基于实际部署经验总结系统环境为Ubuntu 22.04Python 3.10KVM 虚拟化客户机使用Windows 10 专业版。一、系统环境准备1.1 硬件要求CPU支持硬件虚拟化Intel VT-x / AMD-V内存至少8GB推荐 16GB磁盘根分区建议50GB另加一块独立硬盘用于虚拟机镜像建议 100GB1.2 安装基础软件包sudo apt update sudo apt upgrade -y sudo apt install -y git wget curl software-properties-common build-essential1.3 安装 Python 3.10Ubuntu 20.04/18.04 需要22.04 自带sudo apt install -y python3.10 python3.10-venv python3.10-dev1.4 安装 KVM 虚拟化sudo apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager sudo systemctl enable --now libvirtd # 将当前用户加入 libvirt 和 kvm 组 sudo usermod -aG libvirt,kvm $USER # 重新登录或执行 newgrp libvirt1.5 启用嵌套虚拟化若在 VMware/VirtualBox 内运行 Ubuntu关闭 Ubuntu 虚拟机在虚拟机设置 → 处理器 → 勾选 “虚拟化 Intel VT-x/EPT 或 AMD-V/RVI”启动 Ubuntu检查cat /sys/module/kvm_intel/parameters/nested # 应返回 1 或 Y如果为 0执行sudo modprobe -r kvm_intel sudo modprobe kvm_intel nested1 echo options kvm_intel nested1 | sudo tee /etc/modprobe.d/kvm_intel.conf二、安装 CAPEv22.1 克隆项目cd /opt sudo git clone https://github.com/kevoreilly/CAPEv2.git sudo chown -R $USER:$USER CAPEv2 # 将所有权给当前用户后续再改 cape 用户2.2 安装 Poetry 并配置国内源# 为当前用户安装 Poetry python3.10 -m pip install --user poetry export PATH$HOME/.local/bin:$PATH echo export PATH$HOME/.local/bin:$PATH ~/.bashrc # 配置 Poetry 使用清华源加速 poetry config repositories.pypi https://pypi.tuna.tsinghua.edu.cn/simple # 或添加阿里云源 poetry source add --priorityprimary aliyun https://mirrors.aliyun.com/pypi/simple/2.3 安装 Python 依赖cd /opt/CAPEv2 poetry env use python3.10 poetry install2.4 配置数据库PostgreSQL MongoDBCAPEv2 脚本会自动安装若需手动sudo apt install -y postgresql mongodb sudo systemctl enable --now postgresql mongodb三、配置 Windows 10 客户机3.1 创建虚拟机sudo virt-install \ --name Cape-Win10 \ --memory 4096 \ --vcpus 2 \ --disk path/var/lib/libvirt/images/cape-win10.qcow2,size50 \ --os-variant win10 \ --network networkdefault,modelvirtio \ --graphics vnc,listen0.0.0.0,port5900 \ --cdrom /path/to/Win10_22H2.iso \ --noautoconsole name 虚拟机名称 ram内存 16G disk path存储虚拟机的位置用默认位置就好大小为 50 G vcpus虚拟 CPU 核数 os-variant系统为 win10 network采用 default 网络 graphic设置 VNC 连接这个用来就行虚拟机内部的配置这个一定要有如果在服务器上的话。 cdrom操作系统镜像的路径 noautoconsole无自动终端3.2 安装 Windows 10 专业版通过 VNC 连接宿主机 IP:5900完成安装必须使用专业版Pro才能通过组策略彻底关闭 Defender3.3 安装 VirtIO 驱动虚拟机内挂载virtio-win.iso从 Fedora 仓库 下载打开设备管理器 → 未知以太网控制器 → 更新驱动 → 浏览光驱中的NetKVM\w10\amd64重启虚拟机3.4 客户机内部配置静态 IPCAPEv2 不支持 DHCPIP:192.168.122.100掩码:255.255.255.0网关:192.168.122.1DNS:8.8.8.8安装 Python 3.8.10 32位下载地址安装时勾选 “Add Python to PATH”安装 Pillowpython -m pip install Pillow9.5.0部署 CAPE Agent下载agent.py→ 重命名为agent.pyw按WinR输入shell:common startup将agent.pyw放入该文件夹关闭 Windows Defender 实时保护通过组策略gpedit.msc→ 计算机配置 → 管理模板 → Windows 组件 → Microsoft Defender 防病毒 → 启用“关闭 Microsoft Defender 防病毒”禁用 Windows Update 服务services.msc→ Windows Update → 禁用并停止关闭防火墙控制面板 → Windows Defender 防火墙 → 全部关闭3.5 测试 Agent在宿主机执行curl http://192.168.122.100:8000应返回 JSON 格式的 Agent 信息。3.6 拍摄运行中快照关键# 确保虚拟机已开机且 agent 可访问 sudo virsh snapshot-create-as Cape-Win10 cape-running --disk-only --atomic验证快照状态sudo virsh snapshot-info Cape-Win10 cape-running # State: running四、配置 CAPEv2 服务4.1 创建专用运行用户capesudo useradd -m -s /bin/bash cape # 为 cape 用户安装 Poetry sudo -u cape python3.10 -m pip install --user poetry sudo -u cape poetry config repositories.pypi https://pypi.tuna.tsinghua.edu.cn/simple4.2 修改配置文件编辑/opt/CAPEv2/conf/kvm.conf[machinery] machinery kvm [kvm] machines cuckoo1 interface virbr0 dsn qemu:///system [cuckoo1] label Cape-Win10 platform windows ip 192.168.122.100 arch x86 snapshot cape-running4.3 创建 systemd 服务以下服务文件需创建在/etc/systemd/system/ WorkingDirectory为项目目录cape-rooter.service[Unit] DescriptionCAPE rooter Afternetwork.target [Service] WorkingDirectory/opt/CAPEv2 ExecStart/home/cape/.local/bin/poetry run python utils/rooter.py -g cape