Skip to content

Commit

Permalink
Update docs
Browse files Browse the repository at this point in the history
  • Loading branch information
amadisson committed Feb 8, 2024
1 parent 775051d commit 2ad90da
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 12 deletions.
6 changes: 3 additions & 3 deletions docs/src/configuration/system.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@ This page contains settings/changes that need to be made to system (packages) be

!!! info "Assumptions"
- All commands on this page assume you are running Cuckoo under the 'cuckoo' user.
- The assumed operating system is Ubuntu 18.04 or higher.
- The assumed operating system is Ubuntu 22.04 or higher.

### Tcpdump

Tcpdump requires root privileges, but Cuckoo should never run as root. This means you will have to
Tcpdump requires root privileges, but Cuckoo should never run as root. This means you will have to
set specific Linux capabilities to the binary.

1. Adding the Cuckoo user to the pcap group.
Expand All @@ -26,7 +26,7 @@ sudo chgrp pcap /usr/sbin/tcpdump
If the system has other (potentially untrusted) users. We recommend to run Cuckoo on a dedicated system or a trusted environment where the privileged tcpdump execution is contained otherwise.


The `setcap` tool is part of the `libcap2-bin` package.
The `setcap` tool is part of the `libcap2-bin` package.
```bash
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
```
Expand Down
2 changes: 1 addition & 1 deletion docs/src/installation/cuckoo.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ The following steps are for a normal/generic Cuckoo setup. This is the type of s

**2. Installing Cuckoo 3 from a delivery archive.**

2.1 Create and activate a new Python >=3.8 virtualenv
2.1 Create and activate a new Python >=3.10 virtualenv

2.2 Navigate to the `$A/cuckoo/cuckoo3` directory and run install.sh

Expand Down
16 changes: 8 additions & 8 deletions docs/src/installation/vmcreation.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,14 +53,14 @@ name of the snapshot to use in the machinery configuration for the machine.
#### Threemon (default)

Threemon is a kernel driver. Windows must be patched so that the stager (Tmstage) can actually load
the monitor before the sample detonation occurs.
the monitor before the sample detonation occurs.

Threemon supports Windows 7 and 10 versions:

- Windows 7 with SP1. Build 1706 ([link](https://hatching.dev/hatchvm/win7ultimate.iso))
- Windows 10. Build 1703 ([link](https://hatching.dev/hatchvm/Win10_1703_English_x64.iso))
- Windows 7 with SP1. Build 1706 ([link](https://cuckoo-hatch.cert.ee/static/vm/win7ultimate.iso))
- Windows 10. Build 1703 ([link](https://cuckoo-hatch.cert.ee/static/vm/Win10_1703_English_x64.iso))

Download the patch tool [here](https://hatching.dev/hatchvm/patchandgo_amd64.exe)
Download the patch tool [here](https://cuckoo-hatch.cert.ee/static/vm/patchandgo_amd64.exe)

Only perform these steps after all software has been installed. This should be the last step before
making snapshots.
Expand Down Expand Up @@ -136,7 +136,7 @@ removed when using the machinery module. Each entry consists of the following:
* Machine tags is a list of strings that are used to identify installed software/particular settings inside a vm. If .NET framework or Adobe PDF reader is installed, the tags should be: `dotnet` and `pdfreader`.
* To populate the 'supported browser' list in the web UI or API, one or more machines with `browser_browsername` tags must exist. These tags are automatically translated to a list of browsers. Use `_` instead of spaces. An example would be
`browser_internet_explorer`.

* The tags are used by Cuckoo to find a machine that can detonate a submitted sample. The file identification stage of Cuckoo determines what dependencies are needed for specific file types. These dependency names are tied to tag names. This mapping can be found in `$CWD/conf/processing/identification.yaml`. Automated file dependency tag assigning only occurs if it is enabled in `$CWD/conf/cuckoo.yaml`.

#### Machine adding command
Expand All @@ -161,7 +161,7 @@ Options:

```

As an example, suppose we want to add a QEMU Windows 10 VM called win10x64_1 and has the IP 192.168.30.101.
As an example, suppose we want to add a QEMU Windows 10 VM called win10x64_1 and has the IP 192.168.30.101.
We will also assume it has .NET and Adobe pdf reader installed and add the tags for those.
We can add this machine using the following command:

Expand Down Expand Up @@ -244,7 +244,7 @@ This is located in at `VMCLOAK_CWD/vms/`. If we made the machines for qemu, they

The helper tool we can use to import machine is: `cuckoo machine import`.
The tool will write a new entry to the machines dictionary of the specific machinery module for each
discovered machine in the VMCloak vms machinery directory.
discovered machine in the VMCloak vms machinery directory.

The help output looks as follows:

Expand All @@ -262,4 +262,4 @@ We can run the following command to import all the machines.

```bash
cuckoo machine import qemu /home/cuckoo/.vmcloak/vms/qemu
```
```

0 comments on commit 2ad90da

Please sign in to comment.