软件沙箱技术 – 安全分析沙箱Cuckoo Sandbox

1.Cockoo的功能

Cockoo Sandbox是开源安全沙箱，基于GPLv3。目的是恶意软件（malware analysis）分析。使用的时候将待分析文件丢到沙箱内，分析结束后输出报告。很多安全设备提供商所谓云沙箱是同类技术，一些所谓Anti-APT产品也是这个概念。和传统AV软件的静态分析相比，Cuckoo动态检测。扔到沙箱的可执行文件会被执行，文档会被打开，运行中检测。和不少开源软件学而优则仕一样，Cookoo搞了一个产品，Red Dragon。这种方式也是挺好的一种做开源软件的运营方式，Snort的SourceFire不就是被思科十几亿收购了吗。

 

Cuckoo它可以分析的内容有：

1.Windows可执行文件，DLL文件

2.PDF，MSOffice文档

3.URL和HTML文档

4.PHP脚本，VB脚本

5.CPL文件

6.ZIP文件，Jar文件

7.Python文件

可以看出，只是Windows平台，外加一些脚本和文件。

 

Cuckoo的分析结果包含如下内容：

1.函数以及API调用的Call Trace

2.应用拷贝和删除的文件

3.选定进程的内存镜像

4.分析机的full memory dump

5.恶意软件执行时的截屏

6.分析机产生的网络流量

 

2.部署和使用

 

下图是Cuckoo的部署，其实很简单，分为host和guests。

 

 

Host（管理机）

负责

管理guests

启动分析工作

网络流量收集等。

 

host依赖一些开源软件，例如

tcpdump用于Guest网络拦截

Volatility用于内存的dump

 

Guest（虚拟机）

Guest是通用的虚拟机，Xen、VirtualBox等。它运行Cuckoo的Agent，接收Host发过来的任务（文件）运行后获取信息。

Agent是跨平台的（就是Python脚本）可以运行在Windows、Linux和MAC OS上。它实际是是一个XMLRPC server，等待连接。

 

Cuckoo使用

Cuckoo提供了python命令行工具。

1.使用cuckoo.py启动引擎。

2.使用submit.py像cuckoo提交待分析应用。

3.引擎会和虚拟机中的Agent通信，运行应用。

4.分析结束后，结果输出到特定目录。

 

3.Hook引擎

 

cuckoo使用了通用虚拟机做Guest，本身也没有隔离机制和访问控制机制。它特殊的地方就是Hook机制。核心模块cuckoomon（Cuckoo Sandbox Monitor）的源码在这里。它的作用是Hook在可执行程序上，拦截执行流程。 形式上它是一个DLL，会被inject到待分析的恶意软件和它创建的所有进程中。所谓动态分析，就是Hook后的API，在线收集的运行时信息。主要有两个步骤：

 

3.1 DLL注入

注入是使用Python实现的，流程如下：

1.使用CreateProcess(CREATE SUSPENDED)启动应用

2.使用CreateRemoteThread和QueueUserAPC API调用LoadLibrary注入cuckoomon.dll。

3.Resume进程的主线程

 

