Ref: https://medium.com/@seifreed/how-to-deploy-cuckoo-sandbox-431a6e65b848
Ref 2: https://utopianknight.com/malware/cuckoo-installation-on-ubuntu-20/
Environment: MacBook Pro 2019
VirtualBox 6.1
Set up Ubuntu 20 LTS
System Update
1) system update: sudo apt update && sudo apt upgrade -y
2) create a cuckoo user: sudo adduser cuckoo
3) add to sudo: sudo adduser cuckoo sudo
Deployment:
4) Add MongoDB support: sudo apt-key adv -keyserver keyserver.ubuntu.com -recv-keys 68818C72E52529D4
New curl -fsSL https://www.mongodb.org/static/pgp/server-4.4.asc | sudo apt-key add -
5) Add repo: echo “deb [arch=amd64] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/development multiverse” | sudo tee /etc/apt/sources.list.d/mongodb-org-4.0.list
6) enable repo: sudo nano /etc/apt/sources.list
https://miro.medium.com/max/4800/1*u9Y0WNDzqtYJ-pivFUpXYA.png
7) sudo apt-update
8) package update again:
sudo apt install git mongodb-org-unstable python python-dev python-pip python-m2crypto libmagic1 swig libvirt-dev upx-ucl libssl-dev wget unzip p7zip-full geoip-database libgeoip-dev libjpeg-dev mono-utils ssdeep libfuzzy-dev exiftool curl openjdk-11-jre-headless xfce4 xfce4-goodies postgresql postgresql-contrib libpq-dev wkhtmltopdf xvfb xfonts-100dpi tcpdump libcap2-bin clamav clamav-daemon clamav-freshclam python-pil suricata libboost-all-dev qemu-kvm libvirt-clients libvirt-daemon virt-manager htop tmux gdebi-core tor privoxy libssl-dev libjansson-dev libmagic-dev automake apparmor-utils -y
9) pip update:
sudo -H pip install psycopg2 distorm3 pycrypto openpyxl
sudo -H pip install git+https://github.com/kbandla/pydeep.git
sudo -H pip install git+https://github.com/volatilityfoundation/volatility.git
sudo -H pip install pyopenssl -U
10) add our user to the KVM and libvirt group:
sudo usermod -a -G kvm $USER && sudo usermod -a -G libvirt $USER
11) enable package capture in VM:
sudo aa-disable /usr/sbin/tcpdump
sudo groupadd pcap
sudo usermod -a -G pcap cuckoo
sudo chgrp pcap /usr/sbin/tcpdump
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
12) sudo pip install cuckoo==2.0.6.2
