I am conducting a pentest where I got stuck on the following problem:
I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without any success. I tried
- to read log files (apache log files, mail log files, mysql log files, ssh log files, etc.) but none of them were readable (probably due to the missing permissions)
- I tried .ssh/authorized_keys etc. but it is disabled as per sshd config file
- I tried all possible files on LFI I could find on the Internet and did get some config files but I could not extract any useful information on how to proceed
- The only thing I could recover are 2 user names via the /etc/passwd file
Other information I know:
- the server is running a mysql database, I do have the db username, db password and database name, but how can i further exploit it if I cannot ssh on the server due to missing credentials?
- the server has SSH running
Any other ideas how I could proceed?