I'm not quite sure what you ask "[w]ould it be possible to do this with any existing software?" Are you asking whether there are existing software solutions that can inject scripts into a web session?
I'll assume you're asking the "why" and "how" it's done and the implications from a risk standpoint. First, when you're on a public network (hotel wifi is pretty public), the connection traverses the hotel's (usually outsourced to some vendor) network. With unencrypted HTTP traffic, an appliance (usually a linux-based device) can be deployed in line (logically or physically) to intercept, monitor, and modify traffic according to some defined ruleset/policy. Forward proxies are a fairly common implementation of devices that intercept outbound web traffic. Forward proxies can be deployed in such a way that all HTTP and HTTPS traffic is terminated at the proxy before continuing on to its intended destination.
Forward proxies (and other technologies to intercept, modify, monitor) are commonly deployed in corporate settings. They're also usually deployed in libraries, on Amtrak, gogo wireless inflight internet, and many other public areas). They're usually deployed to make sure people aren't doing things they shouldn't be doing and to protect the network provider from legal liability (i.e. kiddie porn). However, the technology can be deployed to enable more ... questionable objectives. In the case of the revenue extraction gateways (RXG's), they're implemented by network providers to make money off its users.
HTTPS sites pose a unique challenge. Because of the architecture and validation steps, the forward proxy has to be able to "fake" a "valid" cert that your browser trusts. Usually https interception is only implemented in corporate settings and on corporate networks (where the users don't really have much in the way of privacy). So, if you browser HTTPS sites at locations where RXG's are deployed, you probably won't be subject to 3rd-party script injection, malicious or otherwise. There has been verified reports where a public CA has cut a subCA for certain deployments, so there's no guarantees that an HTTPS site is legit unless you really know about PKI.