.

If empty, default is set to 60 seconds.

timeout =
[timeouts]

Set the default analysis timeout expressed in seconds. This value wi$

used to define after how many seconds the analysis will terminate un$

otherwise specified at submission.

default = 120

Set the critical timeout expressed in seconds. After this timeout is$

Cuckoo will consider the analysis failed and it will shutdown the ma$

no matter what. When this happens the analysis results will most lik$

be lost. Make sure to have a critical timeout greater than the

default timeout.

critical = 600

Maximum time to wait for virtual machine status change. For example $

shutting down a vm. Default is 300 seconds.

vm_state = 300

virtualbox.conf

[virtualbox]

Specify which VirtualBox mode you want to run your machines on.

Can be "gui", "sdl" or "headless". Refer to VirtualBox's official

documentation to understand the differences.

mode = gui

Path to the local installation of the VBoxManage utility.

path = /usr/bin/VBoxManage

Specify a comma-separated list of available machines to be used. For$

specified ID you have to define a dedicated section containing the d$

on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)

machines = xp

[xp]

Specify the label name of the current machine as specified in your

VirtualBox configuration.

label = xp

Specify the operating system platform used by current machine

[windows/darwin/linux].

platform = windows

Specify the IP address of the current virtual machine. Make sure tha$

IP address is valid and that the host machine is able to reach it. I$

the analysis will fail.

ip = 192.168.56.101

(Optional) Specify the snapshot name to use. If you do not specify a$

name, the VirtualBox MachineManager will use the current snapshot.

Example (Snapshot1 is the snapshot name):

snapshot = Snapshot 1

(Optional) Specify the name of the network interface that should be $

when dumping network traffic from this machine with tcpdump. If spec$

overrides the default interface specified in cuckoo.conf

Example (vboxnet0 is the interface name):

interface = vboxnet0

(Optional) Specify the IP of the Result Server, as your virtual mach$

The Result Server will always bind to the address and port specified$

however you could set up your virtual network to use NAT/PAT, so you$

the IP address for the Result Server as your machine sees it. If you$

address here, the machine will use the default value from cuckoo.con$

NOTE: if you set this option you have to set result server IP to 0.0$

Example:

resultserver_ip = 192.168.56.1

(Optional) Specify the port for the Result Server, as your virtual m$

The Result Server will always bind to the address and port specified$

however you could set up your virtual network to use NAT/PAT, so you$

the port for the Result Server as your machine sees it. If you don't$

here, the machine will use the default value from cuckoo.conf.

Example:

resultserver_port = 2042

(Optional) Set your own tags. These are comma separated and help to $

specific VMs. You can run samples on VMs with tag you require.

tags = windows_xp_sp3,32_bit,acrobat_reader_6

---

thank you for the help

[jbremer]

A wild guess would be it's either a network issue or your VM is broken or: could you change mode = gui to mode = headless.
We have changed it to the latter by default for the upcoming version of Cuckoo as you wouldn't be the first guy with this issue ;)

[ChinnuCSE]

Run virtualbox and cuckoo.py all as root user
$sudo virtualbox
$sudo python cuckoo.py

[tongsens]

I meet the seem mistake "Timeout hit while for machine xp to change status".
the reason is cuckoo change the VM state fail.
So i delete the snapshot,than recreate the snapshot, than problem is slove.

[mishamehra]

hi, i am also facing the same error... i have re-installed the virtualbox i have also recreated the snapshot.. and my host and guest machines with ip 192.168.56.1 and 192.168.58.101 respectively are also pinging each other, but i am still getting the following error
Checking for updates...
Failed! Unable to establish connection.

2016-11-09 11:54:55,712 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
2016-11-09 11:56:10,221 [root] CRITICAL: CuckooCriticalError: Please update your configuration. Unable to shut 'windowsxp' down or find the machine in its proper state: Timeout hit while for machine windowsxp to change status
what is wrong.. i am unable to troubleshoot... kindly help!!

[doomedraven]

i have only one question, why do you use cuckoo 1.2? if there also 1.3, v2 rc1, v2dev?

