{"id":2868,"date":"2016-06-21T02:03:25","date_gmt":"2016-06-21T02:03:25","guid":{"rendered":"http:\/\/www.pir8geek.com\/?p=2868"},"modified":"2016-06-21T02:03:25","modified_gmt":"2016-06-21T02:03:25","slug":"detux-multiplatform-linux-sandbox","status":"publish","type":"post","link":"https:\/\/www.jameseduard.com\/?p=2868","title":{"rendered":"Detux &#8211; The Multiplatform Linux Sandbox"},"content":{"rendered":"<p><strong>Detux<\/strong> is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux (Debian) for various CPU architectures.<br \/>\nTh<strong>e following CPUs are currently supported:<\/strong><\/p>\n<ul>\n<li>x86<\/li>\n<li>x86-64<\/li>\n<li>ARM<\/li>\n<li>MIPS<\/li>\n<li>MIPSEL<\/li>\n<li>Use the Live version now: http:\/\/detux.org<\/li>\n<\/ul>\n<p><strong>What&#8217;s in this release?<\/strong><br \/>\nThis release of <em><strong>Detux<\/strong><\/em> contains the script for executing a Linux binary\/script in a specified CPU arch. Don&#8217;t worry if you don&#8217;t know what platform, it&#8217;s in the script, the Magic package helps picking up the CPU arch in an automated way. x86 is the default CPU version, this can be tuned to a different one in the config file.<br \/>\nThis release gives the analysis report in a DICT format, which can be easily customized to be inserted in to NOSQL dbs.<br \/>\nAn example script has been provided which demonstrates the usage of the sandbox library.<\/p>\n<pre><code>- Static Analysis\n    -- Basic strings extracted from binary\n    -- ELF information generated by readelf commands\n    -- the report.py can be modified to add more 3rd party commands to analyse the binary and add the result to DICT.\n- Dynamic Analysis\n    -- The captured pcaps are parsed with DPKT to extract the IOC's and readable info from the packets. <\/code><\/pre>\n<p><strong>Requirements:<\/strong><br \/>\n<strong>System packages<\/strong><\/p>\n<ul>\n<li>python 2.7<\/li>\n<li>qemu<\/li>\n<li>pcaputils<\/li>\n<li>sudo<\/li>\n<li>libcap2-bin<\/li>\n<li>bridge-utils<\/li>\n<\/ul>\n<p><strong>Python libraries (Preferable to use virtual environment)<\/strong><\/p>\n<ul>\n<li>pexpect<\/li>\n<li>paramiko<\/li>\n<li>python-magic<\/li>\n<li>Kindly make sure that the above requirements are met before using Detux. A few dependencies may vary from OS to OS.<\/li>\n<\/ul>\n<p>Architecture<strong><br \/>\n<\/strong><\/p>\n<ul>\n<li>Host ( The host itself can be a VM or a baremetal machine)<\/li>\n<li>QEMU<\/li>\n<li>dumpcap<\/li>\n<li>DETUX Scripts<\/li>\n<\/ul>\n<p><strong>Network Arch<\/strong><\/p>\n<pre><code>- NIC1 : This interface is for accessing the Host\n- NIC2 : Interface bridged with the the QEMU Sandbox VMs. One can redirect the traffic from the interface to WHONIX or REMNUX or a custom Gateway to filter\/allow internet access for the Sandboxed VMs.<\/code><\/pre>\n<p><strong>VM Setup:<\/strong><br \/>\n<em>Downloading Linux VM Images<\/em><br \/>\nSpecial thanks to aurel who has uploaded pre built QEMU Debian VM images for all possible CPU architectures. The VM images are located at : https:\/\/people.debian.org\/~aurel32\/qemu\/, the same link contains the command examples for invoking the vm images.<br \/>\nYou can use the following script to automatically download the VM images to the &#8220;qemu&#8221; folder of Detux.<\/p>\n<pre>#x86\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/i386\/debian_wheezy_i386_standard.qcow2 -P qemu\/x86\/1\/\n#x86-64\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/amd64\/debian_wheezy_amd64_standard.qcow2 -P qemu\/x86-64\/1\/\n#arm\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/armel\/debian_wheezy_armel_standard.qcow2 -P qemu\/arm\/1\/\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/armel\/initrd.img-3.2.0-4-versatile -P qemu\/arm\/1\/\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/armel\/vmlinuz-3.2.0-4-versatile -P qemu\/arm\/1\/\n#mips\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/mips\/vmlinux-3.2.0-4-4kc-malta -P qemu\/mips\/1\/\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/mips\/debian_wheezy_mips_standard.qcow2 -P qemu\/mips\/1\/\n#mipsel\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/mipsel\/vmlinux-3.2.0-4-4kc-malta -P qemu\/mipsel\/1\/\nwget https:\/\/people.debian.org\/~aurel32\/qemu\/mipsel\/debian_wheezy_mipsel_standard.qcow2 -P qemu\/mipsel\/1\/\n<\/pre>\n<p><strong>Setting sudoers for qemu execution<\/strong><br \/>\nDetux uses SSH to communicate with the VMs and so, this is currently required for the VMs to have networking capability. Considering that the listed binaries are in the same path, you may add the following lines to to \/etc\/sudoers (only if you are a non-root user):<\/p>\n<pre>Cmnd_Alias  QEMU_CMD    =   \/usr\/bin\/qemu-*, \/sbin\/ip, \/sbin\/ifconfig, \/sbin\/brctl\n ALL = (ALL) NOPASSWD: QEMU_CMD\n<\/pre>\n<p>Change the paths to the binaries if they differ for you.<br \/>\n<strong>Network setup:<\/strong>.<br \/>\nAdd the following config to \/etc\/qemu-ifup, backup the original if you already have one:<\/p>\n<pre>#! \/bin\/sh\n# Script to bring a network (tap) device for qemu up.\n# The idea is to add the tap device to the same bridge\n# as we have default routing to.\n# in order to be able to find brctl\nPATH=$PATH:\/sbin:\/usr\/sbin\nip=$(which ip)\nifconfig=$(which ifconfig)\necho \"Starting\"  $1\nif [ -n \"$ip\" ]; then\n   ip link set \"$1\" up\nelse\n   brctl=$(which brctl)\n   if [ ! \"$ip\" -o ! \"$brctl\" ]; then\n     echo \"W: $0: not doing any bridge processing: neither ip nor brctl utility not found\" &gt;&amp;2\n     exit 0\n   fi\n   ifconfig \"$1\" 0.0.0.0 up\nfi\nswitch=$(ip route ls | \\\n    awk '\/^default \/ {\n          for(i=0;i&lt;NF;i++) { if ($i == \"dev\") { print $(i+1); next; } } }' ) if [ -d \/sys\/class\/net\/br0\/bridge\/. ]; then if [ -n \"$ip\" ]; then ip link set \"$1\" master br0 else brctl addif br0 \"$1\" fi exit # exit with status of the previous command fi echo \"W: $0: no bridge for guest interface found\" &gt;&amp;2\n<\/pre>\n<p>Considering that eth0 is the interface you want your VMs to be bridged with, you may remove the configs for eth0 and use the following configs in \/etc\/network\/interfaces:<\/p>\n<pre>auto br0\niface br0 inet dhcp\n  bridge_ports eth0\n  bridge_maxwait 0\n<\/pre>\n<p>You can also specify a static address you used for eth0.<br \/>\n<strong>Setting up your VMs<\/strong><br \/>\nTraverse to the folder in which your VM images are located for each QEMU Images e.g. for ARM is :<\/p>\n<pre>\/qemu\/arm\/1\/\n<\/pre>\n<p>For each image, follow the VM boot instructions given at &#8220;https:\/\/people.debian.org\/~aurel32\/&#8221;, to start the VM. However, if you are a non-root user, you will have to use sudo.<br \/>\nComands for Booting the VMs (Replace with the MAC you desire):<br \/>\n&nbsp;<\/p>\n<pre><code>#x86\nsudo qemu-system-i386 -hda qemu\/x86\/1\/debian_wheezy_i386_standard.qcow2 -vnc 127.0.0.1:5901 -net nic,macaddr=&lt;MACADDR&gt; -net tap -monitor stdio\n#x86-64\nsudo qemu-system-x86_64 -hda qemu\/x86-64\/1\/debian_wheezy_amd64_standard.qcow2 -vnc 127.0.0.1:5901 -net nic,macaddr=&lt;MACADDR&gt; -net tap -monitor stdio\n#arm\nsudo qemu-system-arm -M versatilepb -kernel qemu\/arm\/1\/vmlinuz-3.2.0-4-versatile -initrd qemu\/arm\/1\/initrd.img-3.2.0-4-versatile -hda qemu\/arm\/1\/debian_wheezy_armel_standard.qcow2 -append \"root=\/dev\/sda1\" -vnc 127.0.0.1:5901 -net nic,macaddr=&lt;MACADDR&gt; -net tap -monitor stdio\n#mips\nsudo qemu-system-mips -M malta -kernel qemu\/mips\/1\/vmlinux-3.2.0-4-4kc-malta -hda qemu\/mips\/1\/debian_wheezy_mips_standard.qcow2 -append \"root=\/dev\/sda1 console=tty0\" -vnc 127.0.0.1:5901 -net nic,macaddr=&lt;MACADDR&gt; -net tap -monitor stdio\n#mipsel\nsudo qemu-system-mipsel -M malta -kernel qemu\/mipsel\/1\/vmlinux-3.2.0-4-4kc-malta -hda qemu\/mipsel\/1\/debian_wheezy_mipsel_standard.qcow2 -append \"root=\/dev\/sda1 console=tty0\" -vnc 127.0.0.1:5901 -net nic,macaddr=&lt;MACADDR&gt; -net tap -monitor stdio<\/code><\/pre>\n<p>Detux requires a preconfigured VM snapshot with IP addresses and ssh setup.