参照下面代码

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108

class Process :     "" "Windows process." ""       def  inject ( self , dll = os . path . join ( "dll" , "cuckoomon.dll" ) , apc = False ) :         "" "Cuckoo DLL injection.        @param dll: Cuckoo DLL path.        @param apc: APC use.        " ""         if self . pid == 0 :             log . warning ( "No valid pid specified, injection aborted" )             return False           if not self . is_alive ( ) :             log . warning ( "The process with pid %d is not alive, injection "                         "aborted" % self . pid )             return False           dll = randomize_dll ( dll )           if not dll  or not os . path . exists ( dll ) :             log . warning ( "No valid DLL specified to be injected in process "                         "with pid %d, injection aborted" % self . pid )             return False           arg = KERNEL32 . VirtualAllocEx ( self . h_process ,                                       None ,                                       len ( dll ) + 1 ,                                       MEM_RESERVE | MEM_COMMIT ,                                       PAGE_READWRITE )           if not arg :             log . error ( "VirtualAllocEx failed when injecting process with "                       "pid %d, injection aborted (Error: %s)"                       % ( self . pid , get_error_string ( KERNEL32 . GetLastError ( ) ) ) )             return False           bytes_written = c_int ( 0 )         if not KERNEL32 . WriteProcessMemory ( self . h_process ,                                            arg ,                                            dll + "\x00" ,                                            len ( dll ) + 1 ,                                            byref ( bytes_written ) ) :             log . error ( "WriteProcessMemory failed when injecting process "                       "with pid %d, injection aborted (Error: %s)"                       % ( self . pid , get_error_string ( KERNEL32 . GetLastError ( ) ) ) )             return False           kernel32_handle = KERNEL32 . GetModuleHandleA ( "kernel32.dll" )         load_library = KERNEL32 . GetProcAddress ( kernel32_handle ,                                                "LoadLibraryA" )           config_path = os . path . join ( os . getenv ( "TEMP" ) , "%s.ini" % self . pid )         with  open ( config_path , "w" ) as config :             cfg = Config ( "analysis.conf" )               config . write ( "host-ip={0}\n" . format ( cfg . ip ) )             config . write ( "host-port={0}\n" . format ( cfg . port ) )             config . write ( "pipe={0}\n" . format ( PIPE ) )             config . write ( "results={0}\n" . format ( PATHS [ "root" ] ) )             config . write ( "analyzer={0}\n" . format ( os . getcwd ( ) ) )             config . write ( "first-process={0}\n" . format ( Process . first_process ) )               Process . first_process = False           if apc  or self . suspended :             log . info ( "Using QueueUserAPC injection" )             if not self . h_thread :                 log . info ( "No valid thread handle specified for injecting "                          "process with pid %d, injection aborted" % self . pid )                 return False               if not KERNEL32 . QueueUserAPC ( load_library , self . h_thread , arg ) :                 log . error ( "QueueUserAPC failed when injecting process "                           "with pid %d (Error: %s)"                           % ( self . pid ,                              get_error_string ( KERNEL32 . GetLastError ( ) ) ) )                 return False             log . info ( "Successfully injected process with pid %d" % self . pid )         else :             event_name = "CuckooEvent%d" % self . pid             self . event_handle = KERNEL32 . CreateEventA ( None ,                                                       False ,                                                       False ,                                                       event_name )             if not self . event_handle :                 log . warning ( "Unable to create notify event.." )                 return False               log . info ( "Using CreateRemoteThread injection" )             new_thread_id = c_ulong ( 0 )             thread_handle = KERNEL32 . CreateRemoteThread ( self . h_process ,                                                         None ,                                                         0 ,                                                         load_library ,                                                         arg ,                                                         0 ,                                                         byref ( new_thread_id ) )             if not thread_handle :                 log . error ( "CreateRemoteThread failed when injecting " +                     "process with pid %d (Error: %s)" % ( self . pid ,                     get_error_string ( KERNEL32 . GetLastError ( ) ) ) )                 KERNEL32 . CloseHandle ( self . event_handle )                 self . event_handle = None                 return False             else :                 KERNEL32 . CloseHandle ( thread_handle )           return True

 

 

3.2 API Hook

 

1.上一步中主线程恢复后，因为APC callback，Cuckoo Monitor首先被执行。

2.初始化并且安装Hook

Cuckoo对ntdll.dll, kernel32.dll, advapi32.dll，shell32.dll，msvcrt.dll，user32.dll，wininet.dll，ws2_32.dll，mswsock.dll中的170+API进行hook

3.通知分析模块Analyzer（通过命名管道），应用启动。

4.Log将会通过实现配置好的TCP/IP端口发送给Host。

 

