Harden Windows Server compatibility and system-wide proxy.

Fix exit-IP checks for HTTP-only proxies, apply proxy via WinINet Connections blob and WinHTTP, improve VPN detection on legacy Server, add SOCKS5 host:port:user:pass exit parsing, and add win_compat probe for PowerShell 2.0 hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/mac_spoof.py

@@ -8,6 +8,7 @@ import subprocess
 from dataclasses import dataclass
 
 from .firewall import is_admin
+from .win_compat import probe as _win_probe
 
 log = logging.getLogger(__name__)
 
@@ -36,7 +37,14 @@ def _run(args: list[str], timeout: float = 20.0) -> tuple[int, str, str]:
 
 
 def list_nics() -> list[NicMac]:
-    """Physical/up adapters with current MAC."""
+    """Physical/up adapters with current MAC.
+
+    Falls back to ``wmic nic`` for hosts without PowerShell 3.0 (Server 2008 R2).
+    """
+    compat = _win_probe()
+    if not compat.has_net_cmdlets:
+        return _list_nics_wmic()
+
     script = (
         "Get-NetAdapter | Where-Object { $_.Status -ne 'Disabled' } | "
         "Select-Object Name, MacAddress, InterfaceDescription | "
@@ -44,7 +52,7 @@ def list_nics() -> list[NicMac]:
     )
     code, out, _ = _run(["powershell", "-NoProfile", "-Command", script])
     if code != 0 or not out.strip():
-        return []
+        return _list_nics_wmic()
     import json
 
     try:
@@ -71,9 +79,46 @@ def random_mac() -> str:
     return ":".join(f"{x:02X}" for x in b)
 
 
+def _list_nics_wmic() -> list[NicMac]:
+    """Server 2008 R2 / PowerShell 2.0 fallback via wmic."""
+    code, out, _ = _run([
+        "wmic", "nic", "where", "NetEnabled=true",
+        "get", "NetConnectionID,MACAddress,Name", "/format:list",
+    ])
+    if code != 0 or not out:
+        return []
+    nics: list[NicMac] = []
+    cur = {"id": "", "mac": "", "name": ""}
+    for ln in out.splitlines():
+        s = ln.strip()
+        if not s:
+            if cur["id"] and cur["mac"]:
+                mac = cur["mac"].replace("-", ":")
+                if mac and mac != "00:00:00:00:00:00":
+                    nics.append(NicMac(name=cur["id"], mac=mac, description=cur["name"]))
+            cur = {"id": "", "mac": "", "name": ""}
+            continue
+        if s.startswith("NetConnectionID="):
+            cur["id"] = s.split("=", 1)[1].strip()
+        elif s.startswith("MACAddress="):
+            cur["mac"] = s.split("=", 1)[1].strip()
+        elif s.startswith("Name="):
+            cur["name"] = s.split("=", 1)[1].strip()
+    if cur["id"] and cur["mac"]:
+        mac = cur["mac"].replace("-", ":")
+        if mac and mac != "00:00:00:00:00:00":
+            nics.append(NicMac(name=cur["id"], mac=mac, description=cur["name"]))
+    return nics
+
+
 def set_mac(adapter: str, mac: str) -> tuple[bool, str]:
     if not is_admin():
         return False, "Administrator required to change MAC."
+    if not _win_probe().has_net_cmdlets:
+        return False, (
+            "MAC change requires PowerShell 3.0+ (Windows 8 / Server 2012+). "
+            "Detected legacy PowerShell — feature unavailable on this host."
+        )
     mac = mac.replace("-", ":").upper()
     if not _MAC_RE.match(mac.replace(":", "-")):
         return False, f"Invalid MAC: {mac}"