diff --git a/conf/default/processing.conf.default b/conf/default/processing.conf.default index 686a3d17639..ca0c448bca6 100644 --- a/conf/default/processing.conf.default +++ b/conf/default/processing.conf.default @@ -53,6 +53,8 @@ ram_boost = no # https://capev2.readthedocs.io/en/latest/usage/patterns_replacement.html replace_patterns = no file_activities = no +# Get network details from behavior +network_map = no # process behavior files in ram to speedup processing a little bit? ram_mmap = no diff --git a/data/html/generic/_network_dns.html b/data/html/generic/_network_dns.html index 27447f6175b..643e60e5653 100644 --- a/data/html/generic/_network_dns.html +++ b/data/html/generic/_network_dns.html @@ -3,10 +3,11 @@ Name Response + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for dns in results.network.dns %} - {{dns.request}} + {{dns.request}} {% if dns.source == "behavior" %}behavior{% endif %} {% for a in dns.answers %} {{a.type}} {{a.data}} @@ -15,6 +16,15 @@ {% endif %} {% endfor %} + {% if results.network_proc_map %} + + {% if dns.process_name %} + {{ dns.process_name }}{% if dns.process_id %} ({{ dns.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_hosts.html b/data/html/generic/_network_hosts.html index a78367417a3..8034037e310 100644 --- a/data/html/generic/_network_hosts.html +++ b/data/html/generic/_network_hosts.html @@ -4,6 +4,7 @@ Direct IP Address Country Name + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for host in results.network.hosts %} {% if host.ip[:7] != "192.168" %} @@ -18,6 +19,15 @@ {% endif %} {{host.ip}} {{host.country_name}} + {% if results.network_proc_map %} + + {% if host.process_name %} + {{ host.process_name }}{% if host.process_id %} ({{ host.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endif %} {% endfor %} diff --git a/data/html/generic/_network_http.html b/data/html/generic/_network_http.html index 34ebad884e5..062615210cd 100644 --- a/data/html/generic/_network_http.html +++ b/data/html/generic/_network_http.html @@ -3,6 +3,7 @@ URI Details + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for http in (results.network.http_ex|list + results.network.https_ex|list) %} @@ -43,6 +44,15 @@ + {% if results.network_proc_map %} + + {% if http.process_name %} + {{ http.process_name }}{% if http.process_id %} ({{ http.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} @@ -51,11 +61,21 @@ URI Data + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for request in results.network.http %} - {{request.uri}} + {{request.uri}} {% if request.source == "behavior" %}behavior{% endif %} 
{{request.data}}
+ {% if results.network_proc_map %} + + {% if request.process_name %} + {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_icmp.html b/data/html/generic/_network_icmp.html index bb70eaeaf59..f550f39dfd8 100644 --- a/data/html/generic/_network_icmp.html +++ b/data/html/generic/_network_icmp.html @@ -5,13 +5,23 @@ Destination ICMP Type Data + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for icmp in results.network.icmp %} - {{icmp.src}} + {{icmp.src}} {% if icmp.source == "behavior" %}behavior{% endif %} {{icmp.dst}} {{icmp.type}} 
{{icmp.data}}
 + {% if results.network_proc_map %} + + {% if icmp.process_name %} + {{ icmp.process_name }}{% if icmp.process_id %} ({{ icmp.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_irc.html b/data/html/generic/_network_irc.html index b3557bac111..033f3c0f509 100644 --- a/data/html/generic/_network_irc.html +++ b/data/html/generic/_network_irc.html @@ -4,12 +4,22 @@ Command Params Type + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for irc in results.network.irc %} - {{irc.command}} + {{irc.command}} {% if irc.source == "behavior" %}behavior{% endif %} 
{{irc.params}}
 
{{irc.type}}
 + {% if results.network_proc_map %} + + {% if irc.process_name %} + {{ irc.process_name }}{% if irc.process_id %} ({{ irc.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_smtp.html b/data/html/generic/_network_smtp.html index bb57d0ff0e5..4b8e78ae52d 100644 --- a/data/html/generic/_network_smtp.html +++ b/data/html/generic/_network_smtp.html @@ -3,11 +3,21 @@ Destination Data + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for smtp in results.network.smtp %} - {{smtp.dst}} + {{smtp.dst}} {% if smtp.source == "behavior" %}behavior{% endif %} 
{{smtp.raw}}
 + {% if results.network_proc_map %} + + {% if smtp.process_name %} + {{ smtp.process_name }}{% if smtp.process_id %} ({{ smtp.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_tcp.html b/data/html/generic/_network_tcp.html index e5d7fbd2f9d..6b4cd86d544 100644 --- a/data/html/generic/_network_tcp.html +++ b/data/html/generic/_network_tcp.html @@ -3,11 +3,21 @@ IP Address Port + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for conn in results.network.tcp %} - {{conn.dst}} + {{conn.dst}} {% if conn.source == "behavior" %}behavior{% endif %} {{conn.dport}} + {% if results.network_proc_map %} + + {% if conn.process_name %} + {{ conn.process_name }}{% if conn.process_id %} ({{ conn.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/data/html/generic/_network_udp.html b/data/html/generic/_network_udp.html index 3bc9d9ca203..90f27451848 100644 --- a/data/html/generic/_network_udp.html +++ b/data/html/generic/_network_udp.html @@ -3,11 +3,21 @@ IP Address Port + {% if results.network_proc_map %}Process Name (PID){% endif %} {% for conn in results.network.udp %} - {{conn.dst}} + {{conn.dst}} {% if conn.source == "behavior" %}behavior{% endif %} {{conn.dport}} + {% if results.network_proc_map %} + + {% if conn.process_name %} + {{ conn.process_name }}{% if conn.process_id %} ({{ conn.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} {% endfor %} diff --git a/lib/cuckoo/core/analysis_manager.py b/lib/cuckoo/core/analysis_manager.py index 7aab04cad40..808db42b640 100644 --- a/lib/cuckoo/core/analysis_manager.py +++ b/lib/cuckoo/core/analysis_manager.py @@ -544,7 +544,7 @@ def route_network(self): elif self.route == "internet" and routing.routing.internet != "none": self.interface = routing.routing.internet self.rt_table = routing.routing.rt_table - self.no_local_routing = routing.routing.no_local_routing + self.no_local_routing = routing.routing.no_local_routing and not routing.routing.nat if routing.routing.reject_segments != "none": self.reject_segments = routing.routing.reject_segments if routing.routing.reject_hostports != "none": diff --git a/modules/processing/behavior.py b/modules/processing/behavior.py index 98c5343d485..be600fce5e5 100644 --- a/modules/processing/behavior.py +++ b/modules/processing/behavior.py @@ -1268,10 +1268,12 @@ def event_apicall(self, call, process): _add_http_host(self.http_host_map, host, pinfo, sock=sock) if api in HTTP_HINT_APIS: - url = _get_arg_any(args_map, "URL", "url", "lpszUrl", "lpUrl", "uri", "pszUrl", "pUrl") + url = _get_arg_any(args_map, "URL", "Url", "url", "lpszUrl", "lpUrl", "uri", "pszUrl", "pUrl") if isinstance(url, str) and url.strip(): u = _extract_first_url(url) or url.strip() host = _host_from_url(u) + if not host and "://" not in u: + host = _host_from_url(f"http://{u}") if host: _add_http_host(self.http_host_map, host, pinfo, sock=sock) @@ -1282,6 +1284,11 @@ def event_apicall(self, call, process): if host2: _add_http_host(self.http_host_map, host2, pinfo, sock=sock) + if api in ("internetconnectw", "internetconnecta", "winhttpconnect"): + server_name = _get_arg_any(args_map, "ServerName", "lpszServerName", "szServerName", "pszServerName") + if server_name: + _add_http_host(self.http_host_map, server_name, pinfo, sock=sock) + if api in TLS_HINT_APIS: sni = _extract_tls_server_name(call, args_map) if sni: diff --git a/modules/reporting/reporthtml.py b/modules/reporting/reporthtml.py index b179aebc64f..5fdfd5df59b 100644 --- a/modules/reporting/reporthtml.py +++ b/modules/reporting/reporthtml.py @@ -8,6 +8,7 @@ import os from lib.cuckoo.common.abstracts import Report +from lib.cuckoo.common.config import Config from lib.cuckoo.common.constants import CUCKOO_ROOT from lib.cuckoo.common.exceptions import CuckooReportError from lib.cuckoo.common.objects import File @@ -117,6 +118,7 @@ def run(self, results): ) env.loader = FileSystemLoader(os.path.join(CUCKOO_ROOT, "data", "html")) results["local_conf"] = self.options + results["network_proc_map"] = Config("processing").network.process_map try: tpl = env.get_template("report.html") diff --git a/web/templates/analysis/admin/index.html b/web/templates/analysis/admin/index.html index 06d39e90533..557aed9153a 100644 --- a/web/templates/analysis/admin/index.html +++ b/web/templates/analysis/admin/index.html @@ -1,45 +1,99 @@ {% load analysis_tags %} -
-
Admin Information
+
+
+
Admin Information
+
-
-
Task ID
-
- {{analysis.info.id}} - Delete -
-
+ +
+
+ Task ID +
+
+ {{analysis.info.id}} + + Delete Task + +
+
+ {% if config.mongodb %} -
-
Mongo ID
-
{{analysis|mongo_id}}
-
+
+
+ Mongo ID +
+
+ {{analysis|mongo_id}} +
+
{% elif config.elasticsearchdb %} -
-
ElasticSearch Index
-
{{analysis.es.index}}
-
-
-
ElasticSearch ID
-
{{analysis.es.id}}
-
+
+
+ ElasticSearch Index +
+
+ {{analysis.es.index}} +
+
+
+
+ ElasticSearch ID +
+
+ {{analysis.es.id}} +
+
{% endif %} -
-
CAPE release
-
{{analysis.info.version}}
-
+ +
+
+ CAPE Release +
+
+ {{analysis.info.version}} +
+
+ {% if analysis.info.user_id %} -
-
Task created by user
-
- {{analysis.info.user_id}} - Ban User - Ban All User Tasks -
-
+
+
+ Created By +
+
+
+ + User ID: {{analysis.info.user_id}} + + +
+ + Ban User + + + Ban All Tasks + +
+
+
+
{% endif %}
-
+
\ No newline at end of file