BoomBox - Automatic deployment of Cuckoo Sandbox malware lab

项目说明

!BoomBox

BoomBox

![GitHub Release Date]()
![Latest GitHub release]()

BoomBox is designed for malware analysts and incident responders. It allows for the rapid deployment of a dynamic malware analysis en using Cuckoo Sandbox and a Windows 10 detonation chamber. Cuckoo is configured to use the physical machinery so that both Cuckoo and the Windows sandbox can be machines on a single host.

Features

* Inetsim network simulation
* Cuckoo community modules
* Clean base snapshot of the Windows en is taken as part of the build process
* Chocolatey package manager for Windows used to install Adobe Reader, Flash, Chrome, and Firefox.
* NOTE: Microsoft Office has not been included due to licensing. If you have a license key, you can install Office and take a new clean base snapshot.

Requirements

* 20GB+ of free disk space
* 6GB+ of RAM
* Packer
*
*

Quickstart

BoomBox includes a single build script for Linux, macOS, and Windows. This script will build and configure the Windows 10 and Cuckoo machines from the ground up using Packer and . The entire build process for BoomBox takes around 30-60 minutes.

Linux/macOS

./build.sh - Build BoomBox from scratch.

./build.sh -- - Build BoomBox using pre-built Packer boxes hosted on Cloud. This option is faster than building BoomBox from scratch.

./build.sh --packer-only - This will only build the .Box files and will not build the .

Windows

./build.ps1 -Pro - Build BoomBox from scratch.

./build.ps1 -Pro - - Build BoomBox using pre-built Packer boxes hosted on Cloud. This option is faster than building BoomBox from scratch.

/.build.ps1 -Pro -PackerOnly - This will only build the .Box files and will not build the .

Manually Building BoomBox

1. Build the Windows sandbox using Packer

2. Move the resulting .box file into the Boxes directory

m.box ../Boxes

3. cd ../ and inside the change cfg.vm.box = "boomboxes/sandbox" to cfg.vm.box = ../Boxes/sandbox_.box

4. Install the plugin

plugin install

5. Run the ./build.sh for Linux/macOS or ./build.ps1 for Windows from the project root directory

6. Logs from the build process are located in the directory as <host>.log

Basic Usage

commands must be run from the "" folder.

* Bring up all BoomBox hosts: up
* Bring up a specific host: up <hostname>
* Restart a specific host: reload <hostname>
* Restart a specific host and re-run the pro process: reload <hostname> --pro
* Destroy a specific host destroy <hostname>
* Destroy the entire BoomBox en: destroy (Adding -f forces it without a prompt)
* SSH into a host: ssh cuckoo
* Check the status of each host: status
* Suspend the en: suspend
* Resume the en: resume

Lab Information

* Cuckoo Web Server: - :
* NIC1 attached to NAT
* NIC2 attached to Host-only Adapter
* Windows Sandbox: 192.168.30.101
* NIC1 attached to Host-only Adapter

Snapshots

There are revert.ps1 and revert.sh scripts that are to be used to restore a clean of the Windows sandbox. This script will need to be run after each submission to Cuckoo to ensure a consistent detonation en. This is a temporarily solution until there is a good way to have this done automatically after each detonation.

Todo

[ ] Sandbox anti-e techniques

[ ] Impro scripts to not rely on sleep

[ ] Revert sandbox to clean snapshot on reboot

[ ] Support additional pro

Contributing

Check out CONTRIBUTING.md for details on submitting a pull request.

Credits

The majority of this project was directly borrowed from Chris Long's DetectionLab, which is an incredible resource for defenders looking to build a Windows lab.

项目信息

开发语言：PowerShell

Star 数：240

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。