[mishamehra]

i am using Cuckoo Sandbox 2.0-dev
this is wat is dispalyed when i run cuckoo.py
Cuckoo Sandbox 2.0-dev
www.cuckoosandbox.org

[mishamehra]

this is my cuckoo.conf file pls see if there is any issue with the configuration

[cuckoo]

Enable or disable startup version check. When enabled, Cuckoo will connect

to a remote location to verify whether the running version is the latest

one available.

version_check = on

If turned on, Cuckoo will delete the original file after its analysis

has been completed.

delete_original = off

If turned on, Cuckoo will delete the copy of the original file in the

local binaries repository after the analysis has finished. (On *nix this

will also invalidate the file called "binary" in each analysis directory,

as this is a symlink.)

delete_bin_copy = off

Specify the name of the machinery module to use, this module will

define the interaction between Cuckoo and your virtualization software

of choice.

machinery = virtualbox

Enable creation of memory dump of the analysis machine before shutting

down. Even if turned off, this functionality can also be enabled at

submission. Currently available for: VirtualBox and libvirt modules (KVM).

memory_dump = off

When the timeout of an analysis is hit, the VM is just killed by default.

For some long-running setups it might be interesting to terminate the

monitored processes before killing the VM so that connections are closed.

terminate_processes = off

Enable automatically re-schedule of "broken" tasks each startup.

Each task found in status "processing" is re-queued for analysis.

reschedule = off

Enable processing of results within the main cuckoo process.

This is the default behavior but can be switched off for setups that

require high stability and process the results in a separate task.

process_results = on

Limit the amount of analysis jobs a Cuckoo process goes through.

This can be used together with a watchdog to mitigate risk of memory leaks.

max_analysis_count = 0

Limit the number of concurrently executing analysis machines.

This may be useful on systems with limited resources.

Set to 0 to disable any limits.

max_machines_count = 0

Limit the amount of VMs that are allowed to start in parallel. Generally

speaking starting the VMs is one of the more CPU intensive parts of the

actual analysis. This option tries to avoid maxing out the CPU completely.

max_vmstartup_count = 10

Minimum amount of free space (in MB) available before starting a new task.

This tries to avoid failing an analysis because the reports can't be written

due out-of-diskspace errors. Setting this value to 0 disables the check.

(Note: this feature is currently not supported under Windows.)

freespace = 64

Temporary directory containing the files uploaded through Cuckoo interfaces

(api.py and Django web interface).

tmppath = /tmp

Path to the unix socket for running root commands.

rooter = /tmp/cuckoo-rooter

[routing]

Default network routing mode; "none", "internet", or "vpn_name".

In none mode we don't do any special routing - the VM doesn't have any

network access (this has been the default actually for quite a while).

In internet mode by default all the VMs will be routed through the network

interface configured below (the "dirty line").

And in VPN mode by default the VMs will be routed through the VPN identified

by the given name of the VPN (as per vpn.conf).

Note that just like enabling VPN configuration setting this option to

anything other than "none" requires one to run utils/rooter.py as root next

to the Cuckoo instance (as it's required for setting up the routing).

route = none

Network interface that allows a VM to connect to the entire internet, the

"dirty line" so to say. Note that, just like with the VPNs, this will allow

malicious traffic through your network. So think twice before enabling it.

(For example, to route all VMs through eth0 by default: "internet = eth0").

internet = none

Routing table name/id for "dirty line" interface. If "dirty line" is

also default gateway in the system you can leave "main" value. Otherwise add

new routing table by adding " " line to /etc/iproute2/rt_tables

(e.g., "200 eth0"). ID and name must be unique across the system (refer to

/etc/iproute2/rt_tables for existing names and IDs).

rt_table = main

To route traffic through multiple network interfaces Cuckoo uses

Policy Routing with separate routing table for each output interface

(VPN or "dirty line"). If this option is enabled Cuckoo on start will try

to automatically initialise routing tables by copying routing entries from

main routing table to the new routing tables. Depending on your network/vpn

configuration this might not be sufficient. In such case you would need to

initialise routing tables manually. Note that enabling this option won't

affect main routing table.

auto_rt = yes

[resultserver]

The Result Server is used to receive in real time the behavioral logs

produced by the analyzer.

Specify the IP address of the host. The analysis machines should be able

to contact the host through such address, so make sure it's valid.

