【Cape Sandbox】Cape SandboxのHost構築

# アップデートとアップグレード
sudo apt-get update
sudo apt upgrade

# KVMのダウンロード
wget https://raw.githubusercontent.com/kevoreilly/CAPEv2/master/installer/kvm-qemu.sh

# 実行権限の付与
chmod +x ./kvm-qemu.sh
# KVMとマネージャーのインストール
sudo ./kvm-qemu.sh all <username> | sudo tee kvm-qemu.log
sudo ./kvm-qemu.sh virtmanager <username> | sudo tee kvm-qemu-virt-manager.log
# 再起動
sudo reboot

# CapeV2のダウンロード
wget https://raw.githubusercontent.com/kevoreilly/CAPEv2/master/installer/cape2.sh

# 実行権限の付与
chmod +x ./cape2.sh
# CapeV2のインストール
sudo ./cape2.sh all cape | sudo tee cape.log
# 再起動
sudo reboot

sudo nano /opt/CAPEv2/conf/auxiliary.conf

# Specify the network interface name on which tcpdump should monitor the
# traffic. Make sure the interface is active.
interface = virbr1

# Specify the network interface name on which tcpdump should monitor the
# traffic. Make sure the interface is active.
interface = virbr0

sudo nano /opt/CAPEv2/conf/cuckoo.conf

[resultserver]
# The Result Server is used to receive in real time the behavioral logs
# produced by the analyzer.
# Specify the IP address of the host. The analysis machines should be able
# to contact the host through such address, so make sure it's valid.
# NOTE: if you set resultserver IP to 0.0.0.0 you have to set the option
# `resultserver_ip` for all your virtual machines in machinery configuration.
ip = 192.168.1.1

[resultserver]
# The Result Server is used to receive in real time the behavioral logs
# produced by the analyzer.
# Specify the IP address of the host. The analysis machines should be able
# to contact the host through such address, so make sure it's valid.
# NOTE: if you set resultserver IP to 0.0.0.0 you have to set the option
# `resultserver_ip` for all your virtual machines in machinery configuration.
ip = 192.168.122.1

sudo nano /opt/CAPEv2/conf/reporting.conf

[mongodb]
enabled = no
host = 127.0.0.1
port = 27017
db = cuckoo

[mongodb]
enabled = yes
host = 127.0.0.1
port = 27017
db = cuckoo

sudo nano /opt/CAPEv2/conf/routing.conf

# Default network routing mode; "none", "internet", or "vpn_name".
# In none mode we don't do any special routing - the VM doesn't have any
# network access (this has been the default actually for quite a while).
# In internet mode by default all the VMs will be routed through the network
# interface configured below (the "dirty line").
# And in VPN mode by default the VMs will be routed through the VPN identified
# by the given name of the VPN.
# Note that just like enabling VPN configuration setting this option to
# anything other than "none" requires one to run utils/rooter.py as root next
# to the CAPE instance (as it's required for setting up the routing).
route = none

# Network interface that allows a VM to connect to the entire internet, the
# "dirty line" so to say. Note that, just like with the VPNs, this will allow
# malicious traffic through your network. So think twice before enabling it.
# (For example, to route all VMs through eth0 by default: "internet = eth0").
internet = none

# Default network routing mode; "none", "internet", or "vpn_name".
# In none mode we don't do any special routing - the VM doesn't have any
# network access (this has been the default actually for quite a while).
# In internet mode by default all the VMs will be routed through the network
# interface configured below (the "dirty line").
# And in VPN mode by default the VMs will be routed through the VPN identified
# by the given name of the VPN.
# Note that just like enabling VPN configuration setting this option to
# anything other than "none" requires one to run utils/rooter.py as root next
# to the CAPE instance (as it's required for setting up the routing).
route = internet

# Network interface that allows a VM to connect to the entire internet, the
# "dirty line" so to say. Note that, just like with the VPNs, this will allow
# malicious traffic through your network. So think twice before enabling it.
# (For example, to route all VMs through eth0 by default: "internet = eth0").
internet = virbr0