When I tried to run the python script and pcap file, it show AttributError: 'str' object has no attribute 'do_build' where I did installed Scapy in the VM.
The code looks like this:
The code looks like this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
from scapy. all import * import sys # Get input and output files from command line if len (sys.argv) < 2 : print "Usage: decodexorpayload.py [input pcap file]" sys.exit( 1 ) # Assign variable names for input and output files infile = sys.argv[ 1 ] def many_byte_xor(buf, key): buf = bytearray(buf) key = bytearray(key) key_len = len (key) for i, bufbyte in enumerate (buf): buf[i] = bufbyte ^ key[i % key_len] return str (buf) def process_packets(): pkts = rdpcap(infile) cooked = [] for p in pkts: # You may have to adjust the payload depth here: # i.e. p.payload.payload.payload pkt_payload = str (p.payload.payload) pkt_offset = str (p.payload.payload)[: 3 ] if pkt_payload and pkt_offset: pmod = p # You may have to adjust the payload depth here: p.payload.payload = many_byte_xor(pkt_payload, pkt_offset) cooked.append(pmod) wrpcap( "dump.pcap" , cooked) process_packets() |