下面是添加Hook的代码：

int hook_api(hook_t *h, int type) { // table with all possible hooking types static struct { int(*hook)(hook_t *h, unsigned char *from, unsigned char *to); int len; } hook_types[] = { /* HOOK_JMP_DIRECT */ {&hook_api_jmp_direct, 5}, /* HOOK_NOP_JMP_DIRECT */ {&hook_api_nop_jmp_direct, 6}, /* HOOK_HOTPATCH_JMP_DIRECT */ {&hook_api_hotpatch_jmp_direct, 7}, /* HOOK_PUSH_RETN */ {&hook_api_push_retn, 6}, /* HOOK_NOP_PUSH_RETN */ {&hook_api_nop_push_retn, 7}, /* HOOK_JMP_INDIRECT */ {&hook_api_jmp_indirect, 6}, /* HOOK_MOV_EAX_JMP_EAX */ {&hook_api_mov_eax_jmp_eax, 7}, /* HOOK_MOV_EAX_PUSH_RETN */ {&hook_api_mov_eax_push_retn, 7}, /* HOOK_MOV_EAX_INDIRECT_JMP_EAX */ {&hook_api_mov_eax_indirect_jmp_eax, 7}, /* HOOK_MOV_EAX_INDIRECT_PUSH_RETN */ {&hook_api_mov_eax_indirect_push_retn, 7}, #if HOOK_ENABLE_FPU /* HOOK_PUSH_FPU_RETN */ {&hook_api_push_fpu_retn, 11}, #endif /* HOOK_SPECIAL_JMP */ {&hook_api_special_jmp, 7}, }; // is this address already hooked? if(h->is_hooked != 0) { return 0; } // resolve the address to hook unsigned char *addr = h->addr; if(addr == NULL && h->library != NULL && h->funcname != NULL) { addr = (unsigned char *) GetProcAddress(GetModuleHandleW(h->library), h->funcname); } if(addr == NULL) { return -1; } int ret = -1; // check if this is a valid hook type if(type >= 0 && type < ARRAYSIZE(hook_types)) { // determine whether we're running under win7, if so, we might have to // follow a short relative jmp and an indirect jump before reaching // the real address OSVERSIONINFO os_info = {sizeof(OSVERSIONINFO)}; if(GetVersionEx(&os_info) && os_info.dwMajorVersion == 6 && os_info.dwMinorVersion == 1) { // windows 7 has a DLL called kernelbase.dll which basically acts // as a layer between the program and kernel32 (and related?) it // allows easy hotpatching of a set of functions which is why // there's a short relative jump and an indirect jump. we want to // resolve the address of the real function, so we follow these // two jumps. if(!memcmp(addr, "\xeb\x05", 2) && !memcmp(addr + 7, "\xff\x25", 2)) { addr = **(unsigned char ***)(addr + 9); } // the following applies for "inlined" functions on windows 7, // some functions are inlined into kernelbase.dll, rather than // kernelbase.dll jumping to e.g. kernel32.dll. for these // functions there is a short relative jump, followed by the // inlined function. if(!memcmp(addr, "\xeb\x02", 2) && !memcmp(addr - 5, "\xcc\xcc\xcc\xcc\xcc", 5)) { // step over the short jump and the relative offset addr += 4; } } DWORD old_protect; // make the address writable if(VirtualProtect(addr, hook_types[type].len, PAGE_EXECUTE_READWRITE, &old_protect)) { if(hook_create_trampoline(addr, hook_types[type].len, h->tramp)) { hook_store_exception_info(h); uint8_t special = 0; if(h->allow_hook_recursion == 1) { special = 1; } hook_create_pre_tramp(h, special); // insert the hook (jump from the api to the // pre-trampoline) ret = hook_types[type].hook(h, addr, h->pre_tramp); // if successful, assign the trampoline address to *old_func if(ret == 0) { *h->old_func = h->tramp; // successful hook is successful h->is_hooked = 1; } } // restore the old protection VirtualProtect(addr, hook_types[type].len, old_protect, &old_protect); } } return ret; }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114