Userroot Grouproot Restartalways RestartSec5m [Install] WantedBymulti-user.targetcape-web.service[Unit] DescriptionCAPE WSGI app Aftercape-rooter.service [Service] WorkingDirectory/opt/CAPEv2/web ExecStart/home/cape/.local/bin/poetry run python manage.py runserver_plus 0.0.0.0:8000 --traceback --keep-meta-shutdown Usercape Groupcape Restartalways RestartSec5m [Install] WantedBymulti-user.targetcape-processor.service[Unit] DescriptionCAPE report processor Aftercape-rooter.service [Service] WorkingDirectory/opt/CAPEv2 ExecStart/home/cape/.local/bin/poetry run python utils/process.py -p1 -pt 900 auto Usercape Groupcape Restartalways RestartSec5m LimitNOFILE100000 [Install] WantedBymulti-user.targetcape.service调度器[Unit] DescriptionCAPE scheduler Aftercape-rooter.service [Service] WorkingDirectory/opt/CAPEv2 ExecStart/home/cape/.local/bin/poetry run python cuckoo.py Usercape Groupcape Restartalways RestartSec5m [Install] WantedBymulti-user.target4.4 启动所有服务sudo systemctl daemon-reload sudo systemctl enable --now cape-rooter cape-web cape-processor cape sudo systemctl status cape-rooter cape-web cape-processor cape其中每个服务作用为cape.service cuckoo.py 主调度器负责接收、调度分析任务。cape-processor.service process.py 分析处理器负责处理分析结果并生成报告。cape-web.service manage.py Web 界面提供基于 Django 的网页管理后台。cape-rooter.service rooter.py 网络路由以 root 权限运行负责管理沙箱的网络通信五、验证与提交任务5.1 访问 Web 界面浏览器打开http://宿主机IP:8000默认用户名/密码cape/cape5.2 命令行提交测试任务sudo -u cape /home/cape/.local/bin/poetry run python /opt/CAPEv2/utils/submit.py /tmp/eicar.com六、常见问题与解决办法问题现象可能原因解决方法virt-install报 “Host does not support virtualization”嵌套虚拟化未开启检查 VMware/BIOS 设置加载kvm_intel nested1重启 libvirtdDocker 磁盘空间不足根分区过小添加新硬盘迁移/var/lib/libvirt/images或整个/opt/CAPEv2cape-processor反复重启日志显示 “missing id”服务参数顺序错误ExecStart改为... utils/process.py -p7 -pt 900 autocape-processor报 “No module named libvirt”Python 虚拟环境缺少 libvirt 包sudo -u cape poetry run pip install libvirt-pythoncape-processor报 “Cannot allocate memory”物理内存不足降低-p1并行数增加 swap减少虚拟机内存快照状态为 shutoff快照是在虚拟机关闭时拍摄的重新启动虚拟机开机后执行virsh snapshot-create-aslibvirt连接被拒绝cape用户不在libvirt组sudo usermod -aG libvirt cape重启 libvirtdPoetry 下载依赖超时访问国外源慢配置国内镜像源清华、阿里云增加超时poetry config installer.timeout 600Web 界面无法访问服务监听 127.0.0.1 或防火墙阻挡修改cape-web.service中的0.0.0.0:8000sudo ufw allow 8000虚拟机 Agent 无响应Windows 防火墙阻挡或 agent 未运行关闭防火墙检查启动文件夹手动运行agent.pyw测试提交任务一直 pending调度器未运行或快照错误sudo systemctl status cape检查kvm.conf中的快照名是否正确No space left on device根分区满清理日志journalctl --vacuum-size200M迁移项目到数据盘解决不能自动生成报告添加循环脚本sudo tee /usr/local/bin/cape-processor-loop.sh /dev/null EOF #!/bin/bash LOG_FILE/var/log/cape-processor.log echo $(date): CAPE Processor Loop Started $LOG_FILE cd /var/lib/libvirt/images/CAPEv2-master while true; do echo $(date): Checking for completed tasks... $LOG_FILE # 添加 auto 参数 /home/cape/.local/bin/poetry run python utils/process.py auto -p 1 --disable-memory-limit $LOG_FILE 21 sleep 30 done EOF sudo chmod x /usr/local/bin/cape-processor-clean-loop.sh #更改配置 /etc/systemd/system/cape-processor.service,改为指向脚本 # 3. 修改服务文件使用这个新脚本 sudo tee /etc/systemd/system/cape-processor.service /dev/null EOF [Unit] DescriptionCAPE Report Processor (Clean Loop) Afternetwork.target mongodb.service [Service] Usersqa Groupsqa WorkingDirectory/var/lib/libvirt/images/CAPEv2-master ExecStart/usr/local/bin/cape-processor-clean-loop.sh Restartalways RestartSec10 [Install] WantedBymulti-user.target EOF # 重新加载并启动服务 sudo systemctl daemon-reload sudo systemctl restart cape-processor # 查看服务状态 sudo systemctl status cape-processor # 查看cape-process日志 tail -f /var/log/cape-processor.log七、维护建议定期清理日志sudo journalctl --vacuum-size500M监控磁盘空间df -h尤其注意/var/lib/libvirt/images和根分区更新 CAPEv2cd /opt/CAPEv2 git pull poetry install备份虚拟机快照和数据库
