Running Cuckoo to automate Fog Imaging

[Reuban1219]

Not sure if Ill get much help but, Ill hope for the best.
Im already running FOG server with clients. In total, 5 physical devices connected to each other using a switch. I need to run malware tests on all 4 clients in a sandbox (cuckoo) & make my life easier by automating the image deployment using cuckoo. Ive installed Cuckoo Host. but, I’m struggling to find any guide on the Cuckoo documents on how to configure Fog for the physical.conf files. If anyone here has any links or other sources it would be helpful.

My set up:
Fog server- Debian 10.3
Clients- Win_10, Win_8.1, Win_7, Win_XP

Additional notes:
-my clients are not allowed to connect to the internet
-each client has their own static IP address
-capture & deploy is working well for all clients
-Server has two NIC (one to the internet & one to the locally connected to other clients)

[Sebastian Roth]

@Reuban1219 Didn’t know the Cuckoo project is using FOG. Nice to see. I haven’t used Cuckoo myself and so I am not exactly sure if I can help but I can give it a try.

Looking at this example config we see that it is trying to act like a user on the web UI. Though this seems to be catered to FOG version 1.2.0 and I would imagine it can’t work with 1.5.8 just the same way.

# Credentials to access the FOG website. We're using basic screenscraping
# techniques to programmatically schedule new "image download tasks", i.e., to
# instruct FOG to make a laptop restore the original image on the next reboot.
# Note: if you're using FOG to manage your physical machines without the
# cronjob functionality as per documentation you *will* have to change the
# following "none" to "localhost" or similar (the "none" is for backwards
# compatibility where users are still using the cronjob-style tasking, and
# thus effectively ignore the FOG integration). The FOG functionality has only
# been tested against the FOG 1.2.0 stable release.

FOG does have an API to do such things but this was added after 1.2.0 was released and I can’t find any hint in the Cuckoo documentation taking about this. So my assumtion is that you’d need to use the very dated FOG 1.2.0 or talk to the Cuckoo developers to see if they are keen to implement using the API or have started doing so already.

[Sebastian Roth]

Just found this as well:
https://forums.fogproject.org/topic/3227/fog-api
https://github.com/cuckoosandbox/cuckoo/issues/1258