If you can create a process that will run as the victim user, you already have shell access under their privileges. Anything the victim can do, your program can do. So you've already won, you just haven't realized it yet!

(One simple example: Why do you need a shell? If there's something you want to do with the victim's privilegs, why don't you hard-code into your program what actions you want to do?)

If you really want to set up an interactive shell, that's doable too. I could tell you several ways to do it, but you said you don't want spoilers, so let me just try to give you some hints without answering it flat-out.

1. You mentioned that running netcat would be one way to achieve your goals, however the version of netcat installed on their system is out of date. If Alice wanted to install a program for her own use, could she? If you have access to Alice's account and can do anything Alice can do, does that give you any ideas?

2. How is netcat implemented, internally? How does it work? Could you do something like that yourself?

3. Let's say you've compromised Alice's account. What are some ways that Alice could log into her account? Sure, she could log in with your login password, but what else?

4. Is there anything Alice could do to give one of her friends the ability to log into her account, if she wanted? What are some ways she could do that? If you have the ability to do anything Alice can do, does that give you any ideas for something you could do to get access to her account?

5. If you run ls -a from some user's home directory, what do you see? What do those crazy files do? Does that give you any ideas?

Hopefully that's enough to get you thinking!

If you can create a process that will run as the victim user, you already have shell access under their privileges. Anything the victim can do, your program can do. So you've already won, you just haven't realized it yet!

(One simple example: Why do you need a shell? If there's something you want to do with the victim's privilegs, why don't you hard-code into your program what actions you want to do?)

If you really want to set up an interactive shell, that's doable too. I could tell you several ways to do it, but you said you don't want spoilers, so let me just try to give you some hints without answering it flat-out.

1. You mentioned that running netcat would be one way to achieve your goals, however the version of netcat installed on their system is out of date. If Alice wanted to install a program for her own use, could she? If you have access to Alice's account and can do anything Alice can do, does that give you any ideas?

2. How is netcat implemented, internally? How does it work? Could you do something like that yourself?

3. Let's say you've compromised Alice's account. What are some ways that Alice could log into her account? Sure, she could log in with her login password, but what else?

4. Is there anything Alice could do to give one of her friends the ability to log into her account, if she wanted? What are some ways she could do that? If you have the ability to do anything Alice can do, does that give you any ideas for something you could do to get access to her account?

5. If you run ls -a from some user's home directory, what do you see? What do those crazy files do? Does that give you any ideas?

Hopefully that's enough to get you thinking!