开发

#!/usr/bin/env python
import sys

if __name__ == "__main__":
   from django.core.management import execute_from_command_line
   execute_from_command_line(sys.argv)

from lib.cuckoo.common.abstracts import Auxiliary

class MyAuxiliary(Auxiliary):
    """定义辅助模块"""
    
    def start(self):
        # 定义辅助功能

    def stop(self):
        # 定义模块关闭

class RunAuxiliary(object):
    """辅助模块管理"""
    
	def __init__(self, task, machine, guest_manager)：
    	# 辅助功能模块初始化
    
  	def start(self):
    	# 辅助功能模块配置
        options = config2("auxiliary", module_name)
       	
    def callback(self, name, *args, **kwargs):
    	# 辅助功能模块加载
        MyAuxiliary.start()
        
  	def stop(self):
    	# 辅助功能模块关闭
    	MyAuxiliary.stop()	

from lib.cuckoo.common.abstracts import Machinery
from lib.cuckoo.common.exceptions import CuckooMachineError

class MyMachinery(Machinery):
    def start(self, label):
    	# 开启定义虚拟机管理软件
        try:
            revert(label)
            start(label)
        except SomethingBadHappens:
            raise CuckooMachineError("oops!")
    
    def initialize(self, module_name):
        # 初始化配置信息
    	self._initialize(module_name)
    
    def stop(self, label):
    	# 关闭定义虚拟机管理软件
        try:
            stop(label)
        except SomethingBadHappens:
            raise CuckooMachineError("oops!")

class AnalysisManager(threading.Thread):

    def __init__(self, task_id, error_queue):
        # 读取任务的消息、配置文件中的服务端ip和端口

    def init(self):
        # 初始化分析, 创建分析结果存储目录

    def acquire_machine(self):
        # 开启配置虚拟机
        
    def launch_analysis(self):
  		# 开启分析任务
        self.init():
        self.acquire_machine()
        # 开启虚拟机如：machinery/virtualbox.py 中 VirtualBox.start
        machinery.start(self.machine.label, self.task)
        return succeeded

class MiniHTTPRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
  	# 用作对不同路径的不同函数处理(响应)
    server_version = "Cuckoo Agent"

    def do_GET(self):
        # 响应GET请求

    def do_POST(self):
        # 响应POST请求
    	# host与client之间的数据传输, 格式为multipart/form-data

AGENT_VERSION = "0.10"
AGENT_FEATURES = [
    "execpy", "pinning", "logs", "largefile", "unicodepath",
]
 
@app.route("/")
def get_index():
  
@app.route("/environ")
def get_environ():

@app.route("/mktemp", methods=["GET", "POST"])
def do_mktemp():
    
@app.route("/mkdtemp", methods=["GET", "POST"])
def do_mkdtemp():  
    
@app.route("/extract", methods=["POST"])
def do_extract():
    
@app.route("/store", methods=["POST"])
def do_store():
  
@app.route("/execpy", methods=["POST"])
def do_execpy():
       
@app.route("/status")
def get_status():

class GuestManager(object):

    def __init__(self, vmid, ipaddr, platform, task_id, analysis_manager):
      	# 初始化信息

    def stop(self):
        # 关闭客户端分析
    
    def upload_analyzer(self, monitor):
        # 上传分析模块
     
    def add_config(self, options):
        # 上传分析脚本

    def start_analysis(self, options, monitor):
        # 客户端开启分析
        self.upload_analyzer(monitor)

        self.add_config(options)

        # 执行store命令 --> 在系统中执行写入analysis.conf
        self.post("/store", files=files, data=data)

        # 执行execpy命令 --> 在系统中执行python analyzer.py
        self.post("/execpy", data=data)
            
        # 执行execute命令, execute(command)
        self.post("/execute", data=data)

    def wait_for_completion(self):
        # 不断获取客户端分析状态

from lib.api.process import Process
from lib.common.exceptions import CuckooPackageError

class Package(object):
    """定义文件分析模块"""
    
 	def start(self):
        # 定义文件分析初始化操作
 		raise NotImplementedError

    def check(self):
        # 执行重复操作
        return True

    def execute(self, path, args):
        # 启动分析进程
        dll = self.options.get("dll")
        free = self.options.get("free")
        suspended = True
        if free:
            suspended = False
        p = Process()
        if not p.execute(path=path, args=args, suspended=suspended):
            raise CuckooPackageError(
                    "Unable to execute the initial process, analysis aborted."
            )

        if not free and suspended:
            p.inject(dll)
            p.resume()
            p.close()
            return p.pid

    def finish(self):
        # 转储进程内存
        if self.options.get("procmemdump"):
            for pid in self.pids:
                p = Process(pid=pid)
                p.dump_memory()
        return True

