by detuxsandbox

detuxsandbox / detux

The Multiplatform Linux Sandbox

220 Stars 64 Forks Last release: Not found MIT License 11 Commits 0 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

Detux: The Multiplatform Linux Sandbox


Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux (Debian) for various CPU architectures.

The following CPUs are currently supported: - x86 - x86-64 - ARM - MIPS - MIPSEL

Use the Live version now:

What's in this release?

This release of Detux contains the script for executing a Linux binary/script in a specified CPU arch. Don't worry if you don't know what platform, it's in the script, the Magic package helps picking up the CPU arch in an automated way. x86 is the default CPU version, this can be tuned to a different one in the config file.

This release gives the analysis report in a DICT format, which can be easily customized to be inserted in to NOSQL dbs.

An example script has been provided which demonstrates the usage of the sandbox library.

What's in the report?

- Static Analysis
    -- Basic strings extracted from binary
    -- ELF information generated by readelf commands
    -- the can be modified to add more 3rd party commands to analyse the binary and add the result to DICT.

  • Dynamic Analysis -- The captured pcaps are parsed with DPKT to extract the IOC's and readable info from the packets.


  • System packages

    • python 2.7
    • qemu
    • pcaputils
    • sudo
    • libcap2-bin
    • bridge-utils
  • Python libraries (Preferable to use virtual environment)

    • pexpect
    • paramiko
    • python-magic

Kindly make sure that the above requirements are met before using Detux. A few dependencies may vary from OS to OS.


  • Host ( The host itself can be a VM or a baremetal machine)
    • QEMU
    • dumpcap
    • DETUX Scripts

Network Arch

- NIC1 : This interface is for accessing the Host
- NIC2 : Interface bridged with the the QEMU Sandbox VMs. One can redirect the traffic from the interface to WHONIX or REMNUX or a custom Gateway to filter/allow internet access for the Sandboxed VMs.

VM Setup:

Downloading Linux VM Images

Special thanks to aurel who has uploaded pre built QEMU Debian VM images for all possible CPU architectures. The VM images are located at :, the same link contains the command examples for invoking the vm images.

You can use the following script to automatically download the VM images to the "qemu" folder of Detux.

wget -P qemu/x86/1/

#x86-64 wget -P qemu/x86-64/1/

#arm wget -P qemu/arm/1/ wget -P qemu/arm/1/ wget -P qemu/arm/1/

#mips wget -P qemu/mips/1/ wget -P qemu/mips/1/

#mipsel wget -P qemu/mipsel/1/ wget -P qemu/mipsel/1/

Setting sudoers for qemu execution

Detux uses SSH to communicate with the VMs and so, this is currently required for the VMs to have networking capability. Considering that the listed binaries are in the same path, you may add the following lines to to /etc/sudoers (only if you are a non-root user):

Cmnd_Alias  QEMU_CMD    =   /usr/bin/qemu-*, /sbin/ip, /sbin/ifconfig, /sbin/brctl

Change the paths to the binaries if they differ for you.

Network setup

Add the following config to /etc/qemu-ifup, backup the original if you already have one: ```

! /bin/sh

Script to bring a network (tap) device for qemu up.

The idea is to add the tap device to the same bridge

as we have default routing to.

in order to be able to find brctl

PATH=$PATH:/sbin:/usr/sbin ip=$(which ip) ifconfig=$(which ifconfig)

echo "Starting" $1 if [ -n "$ip" ]; then ip link set "$1" up else brctl=$(which brctl) if [ ! "$ip" -o ! "$brctl" ]; then echo "W: $0: not doing any bridge processing: neither ip nor brctl utility not found" >&2 exit 0 fi ifconfig "$1" up fi

switch=$(ip route ls | \ awk '/^default / { for(i=0;i<NF;i++) { if ($i == "dev") { print $(i+1); next; } } }' ) if [ -d /sys/class/net/br0/bridge/. ]; then if [ -n "$ip" ]; then ip link set "$1" master br0 else brctl addif br0 "$1" fi exit # exit with status of the previous command fi

echo "W: $0: no bridge for guest interface found" >&2 ```

Considering that eth0 is the interface you want your VMs to be bridged with, you may remove the configs for eth0 and use the following configs in /etc/network/interfaces:

auto br0
iface br0 inet dhcp
  bridge_ports eth0
  bridge_maxwait 0
You can also specify a static address you used for eth0.
Setting up your VMs

Traverse to the folder in which your VM images are located for each QEMU Images e.g. for ARM is :

` For each image, follow the VM boot instructions given at "", to start the VM. However, if you are a non-root user, you will have to use sudo.

