Question about deployment CAPE on Azure environment #1156
Comments
|
@rleal124: hello! 👋 This issue is being automatically closed because it does not follow the issue template. This is open source project! |
|
@cccs-kevin can you answer please his question? |
|
but it doesn't look like you need any of those libraries, you just need azure libs https://github.com/kevoreilly/CAPEv2/blob/master/modules/machinery/az.py |
|
First thanks @doomedraven for your feedback. |
|
yes, the script is mine so it's done for me and my needs, so everyone can optimise for their needs ;) |
|
Thanks. |
|
About the interface variable NETWORK_IFACE. I think is interface will connect VM for analysis. Correct ? |
|
Iface is fpr local server for tor, see docs about azure for it
configuration, script is done for kvm, as is uniq hypervisor thqt im using
El jue, 22 sept 2022 9:25, rleal124 ***@***.***> escribió:
… About the interface variable NETWORK_IFACE. I think is interface will
connect VM for analysis. Correct ?
On Azure environment, the NETWORK_IFACE should connect to RG3?
—
Reply to this email directly, view it on GitHub
<#1156 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH367BVZMX3J4HJ6NY2LV7QCWPANCNFSM6AAAAAAQSEYVWM>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
Thanks for you patience and help. |
|
Hey @rleal124, for your first question (which @doomedraven nailed), you do not need libvirt and KVM since we are interacting with the Azure platform via web calls. You do need the following packages though. For you second question, here is the documentation that I've written to assist with an Azure + CAPE deployment:
(Also I'll be reverting the most recent PR I made to the Azure machinery after testing it in production, so stay tuned) |
In the Azure environment, the NETWORK_IFACE variable in the |
|
Hi @cccs-kevin, Thanks a lot your comments and answers. Also identify the mongoDB 6 is not supported on Ubuntu 22.04. |
|
i guess we can start adding ifs for machinery in that script |
|
about mongo is weird as i can see it here https://repo.mongodb.org/apt/ubuntu/dists/jammy/mongodb-org/6.0/ |
|
From mongoDB documentation:
|
|
well docs not always being updated, as sources always speak the truth and not docs ;) |
|
Thanks @doomedraven, good to know. Today I am learned a new stuff. |
|
after many years dealing with open source and software in general, you will learn to trust more to code than any docs :D #SadTruth |
Here is the PR for the updated Azure machinery #1164 |
|
Thanks a lot for your help. I will starting the deployment, by first implement the RG. I will keep posted about he progress. Again many thanks |
|
just be careful, old good meme xD |
|
Hello again. I am install the cape using the script, and replace the az.py for #1164. I got the following error.
But if I using the old az.py I am not got error above. Any advice? |
|
Try running the following from the |
|
Not take any effect. I edited the cape2.sh and add the following line, for install the azure modules during the installation |
|
Can you show me the versions of those packages via |
|
About the MongoDB The solution I found is used for Focal: |
I am install form scratch and I confirm I using the last a I am just running the first analysis for test. Any ideas about this behavior? |
|
Tcpdump requires root privileges, but since cape does not run as root you have to set specific Linux capabilities to the binary: You can verify the results of last command with: |
Feel free to update the docs with a PR for this page so that other users don't make the same mistake https://capev2.readthedocs.io/en/latest/installation/guest/agent.html |
On ubuntu 22.04 the location of tcpdump is under / |
|
yes, that is changed in cape2.sh but not in aux.conf |
|
about why tcpdump doesn't work no really idea, but what i can suggest is to add print statement and see args, then run them by hand in terminal to view what kind of error it gives you |
Can you please tell me how I can do? |
Yes, I change also on |
|
https://github.com/kevoreilly/CAPEv2/blob/master/modules/auxiliary/sniffer.py#L178 |
I had change the code to: On cape log I can observe the sniffer auxiliary started, but I expect see the following message: |
|
That wont work, do it in my way
El lun, 26 sept 2022 20:36, rleal124 ***@***.***> escribió:
…
https://github.com/kevoreilly/CAPEv2/blob/master/modules/auxiliary/sniffer.py#L178
just before this line add print(pargs) you will get list of args, so you
might need later to run something like this once you copy that list: "".join(WHOLE
LIST OF ARGS HERE AS LIST). EExamplee: "".join(["tcpdump", "x", "y",
......])
I had change the code to:
try:
print(pargs)
self.proc = subprocess.Popen(pargs, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
except (OSError, ValueError):
log.exception("Failed to start sniffer (interface=%s, host=%s, dump path=%s)", interface, host, file_path)
return
On cape log I can observe the sniffer auxiliary started, but I expect see
the following message:
"Started sniffer with PID %d (interface=%s, host=%s, dump path=%s)"
But I don't observe.
[lib.cuckoo.core.scheduler] INFO: Enabled route 'none'
Sep 26 18:25:30 capesbxhost02 python3[1002]: 2022-09-26 18:25:30,771 [lib.cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
Sep 26 18:25:30 capesbxhost02 python3[1002]: 2022-09-26 18:25:30,794 [lib.cuckoo.core.guest] INFO: Task #25: Starting analysis on guest (id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7)
Sep 26 18:25:30 capesbxhost02 python3[1002]: 2022-09-26 18:25:30,810 [lib.cuckoo.core.guest] INFO: Task #25: Guest is running CAPE Agent 0.11 (id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7)
Sep 26 18:25:30 capesbxhost02 python3[1002]: 2022-09-26 18:25:30,951 [lib.cuckoo.core.guest] DEBUG: Task #25: Uploading analyzer to guest (id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7, size=26692942)
—
Reply to this email directly, view it on GitHub
<#1156 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH33JNBIGVAYQYOGHDXTWAHUKLANCNFSM6AAAAAAQSEYVWM>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
I am sorry, this correct? |
|
Show me the output of pargs
El lun, 26 sept 2022 21:18, rleal124 ***@***.***> escribió:
… That wont work, do it in my way El lun, 26 sept 2022 20:36, rleal124 *@*.
