Installing Inguma, Bokken, Pyew and Radare2 in Ubuntu

In this post we’ll see how to install Inguma, Bokken, Pyew and Radare2 in Ubuntu 11.10.

Inguma is a penetration testing and vulnerability research toolkit written in Python.

Bokken is a GUI for the Pyew malware analysis tool and the Radare reverse engineering framework, and it’s part of the Inguma project.

Installing Inguma

In order to install Inguma, first of all, we need some pre-requisites installed. These steps are also explained at http://inguma.eu/projects/inguma/wiki/Installation


francisco@sherminator$ tar -zxvf Impacket-0.9.6.0.tar.gz

francisco@sherminator$ cd Impacket-0.9.6.0/

francisco@sherminator$ sudo python setup.py install

francisco@sherminator$ tar -zxvf paramiko-1.7.7.1.tar.gz

francisco@sherminator$ cd paramiko-1.7.7.1/

francisco@sherminator$ sudo python setup.py install
  • Pysnmp (easy_install pysnmp)

francisco@sherminator$ sudo easy_install pysnmp

  • python-crypto (apt-get install python-crypto)

francisco@sherminator$ sudo apt-get install python-crypto

  • python-scapy (apt-get install python-scapy)

francisco@sherminator$ sudo apt-get install python-scapy

Once we have the Inguma dependencies installed, we can proceed to install Inguma itself. The latest version is available at http://inguma.eu/projects/inguma/files


francisco@sherminator$ tar -zxvf inguma-0.4.tar.gz

francisco@sherminator$ sudo mv inguma-0.4/ /opt/

francisco@sherminator$ cd /opt/inguma-0.4/

Let’s run python inguma.py, and there you have Inguma up and running:

Inguma running

Installing Bokken

Let’s start installing the Bokken dependencies, which are graphviz, PyGtk and GtkSourceview2:


francisco@sherminator$ sudo apt-get install graphviz

francisco@sherminator$ sudo apt-get install python-gtk2

francisco@sherminator$ sudo apt-get install python-gtksourceview2

The latest version of Bokken can be found at http://inguma.eu/projects/bokken/files. After downloading the .tar.gz file, just decompress it and move it wherever you want:


francisco@sherminator$ tar -zxvf bokken-1.5.tar.gz

francisco@sherminator$ sudo mv bokken/ /opt/

francisco@sherminator$ cd /opt/bokken/

Let’s run ./bokken. But it refuses to run, because it still has no backend installed.

Bokken without backends

Installing Pyew

Bokken supports pyew and radare as backends. Let’s try to use pyew in the first place, as it seems easier to install. Grab the latest version of pyew from http://code.google.com/p/pyew/downloads/list. Decompress it and move the pyew files to the bokken folder:


francisco@sherminator$ tar -zxvf pyew-2.0-linux-x86.tar.gz

francisco@sherminator$ cd pyew-2.0-linux/

francisco@sherminator$ mv * /opt/bokken/

Let’s try running ./bokken again:
Bokken without r2 bindings

Ooops, looks like it’s mandatory to also have radare2 and its Python bindings installed on the system.

Installing radare2

So go to the radare website and grab the latest release. As usual, decompress the .tar.gz file, and then build radare2 with the classical configure/make/make install:


francisco@sherminator$ tar -zxvf radare2-0.9.tar.gz

francisco@sherminator$ cd radare2-0.9/

francisco@sherminator$ ./configure

francisco@sherminator$ make

francisco@sherminator$ sudo make install

Let’s check if it’s correctly installed and try to run radare2:

Ok, so the shared library libr_core.so.0.9 could not be loaded. Let’s see if it’s installed somewhere on the system:

So it’s located at /usr/local/lib/libr_core.so.0.9, but radare2 was not able to find and load it. We can fix this by using the ldconfig tool to specify a path to shared libraries that will be accessible by the runtime linker.

After that, let’s retry running radare2 specifying an executable file as parameter… now we finally have radare2 working too!

radare2 running

Installing radare2 Python bindings

But unfortunately we are still not able to use radare2 as a backend for Bokken; we still need to install the radare2 Python bindings. Go back to the radare website and download the latest binding packages (r2-bindings-0.9.tar.gz at the time of  this writing). As usual, let’s start by decompressing the .tar.gz file:


francisco@sherminator$ tar -zxvf r2-bindings-0.9.tar.gz

francisco@sherminator$ cd r2-bindings-0.9/

The instructions for building the radare2 bindings are available in the README file included in the package. Since right now we are only interested in the radare2 bindings just for the Python language, the only one dependency we’ll have is swig. Let’s install it:


francisco@sherminator$ sudo apt-get install swig

Then we can run ./configure –prefix=/usr –enable=python:


The next step is to switch to the python directory and then run PYTHON_CONFIG=python2.7-config make, as specified in the README file:


But we fail because we do not have the Python.h headers file installed. We can obtain it by installing the python2.7-dev package:


francisco@sherminator$ sudo apt-get install python2.7-dev

After installing the python2.7-dev package we succeed when running again PYTHON_CONFIG=python2.7-config make:


Finally, switch to the root user, go back to the folder where you decompressed the radare2 bindings package, and run PYTHON_CONFIG=python2.7-config make install. You should see something like this:

Now we should be able to successfully run Bokken on our machine. Switch to the directory where you have Bokken installed and run ./bokken:

Yeah!  We made it. Now try loading an executable file in Bokken, using radare2 as the backend:

And now let’s try Bokken with Pyew as backend:

Great! We finally finished the installation process. Now go and give Inguma and Bokken a try!

Advertisements

One thought on “Installing Inguma, Bokken, Pyew and Radare2 in Ubuntu

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s