Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pip packaging #5

Merged
merged 22 commits into from
Jul 15, 2016
Merged
Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
4022c9c
moved doc/ to docs/ following python convention
obilodeau Jul 6, 2016
592a67d
Clarified documentation licensing (CC-BY-SA 4.0)
obilodeau Jul 6, 2016
63343c2
pip: all mandatory files are present under site-package/
obilodeau Jul 6, 2016
0e65093
Docs: How to do development while using installed malboxes
obilodeau Jul 12, 2016
b09a1e5
pip package: First conversion to pkg_resource to see if it's ok with git
obilodeau Jul 12, 2016
e7d6b61
Missing space in help string
obilodeau Jul 13, 2016
b40f286
README: consistency fixes
obilodeau Jul 13, 2016
e690cf2
build and spin are now using default system paths for all platforms
obilodeau Jul 13, 2016
81f80c3
Added generated documentation to .gitignore
obilodeau Jul 13, 2016
3d1edba
converted customization commands to user config directory
obilodeau Jul 13, 2016
e6509a1
cherry-picked fix for #3: 0e0255f
obilodeau Jul 13, 2016
226926c
TODO / Doc misc updates
obilodeau Jul 13, 2016
840b287
Win 10 x86: Turns out image name is different between x86 and x64 (fi…
obilodeau Jul 13, 2016
2dbbec4
End-to-end VM generation works now
obilodeau Jul 13, 2016
1cd5719
A more portable way to detect packer binary (requires python 3.3)
obilodeau Jul 13, 2016
02fc4c8
review: Doc fix
obilodeau Jul 14, 2016
98c8401
Brought the branch forward to make merge pass
obilodeau Jul 14, 2016
7849387
doc: specify pip version on cli
obilodeau Jul 14, 2016
67a49b5
Pushed out version so we can pip install even w/o deps
obilodeau Jul 14, 2016
2fd51ef
prevent package from loading all dependencies unless called from cli
obilodeau Jul 14, 2016
129898c
Recursively make config / cache directories
obilodeau Jul 14, 2016
b1f2bc1
Windows install documentation: both manually and through chocolatey
obilodeau Jul 15, 2016
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,15 @@ builds/
# Python
__pycache__/

# Python pip/setuptools packaging
build/
dist/
*.egg-info/

# Generic
*~
*.swp

# Documentation artifacts
README.html
docs/*.html
2 changes: 0 additions & 2 deletions .travis.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
language: python
python:
# disabled since pylint is currently broken on 3.2
#- "3.2"
- "3.3"
- "3.4"
- "3.5"
Expand Down
7 changes: 7 additions & 0 deletions MANIFEST.in
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
include LICENSE README.adoc TODO.adoc

# Include the data files
include config-example.json
graft docs
prune docs/presentation/
graft malboxes
5 changes: 4 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,2 +1,5 @@
test:
pylint malboxes.py
pylint malboxes

pkg_clean:
rm -r build/ dist/ malboxes.egg-info/
55 changes: 40 additions & 15 deletions README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -20,33 +20,46 @@ https://github.com/gosecure/malboxes

== Requirements

* Python 3
* Python 3.3+
* appdirs
* jinja2
* packer (sometimes called packer-io)
* vagrant
* packer: https://www.packer.io/intro/getting-started/setup.html
* vagrant: https://www.vagrantup.com/downloads.html

== Installation

sudo pip install git+https://github.com/GoSecure/malboxes.git@pip-packaging#egg=malboxes
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tried that with a machine that didn't have the dependencies ? It doesn't work for me and the traceback indicates that it cannot import appdirs (so that should be the same for all our dependencies) because __version__ is imported from __init__.py which tries to import the dependencies. I got the same from my server too. Also, if we are py3, shouldn't that be pip3 since pip defaults to pip2 in lots of distros (pip --version points to py2.7 for both of the machines I tested on) ? Official docs doesn't seem to discourage hardcoding the version so couldn't we do that ? Django does something interesting that doesn't involve hardcoding so that would be an option too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point for pip3! I use arch so pip is a symlink to pip3 but you are right about most distro being pip -> pip2.


