Cuckoo Permission Denied

[hackdefendr]

Cuckoo Permission Denied

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	9
Cortex Analyzer Name	CuckooSandbox
Cortex Analyzer Version	1.0
Cortex Version	1.1.4
Browser type & version	Chrome

Description

Every Cuckoo submission returns the below error. Other analyzers seem to run fine from the same folder.

{
"errorMessage": "Error: Invalid output\nsh: 1: ./cuckoosandbox_analyzer.py: Permission denied\n",
"input": null,
"success": false
}

Steps to Reproduce

1. Install Cortex
2. Install Cuckoo
3. Configure Cortex settings for Cuckoo
4. Run Cuckoo analysis (file or url)

[hackdefendr]

So just to test...I set my Cuckoo analyzer folder to 777. This seems to resolve the permission error, and now I get this:

{
"errorMessage": "Unexpected Error: Expecting value: line 2 column 1 (char 1)",
"input": {
"dataType": "url",
"config": {
"url": "http://10.71.1.5:8080",
"max_tlp": 1,
"check_tlp": true,
"service": "url_analysis"
},
"tlp": 0,
"data": "http://d2u6vujtbrga6l.cloudfront.net"
},
"success": false
}

[garanews]

Hi,
are you able to submit manually a file or an url to cuckoo using api? (http://docs.cuckoosandbox.org/en/latest/usage/api/)

curl -F file=@/home/cuckoo/xxx.exe http://localhost:8001/tasks/create/file
curl -F url="http://www.malicious.site" http://localhost:8001/tasks/create/url

[hackdefendr]

Is that for the Cuckoo API or the Cortex API?
Cuckoo works fine by itself.
I will try those commands when I get off work.

[garanews]

These are for speak with cuckoo.
From the machine where you run the cortex analyzer you should be able to submit a file/url to cuckoo using curl and pointing the api port of cuckoo.
On the cuckoo machine you have to be sure that api service is on, in ps aux | grep python you should see a row similar to this:
/usr/bin/python /usr/local/bin/cuckoo api --host 0.0.0.0 --port 8001

[garanews]

Can you provide any feedback?

[hackdefendr]

Yes I can submit files and urls via the Cuckoo API, but my API is not listening on port 8001.

[garanews]

In the /etc/cortex/application.conf you should set your cuckoo url with its api port whatever it is.

[hackdefendr]

I already have that configured.

This is beyond the basic stuff.

[saadkadhi]

@hackdefendr I'd advise getting in contact with @garanews on Gitter for troubleshooting the problem then summing up the results here. A GitHub issue is not well-suited for debugging in my opinion.

Thanks.