<br \/>\n<strong>Steps for setting up your snapshot:<\/strong><\/p>\n<ul>\n<li>Choose an unconfigured VM image and start it using the above listed command in a Terminal.<\/li>\n<li>Connect VM monitor. Connect a VNC client to 127.0.0.1:5901 and wait for the VM to boot completely.<\/li>\n<li>Login with the default root credentials (root\/root).<\/li>\n<li>Configure the VM&#8217;s network interface such that it reachable\/ accessible to the host.<\/li>\n<li>Setup SSH server on the VM and anyother configuration if required for you.<\/li>\n<li>Once configured, boot to a running state that accepts network connection.<\/li>\n<li>Switch back to terminal with qemu console on, which should look like:\n<pre>(qemu)\n<\/pre>\n<p>Save the VM state typing the following qemu commands in the qemu console:<\/p>\n<pre>(qemu) savevm init<\/pre>\n<p>Quit the QEMU console:<\/p>\n<pre>(qemu) q\n<\/pre>\n<p>&#8212; Repeat through step 1 for all the VMs<\/li>\n<\/ul>\n<p><strong>Setting capture permisisons<\/strong><br \/>\nIn order for a non-root user to be able to capture packets, Dumpcap needs capture privileges. (https:\/\/wiki.wireshark.org\/CaptureSetup\/CapturePrivileges).<br \/>\n<strong>The following command may enable the same for you:<\/strong><\/p>\n<pre>sudo groupadd -g wireshark\nsudo usermod -a -G wireshark\nsudo chmod 750 \/usr\/bin\/dumpcap\nsudo etcap cap_net_raw,cap_net_admin=eip \/usr\/bin\/dumpcap\n<\/pre>\n<p>If you are unable to capture packets, you need to check if permisions for your users are set correctly and the dumpcap path is right.<br \/>\n<strong>Detux Config<\/strong><br \/>\nThe detux.cfg files in the main directory needs to be configured. Each VM section has to be configured with correct Network Params and SSH credentials. You can choose root\/non-root user depending on your need.<br \/>\n<strong>Running Detux<\/strong><br \/>\nThe Detux library located in &#8220;core&#8221; directory can be used to suit your need of analysis. The repo contains &#8220;detux.py&#8221; which analyses the given binary and saves pcap in pcap folder and writes JSON output to a specified filepath.<br \/>\n<strong>Usage:<\/strong><\/p>\n<pre>usage: detux.py [-h] --sample SAMPLE [--cpu {x86,x86-64,arm,mips,mipsel}]\n                [--int {python,perl,sh,bash}] --report REPORT\noptional arguments:\n  -h, --help            show this help message and exit\n  --sample SAMPLE       Sample path (default: None)\n  --cpu {x86,x86-64,arm,mips,mipsel}\n                        CPU type (default: auto)\n  --int {python,perl,sh,bash}\n                        Architecture type (default: None)\n  --report REPORT       JSON report output path (default: None)\n<\/pre>\n<p><strong>Example:<\/strong><\/p>\n<pre>python detux.py --sample test_script\/example_binary1 --report reports\/example_report1.json\n<\/pre>\n<p><a href=\"https:\/\/github.com\/detuxsandbox\/detux\" target=\"_blank\" rel=\"noopener noreferrer\">Download Detux at Github<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux (Debian) for various CPU architectures. The following CPUs are currently supported: x86 x86-64 ARM MIPS MIPSEL Use the Live version now: http:\/\/detux.org What&#8217;s in this release? This release<\/p>\n","protected":false},"author":1,"featured_media":2869,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,541],"tags":[701,702],"class_list":["post-2868","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-python","tag-detux","tag-sandbox"],"_links":{"self":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts\/2868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2868"}],"version-history":[{"count":0,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=\/wp\/v2\/posts\/2868\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jameseduard.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}