int hook_api ( hook_t * h , int type ) {      // table with all possible hooking types      static struct {          int ( * hook ) ( hook_t * h , unsigned char * from , unsigned char * to ) ;          int len ;      } hook_types [ ] = {          /* HOOK_JMP_DIRECT */ { & hook_api_jmp_direct , 5 } ,          /* HOOK_NOP_JMP_DIRECT */ { & hook_api_nop_jmp_direct , 6 } ,          /* HOOK_HOTPATCH_JMP_DIRECT */ { & hook_api_hotpatch_jmp_direct , 7 } ,          /* HOOK_PUSH_RETN */ { & hook_api_push_retn , 6 } ,          /* HOOK_NOP_PUSH_RETN */ { & hook_api_nop_push_retn , 7 } ,          /* HOOK_JMP_INDIRECT */ { & hook_api_jmp_indirect , 6 } ,          /* HOOK_MOV_EAX_JMP_EAX */ { & hook_api_mov_eax_jmp_eax , 7 } ,          /* HOOK_MOV_EAX_PUSH_RETN */ { & hook_api_mov_eax_push_retn , 7 } ,          /* HOOK_MOV_EAX_INDIRECT_JMP_EAX */              { & hook_api_mov_eax_indirect_jmp_eax , 7 } ,          /* HOOK_MOV_EAX_INDIRECT_PUSH_RETN */              { & hook_api_mov_eax_indirect_push_retn , 7 } , #if HOOK_ENABLE_FPU          /* HOOK_PUSH_FPU_RETN */ { & hook_api_push_fpu_retn , 11 } , #endif          /* HOOK_SPECIAL_JMP */ { & hook_api_special_jmp , 7 } ,      } ;        // is this address already hooked?      if ( h -> is_hooked != 0 ) {          return 0 ;      }        // resolve the address to hook      unsigned char * addr = h -> addr ;        if ( addr == NULL && h -> library != NULL && h -> funcname != NULL ) {          addr = ( unsigned char * ) GetProcAddress ( GetModuleHandleW ( h -> library ) ,              h -> funcname ) ;      }      if ( addr == NULL ) {          return - 1 ;      }        int ret = - 1 ;        // check if this is a valid hook type      if ( type >= 0 && type < ARRAYSIZE ( hook_types ) ) {            // determine whether we're running under win7, if so, we might have to          // follow a short relative jmp and an indirect jump before reaching          // the real address          OSVERSIONINFO  os_info = { sizeof ( OSVERSIONINFO ) } ;          if ( GetVersionEx ( & os_info ) && os_info . dwMajorVersion == 6 &&                  os_info . dwMinorVersion == 1 ) {              // windows 7 has a DLL called kernelbase.dll which basically acts              // as a layer between the program and kernel32 (and related?) it              // allows easy hotpatching of a set of functions which is why              // there's a short relative jump and an indirect jump. we want to              // resolve the address of the real function, so we follow these              // two jumps.              if ( ! memcmp ( addr , "\xeb\x05" , 2 ) &&                      ! memcmp ( addr + 7 , "\xff\x25" , 2 ) ) {                  addr = * * ( unsigned char * * * ) ( addr + 9 ) ;              }                // the following applies for "inlined" functions on windows 7,              // some functions are inlined into kernelbase.dll, rather than              // kernelbase.dll jumping to e.g. kernel32.dll. for these              // functions there is a short relative jump, followed by the              // inlined function.              if ( ! memcmp ( addr , "\xeb\x02" , 2 ) &&                      ! memcmp ( addr - 5 , "\xcc\xcc\xcc\xcc\xcc" , 5 ) ) {                  // step over the short jump and the relative offset                  addr += 4 ;              }          }            DWORD  old_protect ;            // make the address writable          if ( VirtualProtect ( addr , hook_types [ type ] . len , PAGE_EXECUTE_READWRITE ,                  & old_protect ) ) {                if ( hook_create_trampoline ( addr , hook_types [ type ] . len , h -> tramp ) ) {                    hook_store_exception_info ( h ) ;                    uint8_t  special = 0 ;                    if ( h -> allow_hook_recursion == 1 ) {                      special = 1 ;                  }                    hook_create_pre_tramp ( h , special ) ;                    // insert the hook (jump from the api to the                  // pre-trampoline)                  ret = hook_types [ type ] . hook ( h , addr , h -> pre_tramp ) ;                    // if successful, assign the trampoline address to *old_func                  if ( ret == 0 ) {                      * h -> old_func = h -> tramp ;                        // successful hook is successful                      h -> is_hooked = 1 ;                  }              }                // restore the old protection              VirtualProtect ( addr , hook_types [ type ] . len , old_protect ,                  & old_protect ) ;          }      }        return ret ; }

 

 

4.躲避的应对

前面软件加壳技术介绍的时候有部分内容关于躲避。恶意软件会创建自进程，在子进程中做实际工作。对于类似Cuckoo这样的动态分析工具就要处理这种情况，在子进程中启动cuckoomon。下图就是应对流程，Monitor在监控到样本创建进程的时候，也会模拟初始化启动时候cuckoo做的事情，显示suspend，然后通知Analyzer。由后者进行DLL的注入。

From 【5】

 

前文也介绍过进程注入，也就是恶意软件利用周知进程，例如IE，运行自己的恶意逻辑，解决的方法类似。只是监控的不是CreateProcess而是OpenProcess。

 

【参考】

1.官方网站，http://www.cuckoosandbox.org/

2.Cuckoo Sandbox Book，http://cuckoo.readthedocs.org/en/latest/

3.Hooking functions with Cuckoobox’s hooking engine，http://living-security.blogspot.com/2014/07/hooking-functions-with-cuckooboxs.html

4.开源软件 cuckoo sandbox学习(二) 核心拦截模块源代码导读, http://sevemal.blog.51cto.com/8627322/1397666

5.Haow Sandbox, Cuckoo Sandbox Internal, http://recon.cx/2013/slides/recon2013-Jurriaan%20Bremer-Haow%20do%20I%20sandbox.pdf