Cuckoo: moloch redirect not working

[MalPunch3r]

I'm running cuckoo 2.0.4 and the moloch redirect is giving me a 404.

The setup
moloch is running on a different server and the reporting.conf points to the appropriate IP. When logging into moloch, i can see data flowing in appropriately.

The issue
Go to the network activity section of the report and find a host in the list. Click the moloch link and it redirects you to: https://xxxx/analysis/moloch/8.8.8.8//////
This gives you a 404. i've tried manipulating the url to no avail. Nothing i've tried seems to point to the moloch view which looks like it's just a redirect to the actual moloch UI.

Maybe there's something wrong with the urlpatterns.

I see this similar issue but it seems to have started working in that earlier version.
https://github.com/cuckoosandbox/cuckoo/issues/1500

[andr6]

+1
Running Cuckoo 2.0.5. Moloch functional and installed on same machine.

Cuckoo URL showing for Moloch - http://192.168.1.222/analysis/moloch/204.79.197.200//////

Moloch URL - http://192.168.1.222:8005/sessions#general/

[Joukahainen123]

Having exactly the same problem with Cuckoo 2.0.5. Moloch functional and installed on the same machine. Moloch version is 0.5.

[andr6]

Cuckoo from branch . Moloch 0.5.

@jbremer

[hakawati]

I have same issue when using Nginx + uWSGI. But, if not using Nginx + uWSGI, no problem.

[Joukahainen123]

This seems to be related to Nginx + uWSGI as stated above. So if you follow these instructions
https://cuckoo.sh/docs/usage/web.html
Moloch integration gets broken.

[SparkyNZL]

If you are reverse proxying this you will have to do some magic. I run cuckoo and moloch fine. If you are using nginx as an auth front end and reverse proxying to cuckoo, I suggest you trouble shoot with Wireshark and and look at the http flow and create a suitable rproxy rule.

I use iis reverse proxying to my cuckoo / moloch server and this is how I solved my issues.

On Fri, Mar 2, 2018 at 9:15 PM +1300, "Joukahainen123" [e-mail] wrote:

This seems to be related to Nginx + uWSGI as stated above. So if you follow these instructions

https://cuckoo.sh/docs/usage/web.html

Moloch integration gets broken.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[najashark]

I have workaround for this, thanks to @SparkyNZL idea
just add this to your config

 rewrite ^/analysis/moloch/(.*)$ http://<YOURIP:PORT>/?date=-1&expression=ip+==+$1 permanent;

and it will look like this

upstream _uwsgi_cuckoo_web {
    server unix:/run/uwsgi/app/cuckoo-web/socket;
}

server {
    listen 0.0.0.0:8000;

    # Cuckoo Web Interface
    location / {
        client_max_body_size 1G;
        proxy_redirect off;
        proxy_set_header X-Forwarded-Proto $scheme;
        uwsgi_pass  _uwsgi_cuckoo_web;
        include     uwsgi_params;
        rewrite ^/analysis/moloch/(.*)$ http://<YOURIP:PORT>/?date=-1&expression=ip+==+$1 permanent;
    }
}

I hope this helps you guys

[av-gantimurov]

In previous comment solution works only for IP and it's a crutch.
Try setting off slashes merging in nginx.conf
It look like

server {
    listen localhost:80;
    merge_slashes off;
    location / {
        client_max_body_size 1G;
        proxy_redirect off;
        proxy_set_header X-Forwarded-Proto $scheme;
        uwsgi_pass  _uwsgi_cuckoo_web;
        include     uwsgi_params;

    }
}

Check that you chose moloch insecure in reporting.conf if hadn't configure https support for moloch

[moloch]
enabled = yes
insecure = yes

[Joukahainen123]

Thanks. Works with this workaround.

[av-gantimurov]

@MalPunch3r if that works may be you close issue?

[MalPunch3r]

i agree this is something rev proxy related - i haven't been able to fix it personally on my side yet, but it could be my setup. Given it works for @Joukahainen123, i'm good to close.

[libertasfox]

merge_slashes off;

This worked perfectly. Thanks, av-gantimurov.