Carrier

I have inject commands via RCE, so I have the user.txt flag, but still haven’t managed to get a reverse shell, can some one point me in the right direction, have spent 7 days on this.