- Download sources.
- Unzip and extract sources on your web server (under /var/www).
- Edit your configuration file (under /your_root/src/config.php), see below.
- Create a database in MySQL (phpmyadmin may help), suggest name “mrf”.
- Browse to the root of the project (http://localhost), install page will show, see below.
Edit configuration file
$config = array(
"version" => "6.2",
"db" => array(
"storage" => array(
"dbname" => "mrf", // database name for samples storage
"username" => "root", // database user for samples storage
"password" => "", // database user password for samples storage
"host" => "localhost" // database host for samples storage
),
"usercake" => array(
"dbname" => "mrf", // database name for users storage
"username" => "root", // database user for users storage
"password" => "", // database user password for users storage
"host" => "localhost" // database host for users storage
)
),
"leftnav" => array(
array(
"name" => "Dashboard",
"link" => "/index.php",
"icon" => "fa fa-dashboard",
),
array(
"name" => "Upload",
"link" => "/upload.php", // If you don't work at root level, please modify
"icon" => "fa fa-upload",
),
array(
"name" => "Search",
"link" => "/search.php", // If you don't work at root level, please modify
"icon" => "fa fa-search",
),
array(
"name" => "Discussions",
"icon" => "fa fa-comments",
"link" => array(
array(
"name" => "Create",
"link" => "/add_discussion.php", // If you don't work at root level, please modify
"icon" => "fa fa-plus",
),
array(
"name" => "Browse",
"link" => "/discussions.php", // If you don't work at root level, please modify
"icon" => "fa fa-search",
),
)
),
array(
"name" => "Feeds",
"icon" => "fa fa-rss",
"link" => array(
array(
"name" => "Urls Tracker",
"link" => "/urltracker.php", // If you don't work at root level, please modify
"icon" => "fa fa-android",
),
)
),
array(
"name" => "Cuckoo",
"link" => "/cuckoo.php", // If you don't work at root level, please modify
"icon" => "fa fa-fire",
"access" => "admin",
),
),
"user_settings" => array(
"email_notifications" => array(
"display" => "Email Notifications",
"settings" => array(
"new_comment_on_discussion" => array(
"name" => "email_notification_on_discussion",
"display" => "Email notification on discussion activity",
"default" => False
),
"new_comment_on_sample" => array(
"name" => "email_notification_on_sample",
"display" => "Email notification on sample comment",
"default" => False
)
)
),
"third_party" => array(
"display" => "VirusTotal per user Settings",
"settings" => array(
"user_virustotal_key" => array(
"name" => "user_virustotal_key",
"display" => "My VirusTotal API key (if empty, global is used)",
"default" => ""
)
)
)
),
"urls" => array(
"baseUrl" => "https://domain.tld/", // Base url of your website, TRAILING SLASH NEEDED
"storagePath" => "/data/malwaredb/storage/", // Samples storage full path (on disk), TRAILING SLASH NEEDED
"storageUrl" => "https://domain.tld/storage/" // (Optional, only for direct samples access) Samples public url, TRAILING SLASH NEEDED
),
"ui" => array(
"template" => "ampleadmin",
"colors" => "blue-dark",
"is_dark" => True,
"files_per_page" => 40,
"hex_max_length" => 65536, //64 kb *KEEP THAT VALUE LOW, OTHERWISE UI BECOMES UNRESPONSIVE*
),
"modules" => array(
"localstorage" => array(
"enabled" => True, // True/False, if should enable MIME type module
"class" => "LocalStorage", // Don't touch this, this is the name of the Module's class
"priority" => 10, // Don't touch this, already optimized
"cron" => True, // True/False if you want the module Cron routine to be triggered
),
"mime" => array(
"enabled" => True,
"class" => "Mime",
"priority" => 9, // MIME is used by other modules
"cron" => True,
),
"pedata" => array(
"enabled" => True,
"class" => "PEData",
"priority" => 10,
"cron" => True,
),
"officedata" => array(
"enabled" => True,
"class" => "OfficeData",
"priority" => 10,
"cron" => True,
),
"pdfdata" => array(
"enabled" => True,
"class" => "PDFData",
"priority" => 10,
"cron" => True,
),
"ssdeep" => array(
"enabled" => True,
"class" => "SSDEEP",
"priority" => 10,
"cron" => True,
),
"trid" => array(
"enabled" => True,
"class" => "TrID",
"priority" => 10,
"cron" => True,
),
"bin2img" => array(
"enabled" => True,
"class" => "Bin2Img",
