When I tried to run the python script and pcap file, it show AttributError: 'str' object has no attribute 'do_build' where I did installed Scapy in the VM.
The code looks like this:
The code looks like this:
from scapy.all import *
import sys
# Get input and output files from command line
if len(sys.argv) < 2:
print "Usage: decodexorpayload.py [input pcap file]"
sys.exit(1)
# Assign variable names for input and output files
infile = sys.argv[1]
def many_byte_xor(buf, key):
buf = bytearray(buf)
key = bytearray(key)
key_len = len(key)
for i, bufbyte in enumerate(buf):
buf[i] = bufbyte ^ key[i % key_len]
return str(buf)
def process_packets():
pkts = rdpcap(infile)
cooked=[]
for p in pkts:
# You may have to adjust the payload depth here:
# i.e. p.payload.payload.payload
pkt_payload = str(p.payload.payload)
pkt_offset = str(p.payload.payload)[:3]
if pkt_payload and pkt_offset:
pmod=p
# You may have to adjust the payload depth here:
p.payload.payload=many_byte_xor(pkt_payload, pkt_offset)
cooked.append(pmod)
wrpcap("dump.pcap", cooked)
process_packets()
