Filter bypass of ZIP files containing ELF files

[TheMythologist]

Expected Behavior

Linux is disabled in custom/conf configuration files. When submitting any form of ELF files, the submission will be blocked.

Current Behavior

If a ZIP file containing an ELF file is submitted, the submission will go through. This is because the machine platform is determined before demux_sample_and_add_to_db is called (which will unzip the file and go through the zip file contents).

Location of code logic error: https://github.com/kevoreilly/CAPEv2/blob/30a071c3cd088cf53790afade1b9f22c9f20dc33/lib/cuckoo/common/web_utils.py#L691-L714

A possible fix would be to run get_platform only after demuxing the submitted sample.

[doomedraven]

interesting, why there is elf(just as curiosity)? could you PR the solution please?

[doomedraven]

do you have hash to test?

[TheMythologist]

Nope I have no hash (it works on all zip files with an elf file inside). We were just testing for bugs in the code and we just realised that there is this bug.

[doomedraven]

fixed here thank you https://github.com/kevoreilly/CAPEv2/pull/1414