"priority" => 10,
"cron" => True,
),
"cuckoo" => array(
"enabled" => True,
"class" => "Cuckoo",
"priority" => 10,
"api_base_url" => 'http://cuckoo.me:8080/', // Cuckoo API url, TRAILING SLASH NEEDED: Used to communicate with the Cuckoo machine
"web_base_url" => 'http://cuckoo.me:80/', // Cuckoo web url, TRAILING SLASH NEEDED: Used to open reports
"scan" => array( // Cuckoo parameters, not supported yet
//"package" => "", // uncomment to use
//"timeout" => "", // uncomment to use
//"priority" => 3, // 1 to 3, uncomment to use
//"options" => "", // uncomment to use
//"machine" => "", // uncomment to use
//"platform" => "", // uncomment to use
//"tags" => "mrf", // uncomment to use
//"custom" => "", // uncomment to use
//"owner" => "", // uncomment to use
//"memory" => False // uncomment to use
),
"scan_optional" => array(
//"options" => [ "option1", "option2" ], // uncomment to use, define options that can be sent to Cuckoo (a checkbox is shown on submission)
),
"cron" => True,
"score" => False, // The score is quite time consuming to obtain because we need to download the JSON report.
),
"virustotal" => array(
"enabled" => True,
"class" => "VirusTotal",
"priority" => 10,
"key" => 'your_api_key', // Replace with your VirusTotal API key
"automatic_upload" => True, // True/False, whether you want to automatically upload unknown samples on submission.
// If False, only a check is done, and manual upload is possible later.
"comment_uploaded" => array(
"enabled" => True, // If true, files uploaded (new analysis) will be commented upon completion
"comment" => "Sample received on MRF honeypot system, adlice.com"
),
"vendors_priority" => array( // List of vendors as seen in the VT API, the first one detecting will give its threat name to the sample
"Microsoft",
"Kaspersky",
"BitDefender",
"Malwarebytes"
),
"cron" => True,
),
"yed" => array(
"enabled" => False,
"class" => "Yed",
"priority" => 10,
"url" => 'https://yed.server.com/',
'key' => 'your_api_key',
"automatic_upload" => False,
"cron" => True,
),
"urltracker" => array(
"enabled" => True,
"class" => "UrlTracker",
"priority" => 10,
"cron" => True,
),
),
// Warning: Cron isn't enabled by this framework.
// Setting enabled to true means YOU have registered /src/cron.php in the cron table
// and that VirusTotal/Cuckoo refreshes will be performed by it.
// This tells the uploader NOT to perform VirusTotal/Cuckoo refreshes when getting the samples to display.
// This drastically improves performance when you have many scans pending on the current page.
"cron" => array(
"enabled" => True,
"remove_old_samples" => array(
"enabled" => True,
"older_than_days_count" => 30
)
),
// Paths can be different on several machines, and have either redirections or restrictions.
// Default values are usually good, but can be tweaked for specific cases.
"path" => array (
"tmp" => "/tmp" // Temporary folder location, this must be in your authorized write locations
),
"options" => array(
// When public mode is enabled, APIs needed for sample page
// Are NOT checked for valid API Key.
// Instead, only a REFERER/ORIGIN basic check is performed.
// This allows the sample page to be browsed without any account
"public_mode" => False
),
);
Create storage folder
- Create the storage folder (from “storagePath” field in config.php)
- Run the following command to give PHP write access to it:
sudo chown -R www-data:www-data /your/storage/folder/location
Run installer script
If your configuration file is properly filled, it should display the installation page when browsing at root.
Important Note: Installer script must be re-launched every time you modify a module in config.php file. After first installation, the Install page can be found under Admin account, in website settings (“Install” page).
Run the install script and wait for it to complete. Upon completion, all tables will be created in the database, default settings applied and administrator account created.
Warning! Don’t leave the page without saving the admin credentials otherwise you will have to manually delete the database and restart the installation script.
Upon installation everything is setup, you can browse to root again and now it will display the login page (use the admin credentials)