*> escribió: … <#m_1631479041120564023_>
https://github.com/kevoreilly/CAPEv2/blob/master/modules/auxiliary/sniffer.py#L178
<https://github.com/kevoreilly/CAPEv2/blob/master/modules/auxiliary/sniffer.py#L178>
just before this line add print(pargs) you will get list of args, so you
might need later to run something like this once you copy that list:
"".join(WHOLE LIST OF ARGS HERE AS LIST). EExamplee: "".join(["tcpdump",
"x", "y", ......]) I had change the code to: try: print(pargs) self.proc =
subprocess.Popen(pargs, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
shell=False) except (OSError, ValueError): log.exception("Failed to start
sniffer (interface=%s, host=%s, dump path=%s)", interface, host, file_path)
return On cape log I can observe the sniffer auxiliary started, but I
expect see the following message: "Started sniffer with PID %d
(interface=%s, host=%s, dump path=%s)" But I don't observe.
[lib.cuckoo.core.scheduler] INFO: Enabled route 'none' Sep 26 18:25:30
capesbxhost02 python3[1002]: 2022-09-26 18:25:30,771
[lib.cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer Sep 26
18:25:30 capesbxhost02 python3[1002]: 2022-09-26 18:25:30,794
[lib.cuckoo.core.guest] INFO: Task #25
<#25>: Starting analysis on guest
(id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7) Sep 26 18:25:30 capesbxhost02
python3[1002]: 2022-09-26 18:25:30,810 [lib.cuckoo.core.guest] INFO: Task
#25 <#25>: Guest is running CAPE
Agent 0.11 (id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7) Sep 26 18:25:30
capesbxhost02 python3[1002]: 2022-09-26 18:25:30,951
[lib.cuckoo.core.guest] DEBUG: Task #25
<#25>: Uploading analyzer to guest
(id=CAPESBXAnalysisVMSS_1, ip=172.21.3.7, size=26692942) — Reply to this
email directly, view it on GitHub <#1156 (comment)
<#1156 (comment)>>,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAOFH33JNBIGVAYQYOGHDXTWAHUKLANCNFSM6AAAAAAQSEYVWM
<https://github.com/notifications/unsubscribe-auth/AAOFH33JNBIGVAYQYOGHDXTWAHUKLANCNFSM6AAAAAAQSEYVWM>
. You are receiving this because you were mentioned.Message ID: @.*>
I am sorry, this correct?
print(''.join[tcpdump, "-U", "-q", "-s", "0", "-i", interface, "-n"]])
self.proc = subprocess.Popen(pargs, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
—
Reply to this email directly, view it on GitHub
<#1156 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH326HHGEATUOYFAIDR3WAHZGTANCNFSM6AAAAAAQSEYVWM>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
So I change the code to, is correct? I should see the output on |
|
no that is totally wrong, just put |
|
I am sorry. Second: And last: Correct? |
|
Yes
El lun, 26 sept 2022 22:20, rleal124 ***@***.***> escribió:
… I am sorry.
First on sniffer.py add
try:
print(pargs)
self.proc = subprocess.Popen(pargs, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
Second:
systemctl stop cape
~
Last:
poetry run python3 cuckoo.py -d
Correct?
—
Reply to this email directly, view it on GitHub
<#1156 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH37AMGRHZTLUJ4RJW53WAIAQPANCNFSM6AAAAAAQSEYVWM>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
|
|
I am expecte some message like: |
|
|
|
Thanks a lot. |
|
yes as there is no reason to use tcpdump without routing, ensure to restart cuckoo.py |
|
Thanks a lot for your help and patience. Again thanks a lot. |
|
About the pargs output:
|
run the last command by hand as cape to see what error it will give you |
|
I don't get any error, but also I don't get any traffic. I run |
|
you did modify my command and is not correct, you set to listen on all, you need to run exact command |
|
Sorry, I change the interface to any, because I don't get any traffic on eth1 interface. In below the output. |
|
well then all works as expected with tcpdump, the problem here idk what it is as i don't have azure instance. so you probably will need to figurate on your own + pay attention that iface that Kevin told you is not |
|
Thanks a lot for your help. Let read again the documentation. |
|
Yes but that is for local server, doesnt have nothing to do with azure
El jue, 22 sept 2022 9:45, rleal124 ***@***.***> escribió:
… Thanks for you patience and help.
So, the following variables is for TOR, correct ?
NETWORK_IFACE=virbr1
for tor
IFACE_IP="192.168.1.1"
—
Reply to this email directly, view it on GitHub
<#1156 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH337PBTMPRI4G35GZ5TV7QFCXANCNFSM6AAAAAAQSEYVWM>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Question about deployment CAPE on Azure environment
This is opensource and you getting free support so be friendly!
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Install the CAPE on Azure environment. Understand what reequipments addcional I need to meet
Current Behavior
I am read the documentation present https://capev2.readthedocs.io/en/latest/installation/host/cloud.html.
And also I am read and try understand the configurations presents on config path in specific the az.conf
And for last but not less import I review the cape2.sh
But I still have some questions.
Failure Information (for bugs)
Please help provide information about the failure if this is a bug. If it is not a bug, please remove the rest of this template.
The text was updated successfully, but these errors were encountered: