cuckoobox/cuckoo — pull request #142 by dgiese (2013-08-08 21:40:41+00:00)
Title: Initial support for VMWare ESXi/vSphere

Requirements:

-ESXi / vCenter
-VMware-vSphere-CLI

Solution tested with:

-ESXi 5.1
-Ubuntu-Server 12.04.1 LTS amd64
-VMware-vSphere-CLI-5.1.0
-Cuckoo 0.5

Workaround if you are unable to connect to your ESXi with /usr/bin/vmware-cmd:
add the following line to /usr/bin/vmware-cmd:
export PERL_LWP_SSL_VERIFY_HOSTNAME=0;

Howto:

1. Install latest Cuckoo
2. Download and install VMware-vSphere-CLI (suitable for your version of ESXi)
3. Create Sandbox-VM in ESXi (Check the cuckoo manual for creation of Sandboxes), install OS and Software
4. Take a Snapshot of the *running machine* and shut down the VM
4. Clone the VM as you like
- Hint: Create a seperate folder for all Sandbox-VMs
5. Create a seperate cuckoo-User in ESXi with limited privileges
- Required permissions (maybe less permissions are possible):

- ESXi : Role: read-only

- Folder with Sandbox-VMs: Create new role with the following permissions:
Datastore->Browse datastore,
Global->Status,
VM->Interaction{Suspend,Poweroff, Answer question, Reset, Backup Operation},
VM->Snapshot->Revert to Snapshot
6. copy esxi.conf into $cuckoo-dir/conf and esxi.py to $cuckoo-dir/modules/machinemanagers
7. Edit esxi.conf
- Machine is identified by the path to the vmx-file
- Determine the exact path by this command:
#vmware-cmd -H #ESXI-IP# --username #cuckoo-user# --password #cuckoo-password# -l
- You can add multiple Sandbox-VMs
- Use the credentials of the ESXi cuckoo-user created in step #5
8. Edit your $cuckoo-dir/conf/cuckoo.conf and set machine_manager to "esxi"
9. You are ready to go. You can even connect to a Sandbox with the vSphere-client for interacting with programs.

Important notices:

-	In times of malware that may break out from a virtual machine it may be a good idea to use an isolated, non productive ESXi
-	If you run cuckoo on a virtual machine you should create a network port in promiscous mode to get any traffic originating from the sandboxes
-	It is possible to modify the .vmx to hide the typical bios-signatures of virtual machines