== Usage

=== Box creation

Copy `config-example.json` to `config.json`. Modify it and run:
Run:

./malboxes.py build <profile>
malboxes build <profile>

You can also list all supported profiles with:

./malboxes.py list
malboxes list

This will build a Vagrant box ready for malware investigation you can now
include it in a Vagrantfile afterwards.

For example:

./malboxes.py build win10_64_analyst
malboxes build win10_64_analyst

If you want to customize your configuration, look at the following location
for a `config.json` file:

* Linux/Unix: `~/.config/malboxes/`
* Mac OS X: `~/Library/Application Support/malboxes/`
* Win 7+: `C:\Users\<username>\AppData\Local\malboxes\malboxes\`


=== Per analysis instances

./malboxes.py spin win10_64_analyst <name>
malboxes spin win10_64_analyst <name>

This will create a `Vagrantfile` prepared to use for malware analysis. Move it
into the analysis folder of your choice and issue:
Expand All @@ -59,7 +72,7 @@ shared in the VM. This can be changed by commenting the relevant part of the

For example:

./malboxes.py spin win7_32_analyst 20160519.cryptolocker.xyz
malboxes spin win7_32_analyst 20160519.cryptolocker.xyz

// FIXME

Expand All @@ -69,21 +82,27 @@ You can modify (add, modify or delete) registry keys, directories and files like

Registry keys:

./malboxes.py registry profile modtype key name value valuetype
malboxes registry <profile> <modtype> <key name> <value> <valuetype>

Ex: ./malboxes registry win10_64_analyst add HKCU:\Software Malboxes IsAwesome String
Example:

malboxes registry win10_64_analyst add HKCU:\Software "Malboxes IsAwesome" String
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure that this isn't the same thing. The first modifies HKCU:\Sofware's Malboxes key with the value IsAwesome as a String. I'm not sure about the behaviour of the second one since we do not provide a value for the "Malboxes IsAwesome" key.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.


Directories and files:

./malboxes.py directory profile modtype dirpath
malboxes directory <profile> <modtype> <dirpath>

Example:

Ex: ./malboxes.py directory BadAPT57 delete C:\Windows\System32
malboxes directory BadAPT57 delete C:\Windows\System32

You can add packages to install that are specific to the profile:

./malboxes.py package profile package
malboxes package <profile> <package>

Example:

Ex: ./malboxes.py package RansomwareThatINeedRevengeOn chrome
malboxes package RansomwareThatINeedRevengeOn chrome

== More information

Expand All @@ -99,6 +118,12 @@ by link:{twob}[Olivier Bilodeau] and link:{twhg}[Hugo Genesse]
(PDF, degraded)
* Video (coming soon)

== License

Code is licensed under the GPLv3+, see `LICENSE` for details. Documentation
and presentation material is licensed under the Creative Commons
Attribution-ShareAlike 4.0, see `docs/LICENSE` for details.

== Credits

After I had the idea for an improved malware analyst workflow based on what
Expand Down
6 changes: 6 additions & 0 deletions TODO.adoc
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
= TODO

== pip packaging

* where should the built boxes go?

== Misc

* Make work with trial ISOs

== Minimal malware analyst use case
Expand Down
2 changes: 1 addition & 1 deletion config-example.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"iso_path": "/path/to/your/windows/isos/",
"_comment": "If using a registered product update the product_key and set trial to 'false'.",
"_comment": "See doc/windows-licenses.adoc for more information.",
"_comment": "See docs/windows-licenses.adoc for more information.",
"trial": "true",
"product_key": "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
"username": "vagrant",
Expand Down
File renamed without changes.
1 change: 1 addition & 0 deletions docs/LICENSE
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
TODO: https://creativecommons.org/licenses/by-sa/4.0/
7 changes: 7 additions & 0 deletions docs/devel.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
= Development guide

== Install malboxes in development mode

From the project's git repository root directory, execute:

sudo pip install -e . --no-deps
File renamed without changes.
Loading