- Ubuntu 24.04
- Kernel 6.11.0
To replicate the environment, once you have Ubuntu 24.04 installed and running, you will need to download the exact CAPEv2 version used in our study. To do so, run the following commands:
git clone https://github.com/kevoreilly/CAPEv2.git
cd CAPEv2/
git checkout eab3d1dda44c7e381621a96b72b78cb0d91fc3dd
From the repository directory, go to the installer folder.
cd installer/
You will need to edit the kvm-qemu.sh file and replace any occurrence of <WOOT> by "INTL".
Once this is done, you can run the following commands:
sudo chmod a+x kvm-qemu.sh
sudo ./kvm-qemu.sh all <username> | tee kvm-qemu.log
Replacing <username> with your actual username.
Reboot the system after the installation.
To install virt-manager, run the following command:
sudo ./kvm-qemu.sh virtmanager <username> | tee kvm-qemu-virt-manager.log
Replacing <username> with your actual username.
Reboot the system after the installation.
To install CAPE the installation script can be found inside the "installer" folder as "cape2.sh".
To install run the following command:
sudo ./cape2.sh all cape | tee cape.log
This will install all the required libraries and services. Read the code if you need more details. Specifically, the installed services are:
-
cape.service
-
cape-processor.service
-
cape-web.service
-
cape-rooter.service
To install dependencies with poetry, execute the following commands (from the main working directory of CAPE, /opt/CAPEv2/):
cd /opt/CapeV2/
poetry install
Once the installation is done, you can confirm a virtual environment has been created with:
poetry env list
The output should be similar to:
capev2-t2x27zRb-py3.10 (Activated)
Only the installation scripts and some utilities like rooter.py must be executed with sudo, the rest of configuration scripts and programs MUST be executed under the cape user, which is created in the system after executing cape2.sh.
Since the cape user has no login shell by default, you can execute commands as this user by running:
sudo su - cape -c /bin/bash
Once CAPE is installed, you can download the configuration files from this repository and replace them in your /opt/CAPEv2/conf/ directory.
The files you need to replace in your conf folder can be found here.
Once you have replaced the configuration files, reboot the system.
For the virtual machine you will need to download a Windows 10 21H2 64 bits image.
Install it using virt-manager. The configuration for the virtual machine can be found in xml format here.
Name the VM as "win10" to use the same configuration files as we do, if not you will need to change the configuration of the kvm.conf file
Once the virtual machine is installed and running, you will need to install python 3.10.6 32 bits inside the virtual machine.
In the installer you will see an option to add python 3.10 to your PATH, enable it.
When the installation is done, it is recommended to test whether Python is correctly added to your PATH environment variable. In order to do so, you can execute the following commands from a command prompt:
python --version
Once python is installed you will need to install 2 python libraries by running these 2 commands:
python -m pip install --upgrade pip
python -m pip install Pillow
After this, you will need to install .NET 4.8.1.
Reboot the VM after everithing is installed.
To install the agent, you will need to copy the file /opt/CAPEv2/agent/agent.py to your virtual machine.
Store agent.py wherever you prefer, but rename it to <any_name>.pyw.
Once that is done, we will need to create a task in Windows Task Scheduler by creating a basic task which will execute the agent any time session is initiated. You will need to go to the task properties and check the option to let it execute with the higher privileges.
Now run the task by hand or close and open session. Ensure the task is running.
Download and run this 2 scripts in your virtual machine:
After both scripts are run, reboot the VM and check the task running the agent is running
Change the ipv4 configuration to static and set the following static IPv4 configuration:
- IP:
192.168.122.148 - Subnet:
255.255.255.0 - Default gateway:
192.168.122.1.
Download and run the required PowerShell script from here.
Reboot the VM
Make sure the agent's task is running and create a snapshot called snapshot1.
Once the installation is complete, you can access the CAPEv2 web interface at http://localhost:8000.