I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the other user. How can I use this to get shell access under their privileges/account?
It's less useful for me to just be able to run commands as them and more useful for me to actually be able to drop into a shell as them, because there's an application that verifies if I've succeeded in compromising the account properly, so I'd like to run that interactively.
The first thing that occurred to me was to spawn a netcat daemon and run my commands through that, but the -e option doesn't seem to exist on this compromised VM.
Thoughts/ideas? I've been racking my brains here for a while - and I know this is simple!
EDIT: I'm not looking for an answer/spoiler to the exercise I'm stuck on, but I feel there's a gap in the fundamental understanding I have of system security. I figure if I can't figure out how to exploit this hole, I'm missing some piece of information. I want that fundamental piece of information, not an answer to the actual problem I'm facing.