Change TCP Payload with nfqueue/scapy

Question

Hello I am using nfqueue and scapy and I my goal is to recieve packets at my NFQUEUE, change the payload and resend them.

I can change fields like the TTL without any kind of problem, but when it comes to change the payload, I am encoutering problems.

When I change the payload, I sniff the packet with wireshark and apparently I send the packet with the payload modified, but the server doesn't answer.

This is my code:

#!/usr/bin/env python

import nfqueue
from scapy.all import *
def callback(payload):
    data = payload.get_data()
    pkt = IP(data)

    pkt[TCP].payload = str(pkt[TCP].payload).replace("ABC","GET")

    pkt[IP].ttl = 40

    print 'Data: '+ str(pkt[TCP].payload)
    print 'TTL: ' + str(pkt[IP].ttl)

    del pkt[IP].chksum
    payload.set_verdict_modified(nfqueue.NF_ACCEPT, str(pkt), len(pkt))
def main():
    q = nfqueue.queue()
    q.open()
    q.bind(socket.AF_INET)
    q.set_callback(callback)
    q.create_queue(0)
    try:
        q.try_run() # Main loop
    except KeyboardInterrupt:
        q.unbind(socket.AF_INET)
        q.close()

main()

I have set this rule for outgoing traffic to port 80: iptables -I OUTPUT -s 192.168.1.10 -p tcp --dport 80 -j NFQUEUE

And, to test it, for example I open telnet to google port 80, do a GET / HTTP/1.1 and this is what I see:

TTL: 40
DATA: GET / HTTP/1.1

Now, if I do ABC / HTTP/1.1 I receive no answer! My telnet just get stuck.

I have also tried on HTTP websites browers to browse something, check on wireshark how my TTL is really changing to 40, then, browse the string "ABC" and my browser again get stuck. I sniff the request changed to GET but I receive no answer.

Thank is kind of giving me a headache and I would really appreciate if someone with more experience could lead me to the right way. Thank you in advance.

Answer 1

I added the line for recalculate the TCP checksum, that was usefull.

That only works if I change payload I don't alter the lenght of it, otherwise, I would need to change the field length of the IP Header, and answering myself, and maybe other people that is looking for this answer, I achieve that just by doing:

payload_before = len(pkt[TCP].payload)

pkt[TCP].payload = str(pkt[TCP].payload).replace("Heading","Other string")

payload_after = len(pkt[TCP].payload)

payload_dif = payload_after - payload_before

pkt[IP].len = pkt[IP].len + payload_dif

I know that I have to change more fields, because sometimes, if you add enough payload for needing to fragment into a new packet, you have to change more fields.

Currently I don't know how to achieve this efficiently but little by little. Hope someone find my solution for altering the payload useful.

Answer 2

In the second case, you are tampering the TCP layer as well as the IP layer.

You're letting Scapy fix the IP checksum, but not the TCP one. Change del pkt[IP].chksum to del pkt[IP].chksum pkt[TCP].chksum in your code.