Class Process(object):
    """Windows分析进程"""
    
    def execute(self):
        # 执行样本分析
        
        # 启动inject.exe作为中间人，负责启动目标样本进程并挂起主线程
        argv = [
            inject_exe,
            "--app", path,
            "--only-start",
        ]
				subprocess_checkoutput(argv, env)
        
        # 再次启动inject.exe作为中间人，执行dll注入功能
        argv = [
            inject_exe,
            "--resume-thread",
            "--pid", "%s" % self.pid,
            "--tid", "%s" % self.tid,
        ]
        if free:
            argv.append("--free")
        else:
            argv += [
                "--apc",
                "--dll", dllpath,
            ]
        subprocess_checkoutput(argv, env)

Class PipeServer(threading.Thread):
    # 接收传入的管道句柄，创建新线程
    
    def run(self):
        handler.start()

Class PipeForwarder(threading.Thread):
	# 将通过管道接收的数据发送给中心服务器
    
    def run(self):
        socket.create_connection()
        socket.sendall()

from lib.common.abstracts import Package

class Exe(Package):
    """EXE分析包"""
	
    def start(self, path):
        args = self.options.get("arguments")
        return self.execute(path, args)

class Generic(Package):
    """基于Shell的通用执行分析包"""

    def start(self, path):
        os.chmod(path, 0o755)
        return self.execute(["sh", "-c", path])

class Apk(Package):
    """APK分析包"""

    def start(self, path):
        install_sample(path)
        execute_sample(self.package, self.activity)

class Analyzer(object):
    """Windows分析脚本"""
    
    def prepare(self):
        # 配置分析环境
        
    def run(self):
    	# 启动分析进程
        
        self.prepare()
        Package()
        # 根据文件类型选择对应的分析包
        package = choose_package()
        Auxiliary()
        # 启动一系列辅助分析工具
        aux.init()
        aux.start()
        # 隐藏进程
        zer0m0n.hidepid(self.pid)
        zer0m0n.hidepid(self.ppid)
        # 开始执行分析包
        package.start()
        package.execute()

from lib.cuckoo.common.exceptions import CuckooProcessingError
from lib.cuckoo.common.abstracts import Processing

class MyModule(Processing):

    def run(self):
        self.key = "key"
        
        try:
            data = do_something()
        except SomethingFailed:
            raise CuckooProcessingError("Failed")
            
        return data

class RunProcessing(object):

    def __init__(self, task):
        # 初始化信息
        
    def process(self, module, results):
      	# 执行一个结果处理模块
        
    def run(self):
        # 执行所有结果处理模块，返回全局结果容器
        # 获得 processing 功能列表
        processing_list = cuckoo.processing.plugins
        
        for module in processing_list:
            # 执行功能
            key, result = self.process(module, results)
            # If the module provided results, append it to the fat dict.
            if key and result:
                results[key] = result
        return results

