Okay it seems that one possible way to get the user.txt is to work with a reverse shell. I have a theory but am struggling to implement correctly. If somebody could PM me so I dont give what little I know away in the event that I’m moving in the right direction, I would be very grateful. Thankyou ahead of time!