Comands for Booting the VMs (Replace with the MAC you desire): ```


sudo qemu-system-i386 -hda qemu/x86/1/debianwheezyi386_standard.qcow2 -vnc -net nic,macaddr= -net tap -monitor stdio


sudo qemu-system-x8664 -hda qemu/x86-64/1/debianwheezyamd64standard.qcow2 -vnc -net nic,macaddr= -net tap -monitor stdio


sudo qemu-system-arm -M versatilepb -kernel qemu/arm/1/vmlinuz-3.2.0-4-versatile -initrd qemu/arm/1/initrd.img-3.2.0-4-versatile -hda qemu/arm/1/debianwheezyarmel_standard.qcow2 -append "root=/dev/sda1" -vnc -net nic,macaddr= -net tap -monitor stdio


sudo qemu-system-mips -M malta -kernel qemu/mips/1/vmlinux-3.2.0-4-4kc-malta -hda qemu/mips/1/debianwheezymips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -vnc -net nic,macaddr= -net tap -monitor stdio


sudo qemu-system-mipsel -M malta -kernel qemu/mipsel/1/vmlinux-3.2.0-4-4kc-malta -hda qemu/mipsel/1/debianwheezymipsel_standard.qcow2 -append "root=/dev/sda1 console=tty0" -vnc -net nic,macaddr= -net tap -monitor stdio ```

Detux requires a preconfigured VM snapshot with IP addresses and ssh setup.

Steps for setting up your snapshot:
  • Choose an unconfigured VM image and start it using the above listed command in a Terminal.
  • Connect VM monitor. Connect a VNC client to and wait for the VM to boot completely.
  • Login with the default root credentials (root/root).
  • Configure the VM's network interface such that it reachable/ accessible to the host.
  • Setup SSH server on the VM and anyother configuration if required for you.
  • Once configured, boot to a running state that accepts network connection.
  • Switch back to terminal with qemu console on, which should look like:
  • Save the VM state typing the following qemu commands in the qemu console:
    (qemu) savevm init
  • Quit the QEMU console:
    (qemu) q
    -- Repeat through step 1 for all the VMs
Setting capture permisisons

In order for a non-root user to be able to capture packets, Dumpcap needs capture privileges. (

The following command may enable the same for you:

sudo groupadd -g wireshark
sudo usermod -a -G wireshark 
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
Keep in mind that you might have to logout and login again or reboot the host to apply the permissions. If you are unable to capture packets or you get errors related to dumpcap, you need to check if permissions for your users are set correctly and the dumpcap path is right.

Detux Config

The detux.cfg files in the main directory needs to be configured. Each VM section has to be configured with correct Network Params and SSH credentials. You can choose root/non-root user depending on your need.

Running Detux

The Detux library located in "core" directory can be used to suit your need of analysis. The repo contains "" which analyses the given binary and saves pcap in pcap folder and writes JSON output to a specified filepath.


usage: [-h] --sample SAMPLE [--cpu {x86,x86-64,arm,mips,mipsel}]
                [--int {python,perl,sh,bash}] --report REPORT

optional arguments: -h, --help show this help message and exit --sample SAMPLE Sample path (default: None) --cpu {x86,x86-64,arm,mips,mipsel} CPU type (default: auto) --int {python,perl,sh,bash} Architecture type (default: None) --report REPORT JSON report output path (default: None)


python --sample test_script/example_binary1 --report reports/example_report1.json



Thanks to Aurélien Jarno (@aurel32) ( for the pre-built VM images.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.