- info
  - added/strarted/ended: 上传样本, 启动分析与结束分析的时间戳
  - duration: 分析时长
  - id: ={task_id}, 数据库中的任务id
  - package: 文件类型
  - machine: 样本运行环境
- signatures
	- families: 恶意软件家族
	- description: 签名描述
	- severity: 安全等级
	- references: URL列表
  - name: 签名名称
- target
  - file
    - yara: yara规则匹配
    - sha-1/sha256/sha512/md5: 文件哈希值
    - name: 文件名
    - type: 文件类型(包括运行系统与压缩加壳方式)
    - crc32: 校验码
    - path: 文件二进制形式存储路径
    - size: 文件大小
- network
  - tls/udp/http/icmp/smtp/tcp/dns: 协议解析字段
  - pcap_sha256: 流量包哈希值
- static
  - pe_imports: 导入地址表(IAT), 列出了动态链接库和它们的函数
  - imported_dll_count: DLL数量
  - pe_resources: 资源节, 列出了文件中的可打印字符串/图形图像/按钮图标等信息
  - pe_sections: 文件节区信息, 包括节区大小/虚拟地址/熵/加壳方式/虚拟内存等
- behavior
  - generic
    - process_path: 进程启动路径
    - process_name: 进程执行程序名
    - pid: 进程id
    - first_seen: 进程启动时间戳
    - ppid: 父进程id
  - processes
    - modules: 样本运行时调用的系统文件信息, 包括被调用文件名/路径/基地址及其大小
    - time: 运行时间
  - processtree
    - children: 子进程列表
- debug: analysis.log分析结果
- screenshots: 指定运行截图存储路径
- strings: 文件中的可打印字符串列表

from lib.cuckoo.common.abstracts import Signature

class CreatesExe(Signature):
    name = "creates_exe"
    description = "Creates a Windows executable on the filesystem"
    severity = 2
    categories = ["generic"]
    authors = ["Cuckoo Developers"]
    minimum = "2.0"

    def on_complete(self):
        return self.check_file(pattern=".*\\.exe$", regex=True)
    
    def on_call(self, call, pid, tid):
        # 只用于事件签名

class RunSignatures(object):

    def __init__(self, results):
        # 初始化签名，记录标签API

    def call_signature(self, signature, handler, *args, **kwargs):   
        # 签名的包装器。这个包装器将事件产生给签名，并递归地处理匹配的签名
      
    def process_yara_matches(self):
       
    def process_extracted(self):

    def run(self):
      
        self.process_yara_matches()
        # 遍历所有Yara匹配项
        self.process_extracted()
        for sig in self.signatures:
            self.call_signature(sig, sig.on_extract, ExtractedMatch(item))
        # 遍历所有提取的匹配项    
        self.matched.append(signature.results())
        # 分数计算
        score += signature.severity
        # 按严重性级别对匹配的签名进行排序，并将其放入结果字典
        self.matched.sort(key=lambda key: key["severity"])
        self.results["signatures"] = self.matched
        if "info" in self.results:
            self.results["info"]["score"] = score / 5.0
    
    required = ["creates_exe", "badmalware"]
    
    def on_signature(self, matched_sig):
        # 将识别异常的多个签名组合为一个签名分类实例（恶意软件警报）
        
        if matched_sig in self.required:
            self.required.remove(matched_sig)
            
        if not self.required:
            return True
        
        return False

"signatures": [
    {
        "severity": 2,
        "description": "Creates a Windows executable on the filesystem",
        "alert": false,
        "references": [],
        "data": [
            {
                "file_name": "C:\\d.exe"
            }
        ],
        "name": "creates_exe"
    }
]

from lib.cuckoo.common.exceptions import CuckooDetectionError

class Detection(object):
    """
    Base abstract class for detection module.
    """
    def set_options(self, options):
        """ Set report options."""
    def set_path(self, analysis_path):
        """Set paths."""
    def set_task(self, task):
        """Add task information."""
    def load_instance(self, results):
        """
        Initialize the sample instance and load the dictionary
        need a class Instance 
        """
    def run(self):
        """ Start detection."""
        raise NotImplementedError    

class MyDetection(Detection):
 		
    def load_features(self)
    	# 数据预处理
    def load_model(self):
      # 加载模型训练
    def run(self, Y)
    	# 预测目标值
      	return predict

class RunDetection(object):
	""" plugins.py """
       
    def __init__(self, task):
        # 初始化模型信息
        
    def process(self, module, results):
      	# 执行一个检测模块
        
    def run(self):
        # 执行所有结果检测模块，返回全局结果容器
        # 获得 detection 功能列表
        detection_list = cuckoo.detection.plugins
        
        for module in detection_list:
            # 执行功能
            model_name,predict = self.process(module, results)
            if model_name and predict:
                results[model_name] = predict
        return results