NOTE: if you set resultserver IP to 0.0.0.0 you have to set the option

resultserver_ip for all your virtual machines in machinery configuration.

ip = 192.168.56.1

Specify a port number to bind the result server on.

port = 2042

Force the port chosen above, don't try another one (we can select another

port dynamically if we can not bind this one, but that is not an option

in some setups)

force_port = no

Maximum size of uploaded files from VM (screenshots, dropped files, log)

The value is expressed in bytes, by default 10Mb.

upload_max_size = 10485760

[processing]

Set the maximum size of analyses generated files to process. This is used

to avoid the processing of big files which may take a lot of processing

time. The value is expressed in bytes, by default 100Mb.

analysis_size_limit = 104857600

Enable or disable DNS lookups.

resolve_dns = on

Enable PCAP sorting, needed for the connection content view in the web interface.

sort_pcap = on

[database]

Specify the database connection string.

NOTE: If you are using a custom database (different from sqlite), you have to

use utf-8 encoding when issuing the SQL database creation statement.

Examples, see documentation for more:

sqlite:///foo.db

postgresql://foo:bar@localhost:5432/mydatabase

mysql://foo:bar@localhost/mydatabase

If empty, default is a SQLite in db/cuckoo.db.

connection =

Database connection timeout in seconds.

If empty, default is set to 60 seconds.

timeout =

[timeouts]

Set the default analysis timeout expressed in seconds. This value will be

used to define after how many seconds the analysis will terminate unless

otherwise specified at submission.

default = 120

Set the critical timeout expressed in (relative!) seconds. It will be added

to the default timeout above and after this timeout is hit

Cuckoo will consider the analysis failed and it will shutdown the machine

no matter what. When this happens the analysis results will most likely

be lost.

critical = 60

Maximum time to wait for virtual machine status change. For example when

shutting down a vm. Default is 60 seconds.

vm_state = 60

[tehfcae]

I am getting the same error. I checked to make sure the snapshot, OS, label, machine, mode, and vboxmanage path are all correct as well ensured that cuckoo user is the vboxusers group.

Anything else that I should check?

[doomedraven]

first of all why still using 1.2? if 1.3 and 2.0 rc2 exists?

[mishamehra]

hi,
i want to understand the internal working of cuckoo sandbox. As i am not
well versed with python, hence understanding the code is little difficult
for me.. I have gone through your paper at :
https://media.blackhat.com/us-13/US-13-Bremer-Mo-Malware-Mo-Problems-Cuckoo-Sandbox-WP.pdf

here, it states that cuckoo does API hooking and monitor the API calls from
the running process. It then generated logs of that and based on available
signatures, it generated a report. Can i have some more detailed document
on its working??

Thanks :)

On 9 March 2017 at 12:24, doomedraven [e-mail] wrote:

first of all why still using 1.2? if 1.3 and 2.0 rc2 exists?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-285270738,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopMVjcP20yvYlhKPR9M-yY0ajhGRtks5rj6IsgaJpZM4FsJ0D
.

[doomedraven]

https://cuckoo.sh/docs/index.html from package branch

[mishamehra]

this all is it installation , configuration and usage... i want to
understand the theory behind its working... dont u guys have written or
presented some paper on it

On 9 March 2017 at 17:34, doomedraven [e-mail] wrote:

https://cuckoo.sh/docs/index.html from package branch

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-285333982,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopM0N3eZc0cOGxCJVEbIl2Ul6IE-Jks5rj-rTgaJpZM4FsJ0D
.

[tehfcae]

I should have been more clear. I am running 2.0 on an ubuntu 16.04 LTS host with a windows 10 sandbox.

[mishamehra]

hi,

i have one doubt.. after doing analysis of the infected file on a specified
VM, cuckoo logs the actions performed by the processes to the main sandbox.
After the analysis is finished, the gathered logs - like monitored
processes, behaviour logs are given to known signatures modules for any
malicious behaviour..

My question is whether everytime the output is checked against known
signatures.. And What if the signature for that processes is not available
or defined? Would the result of analysis will be wrong for a malicious file
whose signatures are not present??

On 9 March 2017 at 17:37, misha mehra [e-mail] wrote:

this all is it installation , configuration and usage... i want to
understand the theory behind its working... dont u guys have written or
presented some paper on it

On 9 March 2017 at 17:34, doomedraven [e-mail] wrote:

https://cuckoo.sh/docs/index.html from package branch

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-285333982,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopM0N3eZc0cOGxCJVEbIl2Ul6IE-Jks5rj-rTgaJpZM4FsJ0D
.

