What a ride ... took me much more time than I thought. The way was pretty clear, but troubleshooting was a nightmare. But I learned much that way... Thanks @MrR3boot.
User: you need to be very quick. Even when scripted, it didn't work each time
Type your comment> @edspiner said:
Thanks for the pointer to PayloadAllTheThings, I always forget how useful this is .... . Wasn't able to construct a working exploit, but with PayloadAllTheThings it was quite easy.