Compiling Capture-HPC on VMWare Server 1.0.6
Monday, July 28th, 2008We often use Capture-HPC as a high interaction client honeypot for analyzing suspect URLs, but getting it up and running on a new platform can sometimes be a somewhat frustrating and time consuming process. I’ve recently had to repeat the build process on the latest version of VMWare Server (release 1.0.6 build-91891) running on Ubuntu Gutsy, so in case this saves anyone else some pain, this is what I had to do to make it work:
1) Download the latest sources (at the time of writing this was capture-server-2.1.0-300-src.zip)
2) Extract the latest sources
unzip capture-server-2.1.0-300-src.zip cd capture-server-2.1.0-300-src
3) Ensure the necessary build dependencies were installed
sudo aptitude update ; sudo aptitude install ant ant-optional sun-java6-jdk sun-java6-bin sun-java6-jre sudo install VMWare-Server-1.0.6-build-91891
4) Set the correct environment variables
JAVA_HOME=/usr/lib/jvm/java-6-sun-1.6.0.03/ ; export JAVA_HOME VIX_HOME=/usr/lib/vmware-vix/ ; export VIX_HOME VIX_INCLUDE=/usr/include/vmware-vix/ ; export VIX_INCLUDE VIX_LIB=/usr/lib/vmware-vix/ ; export VIX_LIB ANT_HOME=/usr/share/ant/ ; export ANT_HOME
5) Hack the revert compilation shell script:
chmod +x compile_revert_linux.sh cat compile_revert_linux.sh
#!/bin/sh echo $VIX_INCLUDE #gcc -I $VIX_INCLUDE -o revert revert.c $VIX_LIB/libvmware-vix.so gcc -I $VIX_INCLUDE -o revert revert.c /usr/lib/libvmware-vix.so
6) Remove any of the logic from build.xml that refers to the Windows OS branch:
vi build.xml
<?xml version="1.0"?>
<project name="CaptureServer" default="release" basedir=".">
<!-- all stuff to get the jni wrapper compiled -->
<taskdef resource="net/sf/antcontrib/antcontrib.properties"/>
<condition property="os" value="unix">
<os family="unix"/>
</condition>
<property environment="env"/>
<property name="src" value="."/>
<property name="build" value="build"/>
<property name="release" value="release"/>
<target name="init">
<mkdir dir="${build}"/>
<mkdir dir="${release}"/>
</target>
<target name="compile" depends="init">
<!-- Compile the java code -->
<javac srcdir="${src}" destdir="${build}" debug="true" debuglevel="lines,vars,source"/>
<!-- Compile the revert code -->
<exec command="sh" executable="./compile_revert_linux.sh"/>
</target>
<target name="jar" depends="compile">
<mkdir dir="${build}/jar"/>
<jar destfile="${build}/jar/CaptureServer.jar" basedir="${build}">
<manifest>
<attribute name="Main-Class" value="capture.Server"/>
</manifest>
</jar>
</target>
<target name="release" depends="clean,compile,jar">
<copy file="${build}/jar/CaptureServer.jar" todir="${release}"/>
<copy file="./COPYING" todir="${release}"/>
<copy file="./Readme.txt" todir="${release}"/>
<copy file="./input_urls_example.txt" todir="${release}"/>
<copy file="./config.xsd" todir="${release}"/>
<copy file="./config.xml" todir="${release}"/>
<exec executable="cp">
<arg value="./revert"/>
<arg value="${release}"/>
</exec>
<zip destfile="./CaptureServer-Release.zip" basedir="release"/>
</target>
<target name="clean">
<delete dir="${build}"/>
<delete dir="${release}"/>
<delete>
<fileset dir="." includes="revert.exe"/>
<fileset dir="." includes="revert"/>
<fileset dir="." includes="CaptureServer-Release.zip"/>
</delete>
</target>
</project>
6) Compile the Capture Server
ant
Buildfile: build.xml
[taskdef] Could not load definitions from resource net/sf/antcontrib/antcontrib.properties. It could not be found.
clean:
[delete] Deleting directory /home/david/client_honeypots/capture-server-2.1.0-300-src/build
[delete] Deleting directory /home/david/client_honeypots/capture-server-2.1.0-300-src/release
init:
[mkdir] Created dir: /home/david/client_honeypots/capture-server-2.1.0-300-src/build
[mkdir] Created dir: /home/david/client_honeypots/capture-server-2.1.0-300-src/release
compile:
[javac] Compiling 32 source files to /home/david/client_honeypots/capture-server-2.1.0-300-src/build
[javac] /home/david/client_honeypots/capture-server-2.1.0-300-src/capture/ClientFileReceiver.java:9: warning: sun.misc.BASE64Decoder is Sun proprietary API and may be removed in a future release
[javac] import sun.misc.BASE64Decoder;
[javac] ^
[javac] /home/david/client_honeypots/capture-server-2.1.0-300-src/capture/ClientFileReceiver.java:42: warning: sun.misc.BASE64Decoder is Sun proprietary API and may be removed in a future release
[javac] BASE64Decoder base64 = new BASE64Decoder();
[javac] ^
[javac] /home/david/client_honeypots/capture-server-2.1.0-300-src/capture/ClientFileReceiver.java:42: warning: sun.misc.BASE64Decoder is Sun proprietary API and may be removed in a future release
[javac] BASE64Decoder base64 = new BASE64Decoder();
[javac] ^
[javac] Note: /home/david/client_honeypots/capture-server-2.1.0-300-src/capture/MockClient.java uses unchecked or unsafe operations.
[javac] Note: Recompile with -Xlint:unchecked for details.
[javac] 3 warnings
[exec] The command attribute is deprecated.
[exec] Please use the executable attribute and nested arg elements.
[exec] /usr/include/vmware-vix/
[exec] revert.c:232:2: warning: no newline at end of file
jar:
[mkdir] Created dir: /home/david/client_honeypots/capture-server-2.1.0-300-src/build/jar
[jar] Building jar: /home/david/client_honeypots/capture-server-2.1.0-300-src/build/jar/CaptureServer.jar
release:
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[copy] Copying 1 file to /home/david/client_honeypots/capture-server-2.1.0-300-src/release
[zip] Building zip: /home/david/client_honeypots/capture-server-2.1.0-300-src/CaptureServer-Release.zip
BUILD SUCCESSFUL
Total time: 2 seconds
7) Extract the newly made CaptureServer-Release.zip file into a suitable location (such as a newly made capture-server-2.1.0-300 directory).
8) Configure config.xml and run as normal, such as via:
cd capture-server-2.1.0-300 vi config.xml /usr/lib/jvm/java-6-sun/bin/java -Djava.net.preferIPv4Stack=true -jar CaptureServer.jar -s your_ip:7070 -f input_urls_example.txt
Hopefully Capture-HPC should work cleanly after that.
NOTE: If you experience problems running Capture and find you receive this error when attempting to run the server:
VIX Error on connect in connect: One of the parameters was invalid
check that your VMWare Server installation was clean by removing VMWare Server (vmware-uninstall.pl), finding any vmware related files in /usr, deleting them and then reinstalling VMWare. I found that one of my VMWare Server upgrades had left a number of vmware-vix shared libraries on disk and these seem to cause the newly compiled Capture Server to fail to connect on revert.
For more trouble shooting details, see this thread on the public Capture-HPC mailing list:
http://public.honeynet.org/pipermail/capture-hpc/2008-August/000431.html