from lib.cuckoo.common.exceptions import CuckooDetectionError

class Adversarial(object):
    """
    Base abstract class for Adversarial module.
    """
    def set_options(self, options):
        """ Set report options."""
    def set_path(self, analysis_path):
        """Set paths."""
    def set_task(self, task):
        """Add task information."""
    def get_adversarial(self, results):
        """
        Initialize the sample instance and load the dictionary need a class Instance 
        """
        
    def run(self):
        """ Start Adversarial"""
        raise NotImplementedError    

class MyAdversarial(Detection):
 		
    def load_features(self)
    	# 数据预处理
    def load_model(self):
      # 加载模型训练
    def run(self, Y)
    	# 预测目标值
      	return predict

class RunAdversarial(object):
	""" plugins.py """
       
    def __init__(self, task):
        # 初始化模型信息
        
    def process(self, module, results):
      	# 执行一个检测模块
        
    def run(self):
        # 执行所有结果检测模块，返回全局结果容器
        # 获得 detection 功能列表
        detection_list = cuckoo.detection.plugins
        
        for module in detection_list:
            # 执行功能
            model_name,predict = self.process(module, results)
            if model_name and predict:
                results[model_name] = predict
        return results

from lib.cuckoo.common.abstracts import Report

class JsonDump(Report):

    def erase_calls(self, results):
        # 通过将调用替换为空列表，暂时从报表中删除
        
    def run(self, results)
        # 将report.json写入report文件夹

class MongoDB(Report):

    @classmethod
    def init_once(cls):
      	# 初始化mongo数据库

    def store_file(self, file_obj, filename=""):
        # 存储成 GridFS 文件格式.
 
    def run(self, results):
        # 创建词典的副本。这样做是为了不修改原始字典，并可能损害以下报告模块
        # 依次读取结果容器字段，并保存
        self.db.analysis.save(report)

class RunReporting(object):

    def __init__(self, task, results):
      	# 初始化任务、结果容器、任务目录
        
    def process(self, module):
       	# 执行一个生成功能模块
        # 初始化生成功能模块
        # 获得分析任务目录
    	  # 执行对应处理功能
        current.run(self.results)
    
    def run(self):
        #依次执行report模块jsondump,mongodb
        reporting_list = cuckoo.reporting.plugins
        
        for module in reporting_list:
            self.process(module)

mongo.connect()
DATABASES = {}
	#数据库连接
    
STATIC_URL = "/static/"
STATICFILES_DIRS = (
    ...#添加静态资源路径
)

SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
	#配置https
    
SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
SESSION_COOKIE_HTTPONLY = True
	#配置cookie
    
STATICFILES_FINDERS = (
	...#finder函数用来寻找静态文件
)

MIDDLEWARE_CLASSES = (
	...#配置中间件
)

ROOT_URLCONF = "web.urls"
	#配置路由路径
    
TEMPLATES = [
	...#配置模板文件路径
]

WSGI_APPLICATION = "web.wsgi.application"
	#注册WSGI服务
    
INSTALLED_APPS = (
	...#注册应用
)

urlpatterns = [
	...#自定义URL绑定视图函数
]

handler404 = web.errors.handler404
handler500 = web.errors.handler500
	#错误页面绑定自定义视图

"mongodb": {
    "enabled": Boolean(False),
    "host": String("127.0.0.1"),
    "port": Int(27017),
    "db": String("cuckoo"),
    "store_memdump": Boolean(True),
    "paginate": Int(100),
    "username": String(),
    "password": String(),
},

mongo.connect()

class Mongo(object):
    def init(self):
        #初始化
    def drop(self):
        #删除数据库表
    def close(self):
        #关闭数据库链接
    def connect(self):
        #连接数据库

db = Database()
	#数据库连接
	
class AnalysisApi(object):

    def tasks_list(request, body):
        #获取任务列表
    def task_info(request, task_id):
        #获取指定任务信息
	def task_delete(request, task_id):
        #删除指定任务
    def task_screenshots(request, task_id, screenshot=None):
        #获取指定任务截图
    def tasks_stats(request, body):
        #返回任务状态
    def tasks_recent(request, body):
        #返回最近任务
    ...