Cuckoo: Remote Control | Guacamole configuraton

[marcelmalware]

Thanks for creating an issue! But first: did you read our community guidelines?
https://cuckoo.sh/docs/introduction/community.html
Yes

My issue is:

Remote Control Configuration

My Cuckoo version and operating system are:

latest Cuckoo pulled from development branch. Ubuntu 16 Server.

This can be reproduced by:

The log, error, files etc can be found at:

Failed to connect to guacd on 10.0.0.27:4822 -> Guacamole Protocol Error. Cannot start Handshake. Missing protocol.

I have also installed standalone Guacamole but with no help.

[RicoVZ]

Hi @marcelmalware,

Thanks for posting an issue.

A few questions before we can help you:

• Where exactly does this error appear? In the web interface log?
• When exactly does this error occur/What are you doing when it occurs?
• Which machinery module are you using? (Virtualbox by default)
• Can you post your machinery config file from $CWD/conf/<yourmachinery>.conf?

[artv2007]

I have an issue with guacamole too.
When I run the job and click button - Remote control - I get the 404 error and "Remote control is not enabled in the configuration! Please check our documentation on configuring Guacamole."

I install guacamole by instruction (https://github.com/cuckoosandbox/cuckoo/blob/master/docs/book/installation/host/requirements.rst) from the source. (Ubuntu Server 16.04 LTS, guacamole - 0.9.14)

And configure the VM to Settings-Display-Remote Display-Enable Server
Port - 3389
Auth method - null
Auth timeout - 5000

guacd service started
netstat show - tcp 0 0 127.0.0.1:4822 0.0.0.0:* LISTEN 3758/guacd

How I need to enable Remote Control?

[RicoVZ]

Hi @artv2007,

That error means the feature itself is not enabled in the cuckoo.conf. To enabled it, open $CWD/conf/cuckoo.conf, find the [remotecontrol] section, and set enabled = no to enabled = yes. After this, restart Cuckoo web.

Thanks for the comment, we should probably make it more clear that this is also a required step. :smile:

[Antyrael]

I'm also having trouble getting this to work.

OS: Ubuntu 16.04.4 LTS
Guacamole 0.9.14 manually installed.
sudo dpkg -l | grep -i libgua returns nothing.
Cuckoo is installed using pip.
VBoxManage list extpacks output:

Extension Packs: 1
Pack no. 0: Oracle VM VirtualBox Extension Pack
Version: 5.0.26
Revision: 108824
Edition:
Description: USB 2.0 and USB 3.0 Host Controller, Host Webcam, VirtualBox RDP, PXE ROM, Disk Encryption.
VRDE Module: VBoxVRDP
Usable: true

I enabled the feature in cuckoo.conf and I set a port range in virtualbox.conf.
Guacamole is installed as per the instructions on the earlier by artv2007 mentioned website. It's running and listening to the default port.
The Windows VMs, when running headless, can remotely be connected to using the Windows remote desktop client.

Still, Cuckoo can't connect and shows "An error occured" (btw, there's an r missing in there ;)).

The Cuckoo logs show no problem, this is part of the log:

2018-06-12 14:38:20,052 [cuckoo.machinery.virtualbox] INFO: Successfully set remote control ports for virtual machine with label box1: 5001-5050
2018-06-12 14:38:20,145 [cuckoo.machinery.virtualbox] INFO: Successfully enabled remote control for virtual machine with label box1 on port(s): 5001-5050
2018-06-12 14:38:24,458 [cuckoo.core.guest] INFO: Starting analysis on guest (id=box1, ip=192.168.56.101)
2018-06-12 14:38:29,470 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=box1, ip=192.168.56.101)
2018-06-12 14:41:36,706 [cuckoo.core.guest] INFO: box1: analysis completed successfully
2018-06-12 14:41:45,183 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label box1 to path /home/mmmm/.cuckoo/storage/analyses/8/memory.dmp
2018-06-12 14:41:47,402 [cuckoo.machinery.virtualbox] INFO: Successfully disabled remote control for virtual machine with label box1

This is what syslog shows:

Jun 12 14:38:23 cuckoo guacd[25114]: Creating new client for protocol "rdp"
Jun 12 14:38:23 cuckoo guacd[25114]: Connection ID is "$ef5404f7-38a1-4f10-9682-d8d575005ce9"
Jun 12 14:38:23 cuckoo guacd[26522]: No security mode specified. Defaulting to RDP.
Jun 12 14:38:23 cuckoo guacd[26522]: Resize method: none
Jun 12 14:38:23 cuckoo guacd[26522]: User "@09a58360-5380-4a7c-b4e7-60a6b215cf51" joined connection "$ef5404f7-38a1-4f10-9682-d8d575005ce9" (1 u
sers now present)
Jun 12 14:38:23 cuckoo guacd[26522]: Loading keymap "base"
Jun 12 14:38:23 cuckoo guacd[26522]: Loading keymap "en-us-qwerty"
Jun 12 14:38:23 cuckoo guacd[26522]: Failed to load guacdr plugin. Drive redirection and printing will not work. Sound MAY not work.
Jun 12 14:38:23 cuckoo guacd[26522]: Failed to load guacsnd alongside guacdr plugin. Sound will not work. Drive redirection and printing MAY not
work.
Jun 12 14:38:38 cuckoo guacd[26522]: User is not responding.
Jun 12 14:38:38 cuckoo guacd[26522]: User "@09a58360-5380-4a7c-b4e7-60a6b215cf51" disconnected (0 users remain)
Jun 12 14:38:38 cuckoo guacd[26522]: Last user of connection "$ef5404f7-38a1-4f10-9682-d8d575005ce9" disconnected
Jun 12 14:38:38 cuckoo guacd[26522]: Internal RDP client disconnected

Are there more steps to be taken to make this work correctly?

[jmtrevaskis]

try this

mkdir /var/run/guacd/
chown guacd:guacd /var/run/guacd/

then restart guacd

[Antyrael]

@jmtrevaskis Unfortunately, that did not fix it for me.
The directory stays empty even after restarting the service.

[RicoVZ]

Hi @Antyrael,

Can you try removing the manually installed version and use the package manager to install Guacamole?
sudo apt install libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd

[Antyrael]

Hi @RicoVZ,

That's what I tried first, but it installs an older version of guacd (0.8.3 if I'm not mistaken).
It didn't work so I removed the packages, along with the libraries, and installed the newer version manually.

[artv2007]

Hi @RicoVZ
Thanx for show me how to enable remotecontrol. (I upgrade from cuckoo 2.0.5 and I have not this settings in my cuckoo.conf)

Now I add this to cuckoo.conf
[remotecontrol]
enabled = yes
guacd_host = 127.0.0.1
guacd_port = 4822

I start guacd by sudo systemctl start guacd
Listig of my guacd.service

Automatically generated by systemd-sysv-generator

[Unit]
Documentation=man:systemd-sysv-generator(8)
SourcePath=/etc/init.d/guacd
Description=LSB: Guacamole proxy daemon
After=network-online.target
After=systemd-journald-dev-log.socket
Wants=network-online.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
ExecStart=/etc/init.d/guacd start
ExecStop=/etc/init.d/guacd stop

I have no changes to my virtualbox.conf

vboxmanage showvminfo cuckoo1

VRDE: enabled (Address 0.0.0.0, Ports 33389, MultiConn: on, ReuseSingleConn: off, Authentication type: null)
Video redirection: disabled
VRDE property: TCP/Ports = "33389"
VRDE property: TCP/Address =
VRDE property: VideoChannel/Enabled =
VRDE property: VideoChannel/Quality =
VRDE property: VideoChannel/DownscaleProtection =
VRDE property: Client/DisableDisplay =
VRDE property: Client/DisableInput =
VRDE property: Client/DisableAudio =
VRDE property: Client/DisableUSB =
VRDE property: Client/DisableClipboard =
VRDE property: Client/DisableUpstreamAudio =
VRDE property: Client/DisableRDPDR =
VRDE property: H3DRedirect/Enabled =
VRDE property: Security/Method =
VRDE property: Security/ServerCertificate =
VRDE property: Security/ServerPrivateKey =
VRDE property: Security/CACertificate =
VRDE property: Audio/RateCorrectionMode =
VRDE property: Audio/LogPath =

When I start cuckoo -d - everything ok, no errors.
But when I add some files to analyze and check RemoteControl enable - after start I get that error in cuckoo log

2018-06-14 15:16:10,734 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "3903845489292784984" (task #129, options "procmemdump=yes,remotecontrol=yes,route=none")
2018-06-14 15:16:10,832 [cuckoo.core.scheduler] INFO: Task #129: acquired machine cuckoo1 (label=cuckoo1)
2018-06-14 15:16:10,854 [cuckoo.auxiliary.mitm] INFO: Started mitm interception with PID 12176 (ip=192.168.200.1, port=50000).
2018-06-14 15:16:10,854 [cuckoo.core.plugins] DEBUG: Started auxiliary module: MITM
2018-06-14 15:16:10,879 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 12177 (interface=vboxnet0, host=192.168.200.101)
2018-06-14 15:16:10,880 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
2018-06-14 15:16:10,932 [cuckoo.machinery.virtualbox] DEBUG: Starting vm cuckoo1
2018-06-14 15:16:11,179 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine cuckoo1 to running1
2018-06-14 15:16:12,026 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: MITM
2018-06-14 15:16:12,054 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2018-06-14 15:16:12,054 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm cuckoo1
2018-06-14 15:16:12,292 [cuckoo.machinery.virtualbox] INFO: Successfully disabled remote control for virtual machine with label cuckoo1
2018-06-14 15:16:12,321 [cuckoo.core.rooter] CRITICAL: Unable to passthrough root command (drop_disable) as the rooter unix socket doesn't exist.
2018-06-14 15:16:12,332 [cuckoo.core.scheduler] ERROR: Failure in AnalysisManager.run
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/scheduler.py", line 737, in run
self.launch_analysis()
File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/scheduler.py", line 494, in launch_analysis
machinery.start(self.machine.label, self.task)
File "/usr/local/lib/python2.7/dist-packages/cuckoo/machinery/virtualbox.py", line 124, in start
self.enable_vrde(label)
File "/usr/local/lib/python2.7/dist-packages/cuckoo/machinery/virtualbox.py", line 404, in enable_vrde
self._set_vrde_ports(label, self.options.virtualbox.controlports)
File "/usr/local/lib/python2.7/dist-packages/cuckoo/machinery/virtualbox.py", line 453, in _set_vrde_ports
if not re.match("^[0-9\-]+$", ports):
File "/usr/lib/python2.7/re.py", line 141, in match
return _compile(pattern, flags).match(string)
TypeError: expected string or buffer

[RicoVZ]

Hi @artv2007,

What is the value of controlports = in your virtualbox.conf? It should be a port range, for example:
controlports = 5000-5050.

[artv2007]

Hi @RicoVZ ,
I set controlports = 33389-33395 value in the virtualbox.conf
What else should I add to this configuration file?

Now, when I click "RemoteControl" buttom, new window open but an error occured.
What else should I add to this configuration file

[RicoVZ]

@artv2007
Can you post the Cuckoo and Cuckoo web log when this happens? :smile:

Did you install Guacamole using the package manager: sudo apt install libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd?

[artv2007]

@RicoVZ

Here is my logs
cuckoo.log
cuckoo-web.log

I have Ubuntu Server 16.04 and install Guacamole from source by instruction.
following will build the latest version (0.9.14) from source:

$ sudo apt -y install libcairo2-dev libjpeg-turbo8-dev libpng-dev libossp-uuid-dev libfreerdp-dev
$ mkdir /tmp/guac-build && cd /tmp/guac-build
$ wget https://www.apache.org/dist/guacamole/0.9.14/source/guacamole-server-0.9.14.tar.gz
$ tar xvf guacamole-server-0.9.14.tar.gz && cd guacamole-server-0.9.14
$ ./configure --with-init-dir=/etc/init.d
$ make && sudo make install && cd ..
$ sudo ldconfig
$ sudo /etc/init.d/guacd start

[littlejob]

I too had a similar issue posted in another thread - the below is what resolved the issue for me....

It appears when I reinstalled from the package repository I was not pulling the latest version of guac, per the requirements (here)

I ran the below to uninstall..
sudo apt-get remove libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd

I then reinstalled per the instructions in the documentation from building from source.. I restarted cuckoo and bam, it is now working as expected..

[Antyrael]

That's weird, that's exactly what I did and it still didn't work for me.

[rmeghnagi]

Hi all,

do you have some update about this issue?

@artv2007 I've the same error and i don't have any error in the logs, could you help me?

Thank you in advance!
R.

[xECK29x]

Hi @RicoVZ ,
I set controlports = 33389-33395 value in the virtualbox.conf
What else should I add to this configuration file?

Now, when I click "RemoteControl" buttom, new window open but an error occured.
What else should I add to this configuration file

I am having this issue as well, I feel I am so close to getting this working! I am not seeing any notable errors in my logs, happy to provide anything to fix or address this. What I can tell is if I refresh the window while this error is occurring I can see the desktop of my VM for a few seconds but I am unable to interact with it before it shows this error message again.

[infinitesecure]

I too had a similar issue posted in another thread - the below is what resolved the issue for me....

It appears when I reinstalled from the package repository I was not pulling the latest version of guac, per the requirements (here)

I ran the below to uninstall..
sudo apt-get remove libguac-client-rdp0 libguac-client-vnc0 libguac-client-ssh0 guacd

I then reinstalled per the instructions in the documentation from building from source.. I restarted cuckoo and bam, it is now working as expected..

worked for me! Thx

[Mokatsu]

Does anyone have another fix? I build from source but still get the same error: "An error occurred". Using KVM as a virtualization platform.

[ghost]

I use KVM (18.04,guacd 1.0.0 from source) 2.0.7, made it to work with windows 10 VM. Virt-manager set display to VGA, set Graphic to VNC on all interfaces. Leave only VNC.
Quit virt-manager sessions to VM.

Apply this fix to fix internal web errors 500 :
https://github.com/cuckoosandbox/cuckoo/issues/2771

If you run cuckoo web -H 0.0.0.0, it works fine, but with nginx and uswgi you will get many internal server errors and you will be disconnected from VM.

I decided to use nginx as https/authorization proxy to cuckoo web running with cuckoo web -H 0.0.0.0.
So far no disconnects

[Mokatsu]

ghost - I keep seeing on the guac threads that when using virtualbox you need to set remote ports within the virtualbox.conf, do youhave to do the same for kvm? Also Would you be able to share some insight in regards to your configuration? I cant seem to get it to work at all (always get the static screen)

• guacd is running on localhost:4822
• I am running auth via nginx so cuckoo-web is running on localhost as well

additional details:
I removed the nginx service and ran cuckoo web server on 0.0.0.0. started guacamole on locahost:4822 with debug log on, set the config within cuckoo.conf, restarted cuckoo. Started an analysis with remote control and tried to remote. Still getting the static screen:

guacd logs show nothing, it seems like cuckoo is not event calling to guacd
Nov 8 13:34:29 p-sc-dsk-kumi systemd[1]: guacd.service: Found left-over process 26689 (guacd) in control group while starting unit. Ignoring. Nov 8 13:34:29 p-sc-dsk-kumi guacd[26836]: Guacamole proxy daemon (guacd) version 0.9.9 started Nov 8 13:34:29 p-sc-dsk-kumi guacd[26839]: Listening on host 127.0.0.1, port 4822 Nov 8 13:34:29 p-sc-dsk-kumi guacd[26836]: guacd[26836]: INFO:#011Guacamole proxy daemon (guacd) version 0.9.9 started Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: Guacamole proxy daemon (guacd) version 0.9.9 started Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: guacd[26909]: INFO:#011Guacamole proxy daemon (guacd) version 0.9.9 started Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: guacd[26909]: DEBUG:#011Successfully bound socket to host 127.0.0.1, port 4822 Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: guacd[26909]: DEBUG:#011Exiting and passing control to PID 26910 Nov 8 13:34:54 p-sc-dsk-kumi systemd[1]: guacd.service: Can't open PID file /var/run/guacd/guacd.pid (yet?) after start: No such file or directory Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: Successfully bound socket to host 127.0.0.1, port 4822 Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: guacd[26910]: DEBUG:#011Exiting and passing control to PID 26911 Nov 8 13:34:54 p-sc-dsk-kumi guacd[26909]: Exiting and passing control to PID 26910 Nov 8 13:34:54 p-sc-dsk-kumi guacd[26910]: Exiting and passing control to PID 26911 Nov 8 13:34:54 p-sc-dsk-kumi guacd[26911]: Listening on host 127.0.0.1, port 4822