You need to update SYSNAND to 9.0 or 9.2 so you can use PASTA CFW for ninjhax 2.
Then:
1. Download the latest boot.3dsx (ninjhax 2) from
https://smealum.github.io/ninjhax2/boot.3dsx . Copy the boot.3dsx onto root of the SD.
2. Dowload the PastaCFW files :
http://jheberg.net/captcha/pastacfw-for-ninjhax2-90-92/ . Create 3ds folder on root of the SD. Copy the PastaCFW folder inside the 3ds folder.
3. Setup Browserhax :
https://gbatemp.net/threads/yellows8s-browserhax-thread.398132/
4. Launch the HBL with browserhax.
5. Choose the PastaCFW
6. Enjoy!
Additionally, to use install Themehax/HomemenuHax:
1. Go to Home Menu Settings (the House icon on top left of the bottom screen) -> Change Theme -> Wait for the data to be created -> Exit back to Home Menu. Right now, it's not supporting custom themes (at least for common users) so better leave/restore it default.
2. Download the latest unofficial Themehax 1.3 here :
https://gbatemp.net/threads/release-homemenuhax.398124/page-23#post-5717329 . This is untethered version so you don't need internet access in case you need to reinstall later.
3. Copy "themehax_installer" folder from inside the zip you just downloaded, into "3DS" folder on your mSD
4. Start HBL using Browserhax.
5. Install ThemeHax (you can configure how you want trigger Themehax by just following on-screen instructions. If leave default, when turn on the 3DS, you need to hold L to trigger HBL). Now you are free to delete browserhax by reset the browser.
6. To launch PASTA CFW: when turn on your 3DS, depended on how you set up trigger, launch HBL. Then choose PASTA CFW. Enjoy!
Never mind. There's still nobody can convert PASTACFW.3dsx into cia one. You still need to be in a HAX mode to able to launch unsigned CIA. So the above steps is pretty much the same thing!