[doomedraven]

Why wrong? data which doesnt exist are not wrong, the analysis will be the same just with less signatures, nothing else

[mishamehra]

i want to understand how cuckoo analyse malware through cuckoomon.dll...
can u share some document on its internal working plss??

On 16 March 2017 at 10:12, doomedraven [e-mail] wrote:

Why wrong? data which doesnt exist are not wrong, the analysis will be the
same just with less signatures, nothing else

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-286956485,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopBIykLrmEA8JJ31CXmSiPsxVmOHlks5rmL3OgaJpZM4FsJ0D
.

[mishamehra]

hi,
is there support for encrypted/ encoded and zipped files analysis on cuckoo
sandbox?

On 28 March 2017 at 23:23, misha mehra [e-mail] wrote:

i want to understand how cuckoo analyse malware through cuckoomon.dll...
can u share some document on its internal working plss??

On 16 March 2017 at 10:12, doomedraven [e-mail] wrote:

Why wrong? data which doesnt exist are not wrong, the analysis will be
the same just with less signatures, nothing else

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-286956485,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopBIykLrmEA8JJ31CXmSiPsxVmOHlks5rmL3OgaJpZM4FsJ0D
.

[jbremer]

We have support for zip files and basic passwords may be used as well (e.g., password or infected).

[mishamehra]

i m using cuckoo rc-2 and also trying to run pdf file. i have installed
adobe reader version 5 on windows xp virtual machine and i m getting the
following error :

2017-05-16 12:07:45,598 [lib.cuckoo.core.scheduler] INFO: Starting analysis
of FILE "East China Sea 2010-1.pdf" (task #44, options
"route=none,procmemdump=yes")
2017-05-16 12:07:45,943 [lib.cuckoo.core.scheduler] INFO: Task #44:
acquired machine windowsxp (label=windowsxp)
2017-05-16 12:07:46,059 [modules.auxiliary.sniffer] INFO: Started sniffer
with PID 9765 (interface=vboxnet0, host=192.168.56.10,
pcap=/home/misha/cuckoodir/cuckoo-rc2/cuckoo/storage/analyses/44/dump.pcap)
2017-05-16 12:07:55,038 [lib.cuckoo.core.guest] INFO: Starting analysis on
guest (id=windowsxp, ip=192.168.56.10)
2017-05-16 12:08:06,515 [lib.cuckoo.core.scheduler] ERROR: Error from the
Cuckoo Guest: Analysis failed: The package "modules.packages.pdf" start
function raised an error: Unable to find any Adobe Reader executable.
Traceback (most recent call last):
File "C:wpmypanalyzer.py", line 778, in
success = analyzer.run()
File "C:wpmypanalyzer.py", line 626, in run
(package_name, e)
CuckooError: The package "modules.packages.pdf" start function raised an
error: Unable to find any Adobe Reader executable.

2017-05-16 12:08:06,822 [lib.cuckoo.core.plugins] WARNING: Unable to stop
auxiliary module: Error running tcpdump to sniff the network traffic during
the analysis; stdout = '' and stderr = "tcpdump: vboxnet0: You don't have
permission to capture on that devicen(socket: Operation not permitted)n".
Did you enable the extra capabilities to allow running tcpdump as non-root
user and disable AppArmor properly (only applies to Ubuntu)?
2017-05-16 12:08:12,376 [modules.processing.network] WARNING: The PCAP file
does not exist at path
"/home/misha/cuckoodir/cuckoo-rc2/cuckoo/storage/analyses/44/dump.pcap".
2017-05-16 12:08:15,721 [lib.cuckoo.core.scheduler] INFO: Task #44: reports
generation completed
(path=/home/misha/cuckoodir/cuckoo-rc2/cuckoo/storage/analyses/44)
2017-05-16 12:08:15,897 [lib.cuckoo.core.scheduler] INFO: Task #44:
analysis procedure completed

On 12 April 2017 at 16:52, Jurriaan Bremer [e-mail] wrote:

We have support for zip files and basic passwords may be used as well
(e.g., password or infected).

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/616#issuecomment-293547919,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJaopL9JZNbg3APLX--U3c9DS8tuirhYks5rvLQTgaJpZM4FsJ0D
.

[Greiner10767]

If you don't run Vitualbox as sudo, it will look in the wrong location for the VM. Launch Virtual box as sudo and create VM. IF you already created the VM, Launch as sudo and create the VM from the existing.